infisical run

The command that injects your secrets into local environment

• Single command
• Chained commands

infisical run [options] -- [your application start command]

# Example
infisical run [options] -- npm run dev

Description

Inject secrets from Infisical into your application process.

Subcommands & flags

infisical run

Use this command to inject secrets into your applications process

$ infisical run -- <your application command>

# Example
$ infisical run -- npm run dev

Environment variables

INFISICAL_TOKEN

Used to fetch secrets via a machine identity apposed to logged in credentials. Simply, export this variable in the terminal before running this command.

# Example
export INFISICAL_TOKEN=$(infisical login --method=universal-auth --client-id=<identity-client-id> --client-secret=<identity-client-secret> --silent --plain) # --plain flag will output only the token, so it can be fed to an environment variable. --silent will disable any update messages.

Alternatively, you may use service tokens.

Please note, however, that service tokens are being deprecated in favor of machine identities. They will be removed in the future in accordance with the deprecation notice and timeline stated here.

# Example
export INFISICAL_TOKEN=<service-token>

INFISICAL_DISABLE_UPDATE_CHECK

Used to disable the check for new CLI versions. This can improve the time it takes to run this command. Recommended for production environments.

To use, simply export this variable in the terminal before running this command.

# Example
export INFISICAL_DISABLE_UPDATE_CHECK=true

Flags

--project-config-dir

Explicitly set the directory where the .infisical.json resides. This is useful for some monorepo setups.

# Example
infisical run --project-config-dir=/some-dir -- printenv

--command

Pass secrets into multiple commands at once

# Example
infisical run --command="npm run build && npm run dev; more-commands..."

--projectId

The project ID to fetch secrets from. This is required when using a machine identity to authenticate.

# Example
infisical run --projectId=<project-id> -- npm run dev

--token

If you are using a machine identity to authenticate, you can pass the token as a flag

# Example
infisical run --token="<universal-auth-access-token>" --projectId=<project-id> -- npm run start

You may also expose the token to the CLI by setting the environment variable INFISICAL_TOKEN before executing the run command. This will have the same effect as setting the token with --token flag

--expand

Turn on or off the shell parameter expansion in your secrets. If you have used shell parameters in your secret(s), activating this feature will populate them before injecting them into your application process.

Default value: true

--include-imports

By default imported secrets are available, you can disable it by setting this option to false.

Default value: true

--env

This is used to specify the environment from which secrets should be retrieved. The accepted values are the environment slugs defined for your project, such as dev, staging, test, and prod. Default value: dev

--secret-overriding

Prioritizes personal secrets with the same name over shared secrets

Default value: true

--tags

When working with tags, you can use this flag to filter and retrieve only secrets that are associated with a specific tag(s).

# Example
infisical run --tags=tag1,tag2,tag3 -- npm run dev

Note: you must reference the tag by its slug name not its fully qualified name. Go to project settings to view all tag slugs.

By default, all secrets are fetched

--path

The --path flag indicates which project folder secrets will be injected from.

# Example
infisical run --path="/nextjs" -- npm run dev