> ## Documentation Index
> Fetch the complete documentation index at: https://phaseo.app/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Infisical

> Prepare automatic Phaseo API key rotation with Infisical.

Infisical can rotate Phaseo Gateway API keys by authenticating with a scoped Phaseo Management API key. Phaseo already exposes the key lifecycle required for dual-phase, zero-downtime rotation.

<Warning>
  Phaseo is not yet a selectable App Connection in Infisical. This page documents the supported Phaseo contract and the configuration to use once the Infisical connection is available.
</Warning>

## How rotation works

1. Infisical authenticates to Phaseo with a Management API key.
2. Infisical creates a replacement Gateway API key with `POST /v1/keys`.
3. Infisical stores the returned plaintext key in the configured secret.
4. The application begins using the replacement key.
5. Infisical revokes the previous key with `DELETE /v1/keys/{id}`.

Phaseo returns a Gateway API key's plaintext value only when it is created. The old and replacement keys can overlap while the secret is updated.

## Create a scoped Management API key

In **Dashboard → Settings → Management Keys**, create a key with these capabilities:

* `keys:read` to validate the connection and inspect managed keys
* `keys:write` to create replacement keys
* `keys:delete` to revoke previous keys

Store the resulting `phaseo_v1_mk_...` secret in Infisical. Management API keys are control-plane credentials and cannot be used for inference.

## Connection details

| Field              | Value                                           |
| ------------------ | ----------------------------------------------- |
| Base URL           | `https://api.phaseo.app/v1`                     |
| Authentication     | `Authorization: Bearer <PHASEO_MANAGEMENT_KEY>` |
| Validate           | `GET /keys`                                     |
| List Gateway keys  | `GET /keys`                                     |
| Create Gateway key | `POST /keys`                                    |
| Revoke Gateway key | `DELETE /keys/{id}`                             |

## Create a rotated key

```bash theme={null}
curl https://api.phaseo.app/v1/keys \
  -H "Authorization: Bearer $PHASEO_MANAGEMENT_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "infisical-production",
    "limit": 100,
    "limit_reset": "monthly",
    "include_byok_in_limit": false
  }'
```

The response contains the new Gateway key once in `data.key`, plus its stable identifier in `data.id`.

## Revoke the previous key

```bash theme={null}
curl -X DELETE https://api.phaseo.app/v1/keys/$PREVIOUS_KEY_ID \
  -H "Authorization: Bearer $PHASEO_MANAGEMENT_KEY"
```

Deletion is idempotent. A key that is already deleted returns a successful deleted state, which makes rotation retries safe.

## Limits and BYOK

Phaseo accepts the compatibility fields `limit`, `limit_reset`, and `include_byok_in_limit`. Supported reset periods are daily, weekly, and monthly. `include_byok_in_limit` is currently compatibility-only; Phaseo excludes BYOK usage from this key-limit field.

## Partner status

A native Infisical connection requires a Phaseo App Connection and Phaseo API Key Rotation implementation to be accepted into Infisical. Phaseo's management and key lifecycle APIs are already available; the remaining work is the Infisical-side connector, tests, UI entry, and documentation.

## Related

* [Management API Keys](../../developers/management-api-keys.mdx)
* [Create API key](../../api-reference/endpoint/keys-create.mdx)
* [Delete API key](../../api-reference/endpoint/keys-delete.mdx)