Infisical Go SDK

If you’re working with Go Lang, the official Infisical Go SDK package is the easiest way to fetch and work with secrets for your application.

• Package
• Github Repository

Basic Usage

package main

import (
	"fmt"
	"os"

	infisical "github.com/infisical/go-sdk"
)

func main() {

	client, err := infisical.NewInfisicalClient(infisical.Config{
		SiteUrl: "https://app.infisical.com", // Optional, default is https://app.infisical.com
	})

	if err != nil {
		fmt.Printf("Error: %v", err)
		os.Exit(1)
	}

	_, err = client.Auth().UniversalAuthLogin("YOUR_CLIENT_ID", "YOUR_CLIENT_SECRET")

	if err != nil {
		fmt.Printf("Authentication failed: %v", err)
		os.Exit(1)
	}

	apiKeySecret, err := client.Secrets().Retrieve(infisical.RetrieveSecretOptions{
		SecretKey:   "API_KEY",
		Environment: "dev",
		ProjectID:   "YOUR_PROJECT_ID",
		SecretPath:  "/",
	})

	if err != nil {
		fmt.Printf("Error: %v", err)
		os.Exit(1)
	}

	fmt.Printf("API Key Secret: %v", apiKeySecret)

}

This example demonstrates how to use the Infisical Go SDK in a simple Go application. The application retrieves a secret named API_KEY from the dev environment of the YOUR_PROJECT_ID project.

We do not recommend hardcoding your Machine Identity Tokens. Setting it as an environment variable would be best.

Installation

$ go get github.com/infisical/go-sdk

Configuration

Import the SDK and create a client instance.

client, err := infisical.NewInfisicalClient(infisical.Config{
		SiteUrl: "https://app.infisical.com", // Optional, default is https://api.infisical.com
	})

if err != nil {
  fmt.Printf("Error: %v", err)
  os.Exit(1)
}

ClientSettings methods

options

object

Show properties

SiteUrl

string

The URL of the Infisical API. Default is https://api.infisical.com.

UserAgent

string

required

Optionally set the user agent that will be used for HTTP requests. (Not recommended)

Authentication

The SDK supports a variety of authentication methods. The most common authentication method is Universal Auth, which uses a client ID and client secret to authenticate.

Universal Auth

Using environment variables

Call .Auth().UniversalAuthLogin() with empty arguments to use the following environment variables:

• INFISICAL_UNIVERSAL_AUTH_CLIENT_ID - Your machine identity client ID.
• INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET - Your machine identity client secret.

Using the SDK directly

_, err := client.Auth().UniversalAuthLogin("CLIENT_ID", "CLIENT_SECRET")

if err != nil {
  fmt.Println(err)
  os.Exit(1)
}

GCP ID Token Auth

Please note that this authentication method will only work if you’re running your application on Google Cloud Platform. Please read more about this authentication method.

Using environment variables

Call .Auth().GcpIdTokenAuthLogin() with empty arguments to use the following environment variables:

• INFISICAL_GCP_AUTH_IDENTITY_ID - Your Infisical Machine Identity ID.

Using the SDK directly

_, err := client.Auth().GcpIdTokenAuthLogin("YOUR_MACHINE_IDENTITY_ID")

if err != nil {
  fmt.Println(err)
  os.Exit(1)
}

GCP IAM Auth

Using environment variables

Call .Auth().GcpIamAuthLogin() with empty arguments to use the following environment variables:

• INFISICAL_GCP_IAM_AUTH_IDENTITY_ID - Your Infisical Machine Identity ID.
• INFISICAL_GCP_IAM_SERVICE_ACCOUNT_KEY_FILE_PATH - The path to your GCP service account key file.

Using the SDK directly

_, err = client.Auth().GcpIamAuthLogin("MACHINE_IDENTITY_ID", "SERVICE_ACCOUNT_KEY_FILE_PATH")

if err != nil {
  fmt.Println(err)
  os.Exit(1)
}

AWS IAM Auth

Please note that this authentication method will only work if you’re running your application on AWS. Please read more about this authentication method.

Using environment variables

Call .Auth().AwsIamAuthLogin() with empty arguments to use the following environment variables:

• INFISICAL_AWS_IAM_AUTH_IDENTITY_ID - Your Infisical Machine Identity ID.

Using the SDK directly

_, err = client.Auth().AwsIamAuthLogin("MACHINE_IDENTITY_ID")

if err != nil {
  fmt.Println(err)
  os.Exit(1)
}

Azure Auth

Please note that this authentication method will only work if you’re running your application on Azure. Please read more about this authentication method.

Using environment variables

Call .Auth().AzureAuthLogin() with empty arguments to use the following environment variables:

• INFISICAL_AZURE_AUTH_IDENTITY_ID - Your Infisical Machine Identity ID.

Using the SDK directly

_, err = client.Auth().AzureAuthLogin("MACHINE_IDENTITY_ID")

if err != nil {
  fmt.Println(err)
  os.Exit(1)
}

Kubernetes Auth

Please note that this authentication method will only work if you’re running your application on Kubernetes. Please read more about this authentication method.

