Description
Open every PAM account the caller can launch as a local connection point, then start your agent. The agent connects to the accounts its task needs; the CLI never connects to an account itself, and no credential reaches the agent. Claude Code, Codex, and Gemini receive their instructions in their own format. Any other agent, including one you developed, reads them from the file named byINFISICAL_PAM_CONTEXT_FILE, which every run exports.
Everything after -- is the command that starts your agent. The separator is required whenever that command has flags of its own.
For the full picture, including what the agent is told, what the sandbox does and does not protect, and how gated accounts behave mid-run, see AI Agents. To open a single account for yourself instead, use
infisical pam access.Flags
--account
--account
Account to expose, as
folder/account. Repeatable, and also accepts a comma-separated list. Defaults to every account you can launch.If you name an account that cannot be used, the command stops and says why.--duration
--duration
How long each PAM session may last, capped by the account’s template. Supports Go duration format (e.g.,
1h, 30m, 2h30m).Default value: 1h--reason
--reason
Reason for access, recorded for audit. There is nobody to prompt here, so an account whose template requires a reason needs this flag.
--agent
--agent
Override agent detection. Accepts
claude, codex, gemini, or generic. Detection normally comes from the command name, so this is for a wrapper script or an unusual binary name. An agent of your own needs nothing here: it reads INFISICAL_PAM_CONTEXT_FILE regardless.--token
--token
Run as a machine identity using an access token you already have. Service tokens are rejected.Set
INFISICAL_UNIVERSAL_AUTH_ACCESS_TOKEN (or INFISICAL_TOKEN) instead of passing the flag, so the token stays out of your shell history and out of process listings.--auth-method
--auth-method
Authenticate as a machine identity with its own credentials instead of a ready-made
--token. Accepts universal-auth, kubernetes, azure, gcp-id-token, gcp-iam, aws-iam, oidc-auth, jwt-auth, and ldap-auth.Prefer this over --token for a long run: the credentials are kept valid for its whole duration.Every input has an environment variable, and secrets should go through the environment rather than a flag:--organization-slug
--organization-slug
Scope the session to a sub-organization the machine identity can reach. Defaults to the organization the identity was created in.
--no-approval-request
--no-approval-request
Don’t file access requests for accounts that require approval. Those accounts stay unusable for the run.By default, a request is filed the first time the agent reaches for a gated account, and the account works once a reviewer approves it.
--no-sandbox
--no-sandbox
Run the agent without the sandbox, so nothing local restricts what it can read on this host. Keep the sandbox on wherever your operating system provides one; this flag is required on Windows, where none is available.See The sandbox for what it covers.
--log-file
--log-file
Where to write proxy logs while the agent runs.Default value:
~/.infisical/pam-agentic/access.log--domain
--domain
Domain of your self-hosted Infisical instance. If not specified, defaults to Infisical Cloud.