Infisical

Infisical can rotate Phaseo Gateway API keys by authenticating with a scoped Phaseo Management API key. Phaseo already exposes the key lifecycle required for dual-phase, zero-downtime rotation.

Phaseo is not yet a selectable App Connection in Infisical. This page documents the supported Phaseo contract and the configuration to use once the Infisical connection is available.

How rotation works

Infisical authenticates to Phaseo with a Management API key.
Infisical creates a replacement Gateway API key with POST /v1/keys.
Infisical stores the returned plaintext key in the configured secret.
The application begins using the replacement key.
Infisical revokes the previous key with DELETE /v1/keys/{id}.

Phaseo returns a Gateway API key’s plaintext value only when it is created. The old and replacement keys can overlap while the secret is updated.

Create a scoped Management API key

In Dashboard → Settings → Management Keys, create a key with these capabilities:

keys:read to validate the connection and inspect managed keys
keys:write to create replacement keys
keys:delete to revoke previous keys

Store the resulting phaseo_v1_mk_... secret in Infisical. Management API keys are control-plane credentials and cannot be used for inference.

Connection details

Field	Value
Base URL	`https://api.phaseo.app/v1`
Authentication	`Authorization: Bearer <PHASEO_MANAGEMENT_KEY>`
Validate	`GET /keys`
List Gateway keys	`GET /keys`
Create Gateway key	`POST /keys`
Revoke Gateway key	`DELETE /keys/{id}`

Create a rotated key

curl https://api.phaseo.app/v1/keys \
  -H "Authorization: Bearer $PHASEO_MANAGEMENT_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "infisical-production",
    "limit": 100,
    "limit_reset": "monthly",
    "include_byok_in_limit": false
  }'

The response contains the new Gateway key once in data.key, plus its stable identifier in data.id.

Revoke the previous key

curl -X DELETE https://api.phaseo.app/v1/keys/$PREVIOUS_KEY_ID \
  -H "Authorization: Bearer $PHASEO_MANAGEMENT_KEY"

Deletion is idempotent. A key that is already deleted returns a successful deleted state, which makes rotation retries safe.

Limits and BYOK

Phaseo accepts the compatibility fields limit, limit_reset, and include_byok_in_limit. Supported reset periods are daily, weekly, and monthly. include_byok_in_limit is currently compatibility-only; Phaseo excludes BYOK usage from this key-limit field.

Partner status

A native Infisical connection requires a Phaseo App Connection and Phaseo API Key Rotation implementation to be accepted into Infisical. Phaseo’s management and key lifecycle APIs are already available; the remaining work is the Infisical-side connector, tests, UI entry, and documentation.

Overview

Models & Routing

Features

Integrations

Workspace & Access

Reliability & Operations

Platform & Research

Migration Guides

Community

How rotation works

Create a scoped Management API key

Connection details

Create a rotated key

Revoke the previous key

Limits and BYOK

Partner status

​How rotation works

​Create a scoped Management API key

​Connection details

​Create a rotated key

​Revoke the previous key

​Limits and BYOK

​Partner status

​Related

How rotation works

Create a scoped Management API key

Connection details

Create a rotated key

Revoke the previous key

Limits and BYOK

Partner status

Related