Skip to main content

​
Description

Relay-related commands for Infisical. Relays are organization-deployed servers that route encrypted traffic between Infisical and your gateways. Relays are created via the Infisical dashboard (Networking → Relays → Create Relay) and then deployed using the CLI commands below.

​
Subcommands & flags

infisical relay start

Run the Infisical relay component. The relay handles network traffic routing between Infisical and your gateways.

​
Authentication

Relays support two enrollment methods. The enrollment method is set when creating the relay in the dashboard.
Token auth uses a one-time enrollment token (1 hour expiry) generated from the relay detail page. The token is exchanged for a long-lived access token on first start and stored on disk for subsequent restarts.The --host flag is not required — the host is stored server-side when the relay is created.
On subsequent starts with the same enrollment token, the relay skips enrollment and uses the stored access token.Token-method enrollment tokens are single-use and expire after 1 hour. If the token expires before deployment, click Show deploy command on the relay detail page to generate a new one.
AWS auth uses the host’s AWS credentials (instance role, env vars, or shared profile) to authenticate via STS GetCallerIdentity. A fresh token is minted on every start — no on-disk persistence needed.
The --relay-id is the relay’s UUID, visible on the relay detail page. The relay ID is persisted after first use so subsequent starts don’t need --relay-id again.

​
Flags

The name of the relay. Must match the name used when creating the relay in the dashboard.
The enrollment method to use. Supported values: token, aws.
The one-time enrollment token (required when --enroll-method=token). Generated from the relay detail page via Show deploy command.
The relay UUID (required when --enroll-method=aws). Visible on the relay detail page.
Domain of your Infisical instance. Required for self-hosted deployments.
Manage systemd service for the Infisical relay on Linux systems.

​
Requirements

  • Operating System: Linux only
  • Privileges: Root/sudo privileges required
  • Systemd: The system must be running systemd

​
Subcommands

Install and enable a systemd service for the relay. The relay name is provided as a positional argument, and the installed service is named after it, so you can run multiple relays on the same machine. See the authentication section above for the full install commands.
After installation, start and enable the service (replace <name> with your relay name):
To check status and logs:

​
Service Details

  • Service file: /etc/systemd/system/<name>.service
  • Config directory: /etc/infisical/relays/
  • Runs with restricted privileges and automatically restarts on failure
  • Enabled to start on boot
Uninstall and remove a relay’s systemd service. The relay name is provided as a positional argument.