Infisical vs Phase

Infisical

Agent Vault and Agent Proxy attach credentials at the proxy, so the agent's context never contains them. Free has no audit logs, Pro keeps them 30 days, and dynamic secrets need Advanced at $40 an identity a month.

Phase

Service account tokens can be minted with an expiry over the API, every secret read is logged, and the CLI redacts values when it detects an AI agent. No OpenAPI document or pagination was found in the reviewed documentation, and the Free plan keeps audit logs for 24 hours.

Infisical

1. Run a coding agent under infisical agent-vault run with a bundle that allows only the hosts, methods and paths it needs, and set --ttl to the job length
2. Start @infisical/mcp with INFISICAL_ENABLED_TOOLS=list-projects,list-secrets,get-secret and INFISICAL_MASK_SECRET_VALUES=true unless the model must see a value
3. Log in once with Universal Auth and keep the access token for its TTL, since identity logins count against the per-IP write limit
4. Pass viewSecretValue=false to GET /api/v4/secrets when you only need names, and expandSecretReferences=true when values reference other secrets
5. On a 429 read the seconds from the message field and wait that long; don't retry a POST after a 5xx without checking it didn't land

Phase

1. Enable server-side encryption on the app before calling /v1/secrets. Without it the REST API cannot read or write that app's secrets
2. Send Authorization: Bearer ServiceAccount <token> for a service account and Bearer User <token> for a personal access token. The token type is part of the header
3. Stay under 120 requests a minute per account on Free and 240 on Pro, and wait the seconds in the retry-after header on a 429
4. Treat a 409 on POST /v1/secrets as the key already existing at that path, and use PUT to change it. Rotating secrets reject PUT and DELETE
5. Have a person run phase ai enable and choose masked values. The CLI blocks an agent from running phase ai enable or phase ai disable itself