Azure Key Vault vs Infisical

Azure Key Vault

Access runs on Microsoft Entra ID tokens and Azure roles that can be scoped to one secret, with soft delete, a 99.99 per cent SLA and a public OpenAPI contract. Secret rotation needs an Event Grid trigger and a function the owner writes, audit logging is off until enabled, and an Azure subscription needs a person and a payment card.

Infisical

Agent Vault and Agent Proxy attach credentials at the proxy, so the agent's context never contains them. Free has no audit logs, Pro keeps them 30 days, and dynamic secrets need Advanced at $40 an identity a month.

Azure Key Vault

1. Request a token for the resource https://vault.azure.net and send it as a Bearer header. Every call must carry api-version, such as 2025-07-01, because there is no default
2. Ask for the Key Vault Secrets User role on the vault or the single secret. Key Vault Reader returns metadata only, not values
3. Cache secret values in memory. A vault allows 4,000 reads and 300 secret creations per 10 seconds, and a subscription five times that
4. On 429 wait 1, 2, 4, 8 then 16 seconds. Throttled requests do not count against the limit
5. Don't retry Set Secret blindly. Each successful call creates a new version of the secret

Infisical

1. Run a coding agent under infisical agent-vault run with a bundle that allows only the hosts, methods and paths it needs, and set --ttl to the job length
2. Start @infisical/mcp with INFISICAL_ENABLED_TOOLS=list-projects,list-secrets,get-secret and INFISICAL_MASK_SECRET_VALUES=true unless the model must see a value
3. Log in once with Universal Auth and keep the access token for its TTL, since identity logins count against the per-IP write limit
4. Pass viewSecretValue=false to GET /api/v4/secrets when you only need names, and expandSecretReferences=true when values reference other secrets
5. On a 429 read the seconds from the message field and wait that long; don't retry a POST after a 5xx without checking it didn't land