{"docsConfig":{"theme":"aspen","$schema":"https://mintlify.com/docs.json","name":"Infisical","colors":{"primary":"#26272b","light":"#dbf530","dark":"#A1B659"},"logo":{"light":"https://mintlify.s3.us-west-1.amazonaws.com/infisical/logo/light.svg","dark":"https://mintlify.s3.us-west-1.amazonaws.com/infisical/logo/dark.svg","href":"/"},"favicon":"https://mintlify.s3.us-west-1.amazonaws.com/infisical/favicon.ico","api":{"openapi":"https://app.infisical.com/api/docs/json","mdx":{"server":["https://app.infisical.com"]}},"appearance":{"default":"light"},"background":{"color":{"light":"#ffffff","dark":"#08090b"}},"navbar":{"links":[{"href":"https://app.infisical.com/login","label":"Log In"}],"primary":{"type":"button","label":"Start for Free","href":"https://app.infisical.com/signup"}},"footer":{"socials":{"x":"https://www.twitter.com/infisical","linkedin":"https://www.linkedin.com/company/infisical","github":"https://github.com/Infisical/infisical-cli","website":"https://community.infisical.com"},"links":[{"header":"PRODUCT","items":[{"label":"Secrets Management","href":"https://infisical.com/platform/secrets-management"},{"label":"Certificate Management","href":"https://infisical.com/platform/certificate-management"},{"label":"Privileged Access Management (PAM)","href":"https://infisical.com/platform/pam"},{"label":"Agent Vault","href":"https://infisical.com/platform/agent-vault"},{"label":"Key Management Service (KMS)","href":"https://infisical.com/docs/documentation/platform/kms/overview"},{"label":"Secret Scanning","href":"https://infisical.com/radar"},{"label":"Share Secrets","href":"https://app.infisical.com/share-secret"},{"label":"Pricing","href":"https://infisical.com/pricing"},{"label":"Security","href":"https://infisical.com/docs/internals/security"},{"label":"Blog","href":"https://infisical.com/blog"},{"label":"Infisical vs Vault","href":"https://infisical.com/infisical-vs-hashicorp-vault"},{"label":"Community","href":"https://community.infisical.com/"}]},{"header":"USE CASES","items":[{"label":"Infisical Agent","href":"https://infisical.com/docs/documentation/getting-started/introduction"},{"label":"Infisical Proxy","href":"https://infisical.com/docs/integrations/platforms/infisical-proxy"},{"label":"Kubernetes","href":"https://infisical.com/docs/integrations/platforms/kubernetes"},{"label":"Dynamic Secrets","href":"https://infisical.com/docs/documentation/platform/dynamic-secrets/overview"},{"label":"Terraform","href":"https://registry.terraform.io/providers/Infisical/infisical/latest/docs"},{"label":"Ansible","href":"https://infisical.com/docs/integrations/platforms/ansible"},{"label":"Jenkins","href":"https://infisical.com/docs/integrations/cicd/jenkins"},{"label":"Docker","href":"https://infisical.com/docs/integrations/platforms/docker"},{"label":"AWS ECS","href":"https://infisical.com/docs/integrations/platforms/ecs-with-agent"},{"label":"GitLab","href":"https://infisical.com/docs/integrations/cicd/gitlab"},{"label":"GitHub","href":"https://infisical.com/docs/integrations/cicd/githubactions"},{"label":"SDK","href":"https://infisical.com/docs/sdks/overview"}]},{"header":"DEVELOPERS","items":[{"label":"Changelog","href":"https://github.com/Infisical/infisical/releases"},{"label":"Status","href":"https://status.infisical.com/"},{"label":"Feedback \u0026 Requests","href":"https://github.com/Infisical/infisical/issues"},{"label":"Trust of Center","href":"https://app.vanta.com/infisical.com/trust/hoop8cr78cuarxo9sztvs"},{"label":"Open Source Friends","href":"https://infisical.com/infisical-friends"},{"label":"How to contribute","href":"https://www.infisical.com/infisical-heroes"}]},{"header":"OTHERS","items":[{"label":"Customers","href":"https://infisical.com/customers/traba"},{"label":"Company Handbook","href":"https://infisical.com/wiki/handbook/overview"},{"label":"Careers","href":"https://infisical.com/careers"},{"label":"Terms of Service","href":"https://infisical.com/terms"},{"label":"Privacy Policy","href":"https://infisical.com/privacy"},{"label":"Subprocessors","href":"https://infisical.com/subprocessors"},{"label":"SLA","href":"https://infisical.com/sla"},{"label":"Support Email","href":"mailto:[email protected]"},{"label":"Sales","href":"mailto:[email