Quick usage
Manage secrets with Infisical CLI
The CLI is designed for a variety of applications, ranging from local secret management to CI/CD and production scenarios. The distinguishing factor, however, is the authentication method used.
To use the Infisical CLI in your local development environment, simply run the command below and follow the interactive guide.
If you are in a containerized environment such as WSL 2 or Codespaces, run infisical login -i
to avoid browser based login
Initialize Infisical for your project
This will create .infisical.json
file at the location the command was executed. This file contains your local project settings. It does not contain any sensitive data.
To use the Infisical CLI in your local development environment, simply run the command below and follow the interactive guide.
If you are in a containerized environment such as WSL 2 or Codespaces, run infisical login -i
to avoid browser based login
Initialize Infisical for your project
This will create .infisical.json
file at the location the command was executed. This file contains your local project settings. It does not contain any sensitive data.
To use Infisical for non local development scenarios, please create a service token. The service token will allow you to authenticate and interact with Infisical. Once you have created a service token with the required permissions, you’ll need to feed the token to the CLI.
Pass as flag
You may use the —token flag to set the token
Pass via shell environment variable
The CLI is configured to look for an environment variable named INFISICAL_TOKEN
. If set, it’ll attempt to use it for authentication.
Inject environment variables
Custom aliases can utilize secrets from Infisical. Suppose there is a custom alias yd
in custom.sh
that runs yarn dev
and needs the secrets provided by Infisical.
To make the secrets available from Infisical to yd
, you can run the following command:
View all available options for run
command here
Connect CLI to self hosted Infisical
Optional: point CLI to self-hosted
Optional: point CLI to self-hosted
The CLI is set to connect to Infisical Cloud by default, but if you’re running your own instance of Infisical, you can direct the CLI to it using one of the methods provided below.
Method 1: Use the updated CLI
Beginning with CLI version V0.4.0, it is now possible to choose between logging in through the Infisical cloud or your own self-hosted instance. Simply execute the infisical login
command and follow the on-screen instructions.
Method 2: Export environment variable
You can point the CLI to the self hosted Infisical instance by exporting the environment variable INFISICAL_API_URL
in your terminal.
Method 3: Set manually on every command
Another option to point the CLI to your self hosted Infisical instance is to set it via a flag on every command you run.
History
Your terminal keeps a history with the commands you run. When you create Infisical secrets directly from your terminal, they’ll stay there for a while.
For security and privacy concerns, we recommend you to configure your terminal to ignore those specific Infisical commands.
Ignore commands
Ignore commands
$HOME/.profile
is pretty common but, you could place it under $HOME/.profile.d/infisical.sh
or any profile file run at login
$HOME/.profile
is pretty common but, you could place it under $HOME/.profile.d/infisical.sh
or any profile file run at login
If you’re on WSL, then you can use the Unix/Linux method.
Here’s some documentation about how to clear the terminal history, in PowerShell and CMD