Skip to main content

​
Description

The CLI uses authentication to verify your identity. You can authenticate using:
  • Browser Login (default): Opens a browser for authentication
  • Direct Login: Provide email and password via flags or environment variables for non-interactive workflows
  • Interactive CLI Login: Use the --interactive flag to enter credentials via CLI prompts
When authenticated, a token is generated and saved in your system Keyring to allow you to make future interactions with the CLI. To change where the login credentials are stored, visit the vaults command. If you have added multiple users, you can switch between the users by using the user command.
JWT Token Output:
  • For user authentication with the --plain --silent flags: outputs only the JWT access token (useful for scripting)
  • For machine identity authentication: an access token is always printed to the console
Use the --plain flag to print only the token in plain text and the --silent flag to disable update alerts.Both flags are ideal for capturing the token in environment variables or CI/CD pipelines.

​
Authentication Methods

The Infisical CLI supports two main categories of authentication: User Authentication and Machine Identity Authentication.

​
User Authentication

User authentication is designed for individual developers and supports multiple login flows.
The User authentication method allows you to log in with your email and password. This method supports three different login flows:
  • Browser Login (default): Opens a browser for authentication
  • Direct Login: Provide credentials via flags or environment variables for CI/CD
  • Interactive CLI Login: Enter credentials via CLI prompts using --interactive
​
Flags

​
Machine Identity Authentication

Machine identity authentication methods are designed for automated systems, services, and CI/CD pipelines.
The Universal Auth method is a simple and secure way to authenticate with Infisical. It requires a client ID and a client secret to authenticate with Infisical.
​
Flags
1

Create a universal auth machine identity

To create a universal auth machine identity, follow the step by step guide outlined here.
2

Obtain an access token

Run the login command with the following flags to obtain an access token:
The Native Kubernetes method is used to authenticate with Infisical when running in a Kubernetes environment. It requires a service account token to authenticate with Infisical.
​
Flags
1

Create a Kubernetes machine identity

To create a Kubernetes machine identity, follow the step by step guide outlined here.
2

Obtain access an token

Run the login command with the following flags to obtain an access token:
The Native Azure method is used to authenticate with Infisical when running in an Azure environment.
​
Flags
1

Create an Azure machine identity

To create an Azure machine identity, follow the step by step guide outlined here.
2

Obtain an access token

Run the login command with the following flags to obtain an access token:
The Native GCP ID Token method is used to authenticate with Infisical when running in a GCP environment.
​
Flags
1

Create a GCP machine identity

To create a GCP machine identity, follow the step by step guide outlined here.
2

Obtain an access token

Run the login command with the following flags to obtain an access token:
The GCP IAM method is used to authenticate with Infisical with a GCP service account key.
​
Flags
1

Create a GCP machine identity

To create a GCP machine identity, follow the step by step guide outlined here.
2

Obtain an access token

Run the login command with the following flags to obtain an access token:
The AWS IAM method is used to authenticate with Infisical with an AWS IAM role while running in an AWS environment like EC2, Lambda, etc.
​
Flags
1

Create an AWS machine identity

To create an AWS machine identity, follow the step by step guide outlined here.
2

Obtain an access token

Run the login command with the following flags to obtain an access token:
The OIDC Auth method is used to authenticate with Infisical via identity tokens with OIDC.
​
Flags
1

Create an OIDC machine identity

To create an OIDC machine identity, follow the step by step guide outlined here.
2

Obtain an access token

Run the login command with the following flags to obtain an access token:
The JWT Auth method is used to authenticate with Infisical via a JWT token.
​
Flags
1

Obtain an access token

Run the login command with the following flags to obtain an access token:

​
Flags

The login command supports a number of flags that you can use for different authentication methods. Below is a list of all the flags that can be used with the login command.

​
Valid values for the method flag are:

  • user: Login using email and password. (default)
  • universal-auth: Login using a universal auth client ID and client secret.
  • kubernetes: Login using a Kubernetes native auth.
  • azure: Login using an Azure native auth.
  • gcp-id-token: Login using a GCP ID token native auth.
  • gcp-iam: Login using a GCP IAM.
  • aws-iam: Login using an AWS IAM native auth.
  • oidc-auth: Login using OIDC auth.
  • jwt-auth: Login using a plain JWT token.

​
Description

This authenticates the machine identity against the specified sub-organization.
The organization-slug flag can be substituted with the INFISICAL_AUTH_ORGANIZATION_SLUG environment variable.
If no organization slug is provided, the authentication session defaults to the organization where the machine identity was originally created.

​
Description

The client ID of the universal auth machine identity. This is required if the --method flag is set to universal-auth.
The client-id flag can be substituted with the INFISICAL_UNIVERSAL_AUTH_CLIENT_ID environment variable.

​
Description

The client secret of the universal auth machine identity. This is required if the --method flag is set to universal-auth.
The client-secret flag can be substituted with the INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET environment variable.

​
Description

The ID of the machine identity. This is required if the --method flag is set to kubernetes, azure, gcp-id-token, gcp-iam, or aws-iam.
The machine-identity-id flag can be substituted with the INFISICAL_MACHINE_IDENTITY_ID environment variable.

