infisical gateway - Infisical

infisical gateway --token=<token>

Description

Run the Infisical gateway in the foreground or manage its systemd service installation. The gateway allows secure communication between your self-hosted Infisical instance and client applications.

Subcommands & flags

infisical gateway

Run the Infisical gateway in the foreground. The gateway will connect to the relay service and maintain a persistent connection.

infisical gateway --domain=<domain> --auth-method=<auth-method>

Authentication

The Infisical CLI supports multiple authentication methods. Below are the available authentication methods, with their respective flags.

Universal Auth

The Universal Auth method is a simple and secure way to authenticate with Infisical. It requires a client ID and a client secret to authenticate with Infisical.

Flags

Show properties

client-id

string

required

Your machine identity client ID.

client-secret

string

required

Your machine identity client secret.

auth-method

string

required

The authentication method to use. Must be universal-auth when using Universal Auth.

  infisical gateway --auth-method=universal-auth --client-id=<client-id> --client-secret=<client-secret>

Native Kubernetes

The Native Kubernetes method is used to authenticate with Infisical when running in a Kubernetes environment. It requires a service account token to authenticate with Infisical.

Flags

Show properties

machine-identity-id

string

required

Your machine identity ID.

service-account-token-path

string

Path to the Kubernetes service account token to use. Default: /var/run/secrets/kubernetes.io/serviceaccount/token.

auth-method

string

required

The authentication method to use. Must be kubernetes when using Native Kubernetes.

  infisical gateway --auth-method=kubernetes --machine-identity-id=<machine-identity-id>

Native Azure

The Native Azure method is used to authenticate with Infisical when running in an Azure environment.

Flags

Show properties

machine-identity-id

string

required

Your machine identity ID.

auth-method

string

required

The authentication method to use. Must be azure when using Native Azure.

  infisical gateway --auth-method=azure --machine-identity-id=<machine-identity-id>

Native GCP ID Token

The Native GCP ID Token method is used to authenticate with Infisical when running in a GCP environment.

Flags

Show properties

machine-identity-id

string

required

Your machine identity ID.

auth-method

string

required

The authentication method to use. Must be gcp-id-token when using Native GCP ID Token.

  infisical gateway --auth-method=gcp-id-token --machine-identity-id=<machine-identity-id>

GCP IAM

The GCP IAM method is used to authenticate with Infisical with a GCP service account key.

Flags

Show properties

machine-identity-id

string

required

Your machine identity ID.

service-account-key-file-path

string

required

Path to your GCP service account key file (Must be in JSON format!)

auth-method

string

required

The authentication method to use. Must be gcp-iam when using GCP IAM.

  infisical gateway --auth-method=gcp-iam --machine-identity-id=<machine-identity-id> --service-account-key-file-path=<service-account-key-file-path>

Native AWS IAM

The AWS IAM method is used to authenticate with Infisical with an AWS IAM role while running in an AWS environment like EC2, Lambda, etc.

Flags

Show properties

machine-identity-id

string

required

Your machine identity ID.

auth-method

string

required

The authentication method to use. Must be aws-iam when using Native AWS IAM.

  infisical gateway --auth-method=aws-iam --machine-identity-id=<machine-identity-id>

OIDC Auth

The OIDC Auth method is used to authenticate with Infisical via identity tokens with OIDC.

Flags

Show properties

machine-identity-id

string

required

Your machine identity ID.

jwt

string

required

The OIDC JWT from the identity provider.

auth-method

string

required

The authentication method to use. Must be oidc-auth when using OIDC Auth.

  infisical gateway --auth-method=oidc-auth --machine-identity-id=<machine-identity-id> --jwt=<oidc-jwt>

JWT Auth

The JWT Auth method is used to authenticate with Infisical via a JWT token.

Flags

Show properties

jwt

string

required

The JWT token to use for authentication.

machine-identity-id

string

required

Your machine identity ID.

auth-method

string

required

The authentication method to use. Must be jwt-auth when using JWT Auth.

  infisical gateway --auth-method=jwt-auth --jwt=<jwt> --machine-identity-id=<machine-identity-id>

Token Auth

You can use the INFISICAL_TOKEN environment variable to authenticate with Infisical with a raw machine identity access token.

Flags

Show properties

token

string

required

The machine identity access token to use for authentication.

  infisical gateway --token=<token>

Other Flags

--domain

infisical gateway install

Install and enable the gateway as a systemd service. This command must be run with sudo on Linux.

sudo infisical gateway install --token=<token> --domain=<domain>

Requirements

Must be run on Linux
Must be run with root/sudo privileges
Requires systemd

Flags

--token

The machine identity access token to authenticate with Infisical.

# Example
sudo infisical gateway install --token=<token>

You may also expose the token to the CLI by setting the environment variable INFISICAL_TOKEN before executing the install command.

--domain

Service Details

The systemd service is installed with secure defaults:

Service file: /etc/systemd/system/infisical-gateway.service
Config file: /etc/infisical/gateway.conf
Runs with restricted privileges:
- InaccessibleDirectories=/home
- PrivateTmp=yes
- Resource limits configured for stability
Automatically restarts on failure
Enabled to start on boot

After installation, manage the service with standard systemd commands:

sudo systemctl start infisical-gateway    # Start the service
sudo systemctl stop infisical-gateway     # Stop the service
sudo systemctl status infisical-gateway   # Check service status
sudo systemctl disable infisical-gateway  # Disable auto-start on boot

Command line

​Description

​Subcommands & flags

Description

Subcommands & flags