Using environment variables

Call .Auth().KubernetesAuthLogin() with empty arguments to use the following environment variables:

• INFISICAL_KUBERNETES_IDENTITY_ID - Your Infisical Machine Identity ID.
• INFISICAL_KUBERNETES_SERVICE_ACCOUNT_TOKEN_PATH_ENV_NAME - The environment variable name that contains the path to the service account token. This is optional and will default to /var/run/secrets/kubernetes.io/serviceaccount/token.

Using the SDK directly

// Service account token path will default to /var/run/secrets/kubernetes.io/serviceaccount/token if empty value is passed
_, err = client.Auth().KubernetesAuthLogin("MACHINE_IDENTITY_ID", "SERVICE_ACCOUNT_TOKEN_PATH")

if err != nil {
  fmt.Println(err)
  os.Exit(1)
}

Working with Secrets

client.Secrets().List(options)

secrets, err := client.Secrets().List(infisical.ListSecretsOptions{
  ProjectID:          "PROJECT_ID",
  Environment:        "dev",
  SecretPath:         "/foo/bar",
  AttachToProcessEnv: false,
})

Retrieve all secrets within the Infisical project and environment that client is connected to

Parameters

Parameters

object

Show properties

Environment

string

required

The slug name (dev, prod, etc) of the environment from where secrets should be fetched from.

ProjectID

string

The project ID where the secret lives in.

SecretPath

string

The path from where secrets should be fetched from.

AttachToProcessEnv

boolean

default: "false"

Whether or not to set the fetched secrets to the process environment. If true, you can access the secrets like so System.getenv("SECRET_NAME").

IncludeImports

boolean

default: "false"

Whether or not to include imported secrets from the current path. Read about secret import

Recursive

boolean

default: "false"

Whether or not to fetch secrets recursively from the specified path. Please note that there’s a 20-depth limit for recursive fetching.

ExpandSecretReferences

boolean

default: "true"

Whether or not to expand secret references in the fetched secrets. Read about secret reference

client.Secrets().Retrieve(options)

secret, err := client.Secrets().Retrieve(infisical.RetrieveSecretOptions{
  SecretKey:   "API_KEY",
  ProjectID:   "PROJECT_ID",
  Environment: "dev",
})

Retrieve a secret from Infisical.

By default, Secrets().Retrieve() fetches and returns a shared secret.

Parameters

Parameters

object

Show properties

SecretKey

string

required

The key of the secret to retrieve.

ProjectID

string

required

The project ID where the secret lives in.

Environment

string

required

The slug name (dev, prod, etc) of the environment from where secrets should be fetched from.

SecretPath

string

The path from where secret should be fetched from.

Type

string

The type of the secret. Valid options are “shared” or “personal”. If not specified, the default value is “shared”.

client.Secrets().Create(options)

secret, err := client.Secrets().Create(infisical.CreateSecretOptions{
  ProjectID:   "PROJECT_ID",
  Environment: "dev",

  SecretKey:     "NEW_SECRET_KEY",
  SecretValue:   "NEW_SECRET_VALUE",
  SecretComment: "This is a new secret",
})

Create a new secret in Infisical.

Parameters

Parameters

object

Show properties

SecretKey

string

required

The key of the secret to create.

SecretValue

string

required

The value of the secret.

SecretComment

string

A comment for the secret.

ProjectID

string

required

The project ID where the secret lives in.

Environment

string

required

The slug name (dev, prod, etc) of the environment from where secrets should be fetched from.

SecretPath

string

The path from where secret should be created.

Type

string

The type of the secret. Valid options are “shared” or “personal”. If not specified, the default value is “shared”.

client.Secrets().Update(options)

secret, err := client.Secrets().Update(infisical.UpdateSecretOptions{
  ProjectID:                "PROJECT_ID",
  Environment:              "dev",
  SecretKey:                "NEW_SECRET_KEY",
  NewSecretValue:           "NEW_SECRET_VALUE",
  NewSkipMultilineEncoding: false,
})

Update an existing secret in Infisical.

Parameters

Parameters

object

Show properties

SecretKey

string

required

The key of the secret to update.

NewSecretValue

string

required

The new value of the secret.

NewSkipMultilineEncoding

boolean

default: "false"

Whether or not to skip multiline encoding for the new secret value.

ProjectID

string

required

The project ID where the secret lives in.

Environment

string

required

The slug name (dev, prod, etc) of the environment from where secrets should be fetched from.

SecretPath

string

The path from where secret should be updated.

Type

string

The type of the secret. Valid options are “shared” or “personal”. If not specified, the default value is “shared”.

client.Secrets().Delete(options)

secret, err := client.Secrets().Delete(infisical.DeleteSecretOptions{
  ProjectID:   "PROJECT_ID",
  Environment: "dev",
  SecretKey:   "SECRET_KEY",
})

Delete a secret in Infisical.

Parameters

Parameters

object

Show properties

SecretKey

string

The key of the secret to update.

ProjectID

string

required

The project ID where the secret lives in.

Environment

string

required

The slug name (dev, prod, etc) of the environment from where secrets should be fetched from.

SecretPath

string

The path from where secret should be deleted.

Type

string

The type of the secret. Valid options are “shared” or “personal”. If not specified, the default value is “shared”.