​
Description

The path to the Kubernetes service account token to use for authentication. This is optional and will default to /var/run/secrets/kubernetes.io/serviceaccount/token.
The service-account-token-path flag can be substituted with the INFISICAL_KUBERNETES_SERVICE_ACCOUNT_TOKEN_PATH environment variable.

​
Description

The path to your GCP service account key file. This is required if the --method flag is set to gcp-iam.
The service-account-key-path flag can be substituted with the INFISICAL_GCP_IAM_SERVICE_ACCOUNT_KEY_FILE_PATH environment variable.

​
Description

User email address. Required if you want to do a non-interactive login when the —method flag is set to user. Must be used together with the --password and --organization-id flag.
You can omit the —method=user if you want as it’s the default method.
The email flag can be substituted with the INFISICAL_EMAIL environment variable.

​
Description

User password. Required if you want to do a non-interactive login when the —method flag is set to user. Must be used together with the --email and --organization-id flag.
For security in CI/CD environments, prefer using the INFISICAL_PASSWORD environment variable instead of passing the password as a command-line flag.
You can omit the —method=user if you want as it’s the default method.
The password flag can be substituted with the INFISICAL_PASSWORD environment variable.

​
Description

User organization id. Required if you want to do a non-interactive login when the —method flag is set to user. Must be used together with the --email and --password flag.
You can omit the —method=user if you want as it’s the default method.
The organization-id flag can be substituted with the INFISICAL_ORGANIZATION_ID environment variable.

​
Description

Forces interactive CLI login where you’ll be prompted to enter your email, password, and select your organization in the terminal, instead of opening a browser.

​
Description

When used with direct user login or machine identity authentication, outputs only the JWT access token without any additional formatting. This is useful for scripting and CI/CD pipelines where you need to capture the token.
Use it alongside the silent flag to disable all messages in the console except from the access token.

​
Description

The JWT provided by an identity provider for OIDC or plain JWT authentication. This is required if the --method flag is set to oidc-auth or jwt-auth.
The jwt flag can be substituted with the INFISICAL_JWT environment variable.

​
Description

Specifies the Infisical API URL for non-US Cloud instances. This flag is required when connecting to any instance other than US Cloud (e.g. EU Cloud or self-hosted).
Critical: If you use --domain during login, you must also include it on all subsequent CLI commands (e.g., infisical secrets, infisical export, etc.). Alternatively, set the INFISICAL_API_URL environment variable to avoid having to use --domain on every command. Refer to the Domain Configuration section for more details.

​
User Authentication Examples

The following examples demonstrate different ways to authenticate as a user with the Infisical CLI.
By default, running infisical login without any flags opens your browser for authentication.
The browser will open to the Infisical login page, and upon successful authentication, the CLI will be automatically authenticated.
Direct login is ideal for CI/CD pipelines and automation scripts where browser-based authentication is not possible.

​
Using Command-Line Flags

For non-US Cloud instances: If you’re using EU Cloud or a self-hosted instance, you must set INFISICAL_API_URL before login or use --domain on all commands. Refer to the Domain Configuration section for more details.
Interactive login prompts you to enter credentials in the terminal instead of opening a browser.
You’ll be prompted to enter:
  • Email address
  • Password
After the prompt, you will be shown a list of organizations to choose from.
If you have SSO enabled, we recommend using the default browser login.

​
Sub-commands

infisical login status

Reports whether the CLI is currently authenticated to Infisical and, when available, the organization the active session is scoped to. The command checks the user session stored in your vault, machine identity tokens exported as environment variables, and a token passed via the --token flag.
In addition to local checks (token presence, local expiration), status calls the Infisical backend to verify that each credential is still valid — so revoked or rejected tokens are surfaced even when they look fine locally.

​
Sources checked

  • User session: the active login stored in your system keyring (or the configured vault).
  • Machine identity environment variable: INFISICAL_TOKEN.
  • --token flag: a specific machine identity access token passed explicitly.

​
Exit codes

  • 0: at least one session was reported and none are expired or rejected.
  • 1: no active session was found, or a reported session is expired or rejected by the backend.

​
Flags

Output the login status as JSON instead of the default human-readable format. Useful for scripting and CI/CD pipelines.
Inspect the given machine identity access token instead of the active session or environment variables. When this flag is set, --domain (or the INFISICAL_API_URL environment variable) must also be provided so the status reflects the correct Infisical instance.

​
Examples

Example output:

​
Machine Identity Authentication Quick Start

In this example we’ll be using the universal-auth method to login to obtain an Infisical access token, which we will then use to fetch secrets with.
1

Obtain an access token

For non-US Cloud instances: If you’re using EU Cloud or a self-hosted instance, you must set INFISICAL_API_URL before login or use --domain on all commands. Refer to the Domain Configuration section for more details.
Now that we’ve set the INFISICAL_TOKEN environment variable, we can use the CLI to interact with Infisical. The CLI will automatically check for the presence of the INFISICAL_TOKEN environment variable and use it for authentication.Alternatively, if you would rather use the --token flag to pass the token directly, you can do so by running the following command:
2

Fetch all secrets from an environment

This command will fetch all secrets from the dev environment in your project, including all secrets in subfolders.
The --recursive, and --env flag is optional and will fetch all secrets in subfolders. The default environment is dev if no --env flag is provided.