Quickstart

Manage secrets with Infisical CLI

The CLI is designed for a variety of secret management applications ranging from local development to CI/CD and production scenarios.

Local development

In the following steps, we explore how to use the Infisical CLI to fetch back environment variables from Infisical and inject them into your local development process.

1. Log in with the CLI

   Start by running the infisical login command to authenticate with Infisical.

   infisical login
   

   If you are in a containerized environment such as WSL 2 or Codespaces, run infisical login -i to avoid browser based login

2. Initialize Infisical for your project

   Next, navigate to your project and initialize Infisical.

   # navigate to your project
   cd /path/to/project
   
   # initialize infisical
   infisical init
   

   The infisical init command creates a .infisical.json file, containing local project settings, at the location where the command is executed.

   The .infisical.json file does not contain any sensitive data, so you may commit it to your git repository.

3. Inject environment variables

   Finally, pass environment variables from Infisical into your application.

   Feed secrets to your application

   infisical run --env=dev --path=/apps/firefly -- [your application start command] # e.g. npm run dev
   
   # example with node (nodemon)
   infisical run --env=staging --path=/apps/spotify -- nodemon index.js
   
   # example with flask
   infisical run --env=prod --path=/apps/backend -- flask run
   
   # example with spring boot - maven
   infisical run --env=dev --path=/apps/ -- ./mvnw spring-boot:run --quiet
   

   View all available options for run command here

History

Your terminal keeps a history with the commands you run. When you create Infisical secrets directly from your terminal, they’ll stay there for a while.

For security and privacy concerns, we recommend you to configure your terminal to ignore those specific Infisical commands.

Ignore commands

Unix/Linux

$HOME/.profile is pretty common but, you could place it under $HOME/.profile.d/infisical.sh or any profile file run at login

cat <<EOF >> $HOME/.profile && source $HOME/.profile

# Ignoring specific Infisical CLI commands
DEFAULT_HISTIGNORE=$HISTIGNORE
export HISTIGNORE="*infisical secrets set*:$DEFAULT_HISTIGNORE"
EOF

FAQ

Can I connect the CLI to my self-hosted Infisical instance?

Yes. The CLI is set to connect to Infisical Cloud by default, but if you’re running your own instance of Infisical, you can direct the CLI to it using one of the methods provided below.

Method 1: Use the updated CLI

Beginning with CLI version V0.4.0, it is now possible to choose between logging in through the Infisical cloud or your own self-hosted instance. Simply execute the infisical login command and follow the on-screen instructions.

Method 2: Export environment variable

You can point the CLI to the self hosted Infisical instance by exporting the environment variable INFISICAL_API_URL in your terminal.

Linux/MacOs

# set backend host
export INFISICAL_API_URL="https://your-self-hosted-infisical.com/api"

# remove backend host
unset INFISICAL_API_URL

Method 3: Set manually on every command

Another option to point the CLI to your self hosted Infisical instance is to set it via a flag on every command you run.

# Example
infisical <any-command> --domain="https://your-self-hosted-infisical.com/api"

Can I use the CLI with service tokens?

Yes. Please note, however, that service tokens are being deprecated in favor of machine identities. They will be removed in the future in accordance with the deprecation notice and timeline stated here.

To use Infisical for non local development scenarios, please create a service token. The service token will allow you to authenticate and interact with Infisical. Once you have created a service token with the required permissions, you’ll need to feed the token to the CLI.

  infisical export --token=<service-token>
  infisical secrets --token=<service-token>
  infisical run --token=<service-token> -- npm run dev

Pass via shell environment variable

The CLI is configured to look for an environment variable named INFISICAL_TOKEN. If set, it’ll attempt to use it for authentication.

  export INFISICAL_TOKEN=<service-token>