protected]"},{"label":"Support","href":"https://community.infisical.com"}]}]},"fonts":{"heading":{"family":"Alliance","weight":400,"source":"https://infisical.com/docs/fonts/AllianceNo2-Regular.woff2","format":"woff2"}},"icons":{"library":"lucide"},"styling":{"eyebrows":"breadcrumbs","codeblocks":"dark","latex":false},"integrations":{"posthog":{"apiKey":"phc_Q0xfB3LeOqo7ySk4DE6zLNwDzHFesKcmigknCy4fTdV","apiHost":"https://p.infisical.com"},"koala":{"publicApiKey":"pk_b50d7184e0e39ddd5cdb43cf6abeadd9b97d"},"gtm":{"tagId":"GTM-WL5C7MWT"}},"contextual":{"options":["assistant","copy","view","chatgpt","claude","mcp"],"display":"header"},"thumbnails":{"appearance":"light"},"navigation":{"pages":[]}},"deployment":{"deploymentMetadataValue":{"subdomain":"infisical","hasAudioNarration":false,"actualSubdomain":"infisical","customDomains":["infisical.com"],"gitSource":{"type":"github","owner":"infisical","repo":"infisical","deployBranch":"main","contentDirectory":"docs","mountPath":"","label":""},"chroma":{"liveDeploymentHistoryId":"6aecafd57e5e99a1eb705961","collectionId":"6b3c89c2-d7d8-4239-bc48-3f323d3a5942","schemaVersion":"v3","latestBuiltDeploymentHistoryId":"6aecafd57e5e99a1eb705961"},"feedback":{"thumbs":true,"edits":true,"issues":true},"entitlements":{"AI_CHAT":{"status":"ENABLED"},"WEB_MCP":{"status":"ENABLED"},"NARRATION":{"status":"ENABLED"}},"buildId":"6aed19946a0e5dbe5915539a","clientVersion":"0.0.4074","searchFilterCounts":[{"language":"default","tag":"Reference","count":1883},{"language":"default","tag":"API","count":1840},{"language":"default","tag":"Secrets Management","count":913},{"language":"default","tag":"App connections","count":658},{"language":"default","tag":"Shared","count":572},{"language":"default","tag":"Secret syncs","count":420},{"language":"default","tag":"Products","count":375},{"language":"default","tag":"Certificate Management","count":324},{"language":"default","tag":"Platform","count":249},{"language":"default","tag":"Secret rotations","count":221}]},"assistantConfig":{"enableAskAiButton":true,"enableAskAiSearchBar":false},"basePath":"/docs","hasChatPermissions":true,"hasWebMcpPermissions":true,"toggles":[{"name":"kill-isr","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"selectively-prewarm","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"agent-mintlify-slack","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"agent-integrations-settings","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"rbac-expansion","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automations-pr-grouping","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"custom-prefix","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"analytics-v7","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"user-flows-analytics","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"no-publish-flow","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-onboarding","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"llms-txt-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"snapshot-serving-live","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"stripTemperatureMiddleware","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"support-platform-pylon-zendesk","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"snapshot-serving","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"instant-rollback","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"granular-notifications-server","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"granular-notifications","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automations-fable","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"fixed-ai-action-pricing","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automation-resolve-merge-conflict","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"scoped-publishing","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"mintql","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"page-level-analytics","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"editor-version-history-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"instinct-self-updating-docs","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"billing-page-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"full-page-search","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workspace-projects","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"assistant-v5","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"fork-pr-previews","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"revalidation-jwt","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"vite-origin","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-sso-scim","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"hobby-abuse-scan","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"dashboard-inbox","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-signup","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"turbopuffer-dual-write","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-enabled","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"approve-review-flow","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"sso-setup-deadline-banner","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"turbopuffer-serve","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"live-agents","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"comment-mode","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false}],"googleFontsInlined":false},"customCss":[{"filePath":"style.css","href":"/docs/_mintlify/custom/infisical/792e2875e269d30a/style.css"}],"page":{"pagePath":"cli/reference","slug":"/cli/reference","pageMetadata":{"title":"CLI reference","hidden":true,"description":"Every Infisical CLI command, with its flags and examples.","mode":"frame","href":"/cli/reference","hiddenSetByFrontmatter":true},"description":{"compiledSource":"\"use strict\";\nconst {jsx: _jsx} = arguments[0];\nconst {useMDXComponents: _provideComponents} = arguments[0];\nfunction _createMdxContent(props) {\n const _components = {\n p: \"p\",\n ..._provideComponents(),\n ...props.components\n };\n return _jsx(_components.p, {\n children: \"Every Infisical CLI command, with its flags and examples.\"\n });\n}\nfunction MDXContent(props = {}) {\n const {wrapper: MDXLayout} = {\n ..._provideComponents(),\n ...props.components\n };\n return MDXLayout ? _jsx(MDXLayout, {\n ...props,\n children: _jsx(_createMdxContent, {\n ...props\n })\n }) : _createMdxContent(props);\n}\nreturn {\n default: MDXContent\n};\n","frontmatter":{},"scope":{}},"pageType":"default","mdx":{"mdxSource":{"compiledSource":"\"use strict\";const{Fragment:_Fragment,jsx:_jsx,jsxs:_jsxs}=arguments[0];const{useMDXComponents:_provideComponents}=arguments[0];const CLICommand=({id,command,heading,usage,description,args=[],flags=[],inheritedFlags=[],env=[],examples=[],children})=>{const _components={a:`a`,..._provideComponents()};const[copied,setCopied]=useState(null);const[subcommands,setSubcommands]=useState([]);const sectionRef=useRef(null);const headingRef=useRef(null);useEffect(()=>{const section=sectionRef.current;if(!section)return;const page=section.closest(`.cli-ref`)||document;const depth=command.split(` `).length+1;const found=Array.from(page.querySelectorAll(`[data-cli-command]`)).filter(el=>{const path=el.dataset.command||``;return path.startsWith(`${command} `)\u0026\u0026path.split(` `).length===depth}).map(el=>({id:el.id,command:el.dataset.command}));setSubcommands(found)},[command]);useEffect(()=>{const section=sectionRef.current;const heading=headingRef.current;if(!section||!heading)return undefined;const measure=()=>section.style.setProperty(`--cli-head`,`${Math.round(heading.offsetHeight)}px`);measure();const observer=new ResizeObserver(measure);observer.observe(heading);return()=>observer.disconnect()},[]);const inline=text=>{if(!text)return null;const parts=[];const pattern=/`([^`]+)`|\\[([^\\]]+)\\]\\(([^)]+)\\)|\\[(infisical [^\\]]+)\\]|\\*\\*([^*]+)\\*\\*/g;let last=0;let match;while(match=pattern.exec(text)){if(match.index>last)parts.push(text.slice(last,match.index));if(match[1])parts.push(_jsx(`code`,{children:match[1]},match.index));else if(match[4])parts.push(_jsx(`code`,{children:match[4]},match.index));else if(match[5])parts.push(_jsx(`strong`,{children:match[5]},match.index));else parts.push(_jsx(_components.a,{href:match[3],children:match[2]},match.index));last=pattern.lastIndex}if(last\u003ctext.length)parts.push(text.slice(last));return parts};const slug=name=>name.replace(/^-+/,``).replace(/[^a-zA-Z0-9]+/g,`-`).toLowerCase();const anchor=(kind,name)=>`${id}--${kind}-${slug(name)}`;const jump=(event,target)=>{const el=document.getElementById(target);if(!el)return;event.preventDefault();document.documentElement.dataset.cliJumpUntil=String(Date.now()+1200);const isRow=el.classList.contains(`cli-row`);el.scrollIntoView({behavior:`smooth`,block:isRow?`center`:`start`});window.history.replaceState(window.history.state,``,`#${target}`);if(!isRow)return;el.classList.remove(`cli-row--flash`);void el.offsetWidth;el.classList.add(`cli-row--flash`)};const copy=(index,code)=>{navigator.clipboard.writeText(code);setCopied(index);setTimeout(()=>setCopied(null),1500)};const highlight=code=>code.split(`\n`).map((line,lineIndex)=>{if(/^\\s*#/.test(line)){return _jsxs(`span`,{className:`cli-code__line cli-code__comment`,children:[line,`\n`]},lineIndex)}const tokens=line.split(/(\\s+|\"[^\"]*\"|'[^']*')/).filter(t=>t!==``);return _jsxs(`span`,{className:`cli-code__line`,children:[tokens.map((token,tokenIndex)=>{let cls=null;if(token===`infisical`)cls=`cli-code__bin`;else if(/^--?[a-zA-Z]/.test(token))cls=`cli-code__flag`;else if(/^[\"']/.test(token))cls=`cli-code__string`;else if(tokenIndex===0\u0026\u0026/^(export|eval)$/.test(token))cls=`cli-code__muted`;return cls?_jsx(`span`,{className:cls,children:token},tokenIndex):token}),`\n`]},lineIndex)});const renderRows=(kind,heading,rows,tableId=`${id}--${kind}s`)=>rows.length?_jsxs(`div`,{className:`cli-cmd__table`,id:tableId,children:[_jsx(`h3`,{className:`cli-cmd__table-title`,children:heading}),rows.map(row=>_jsxs(`div`,{id:anchor(kind,row.name),className:`cli-row`,children:[_jsxs(`div`,{className:`cli-row__head`,children:[_jsxs(_components.a,{className:`cli-row__name`,href:`#${anchor(kind,row.name)}`,onClick:event=>jump(event,anchor(kind,row.name)),children:[row.short?`${row.short}, `:``,row.name,row.value\u0026\u0026row.value!==`\u003c${row.type}>`?_jsxs(`span`,{className:`cli-row__value`,children:[` `,row.value]}):null]}),row.type?_jsx(`span`,{className:`cli-row__meta`,children:row.type}):null,row.required?_jsx(`span`,{className:`cli-row__meta cli-row__meta--required`,children:`required`}):null,kind===`arg`\u0026\u0026!row.required?_jsx(`span`,{className:`cli-row__meta`,children:`optional`}):null,row.repeatable?_jsx(`span`,{className:`cli-row__meta`,children:`repeatable`}):null,row.deprecated?_jsx(`span`,{className:`cli-row__meta cli-row__meta--deprecated`,children:`deprecated`}):null]}),_jsx(`div`,{className:`cli-row__doc`,children:inline(row.description)}),row.default!==undefined?_jsxs(`div`,{className:`cli-row__default`,children:[`Default: `,_jsx(`code`,{children:String(row.default)})]}):null]},row.name))]}):null;const listed=flags.filter(flag=>!flag.deprecated);const collapseFlags=listed.length>=3;const flagCount=flags.length+inheritedFlags.length;const flagsTable=flags.length?`${id}--flags`:`${id}--inherited-flags`;const usageTokens=usage?usage.match(/\\[[^\\]]*\\](?:\\.\\.\\.)?|\u003c[^>]*>(?:\\.\\.\\.)?|\\S+/g)||[]:[];const isFlagsPlaceholder=token=>/^\\[.*\\bflags\\b.*\\]$/.test(token);const usageNamesFlags=usageTokens.some(isFlagsPlaceholder);const paragraphs=description?description.split(/\\n\\s*\\n/).map(paragraph=>paragraph.replace(/\\s*\\n\\s*/g,` `).trim()):[];const signature=_jsxs(_Fragment,{children:[_jsx(`span`,{className:`cli-usage__bin`,children:`infisical`}),` `,_jsx(_components.a,{className:`cli-usage__cmd`,href:`#${id}`,onClick:event=>jump(event,id),children:command}),usage?null:args.map(arg=>_jsxs(`span`,{children:[` `,_jsx(_components.a,{className:`cli-usage__arg`,href:`#${anchor(`arg`,arg.name)}`,onClick:event=>jump(event,anchor(`arg`,arg.name)),children:arg.name})]},arg.name)),usageTokens.map((token,index)=>{const arg=args.find(candidate=>candidate.usage===token);let content=_jsx(`span`,{className:`cli-usage__arg`,children:token});if(isFlagsPlaceholder(token)\u0026\u0026flagCount){content=_jsx(_components.a,{className:`cli-usage__flag`,href:`#${flagsTable}`,onClick:event=>jump(event,flagsTable),children:token})}else if(arg){content=_jsx(_components.a,{className:`cli-usage__arg`,href:`#${anchor(`arg`,arg.name)}`,onClick:event=>jump(event,anchor(`arg`,arg.name)),children:token})}return _jsxs(`span`,{children:[` `,content]},`usage-${index}`)}),usageNamesFlags?null:collapseFlags?_jsxs(`span`,{children:[` `,_jsx(_components.a,{className:`cli-usage__flag`,href:`#${id}--flags`,onClick:event=>jump(event,`${id}--flags`),children:`[flags]`})]}):listed.map(flag=>_jsxs(`span`,{children:[` `,_jsxs(_components.a,{className:`cli-usage__flag`,href:`#${anchor(`flag`,flag.name)}`,onClick:event=>jump(event,anchor(`flag`,flag.name)),children:[flag.required?``:`[`,flag.name,flag.value?`=${flag.value}`:``,flag.required?``:`]`]})]},flag.name))]});return _jsxs(`section`,{ref:sectionRef,id,className:`cli-cmd`,\"data-cli-command\":``,\"data-command\":command,children:[_jsx(`h2`,{className:heading?`cli-cmd__title cli-cmd__title--text`:`cli-cmd__title`,ref:headingRef,children:heading?_jsx(_components.a,{className:`cli-usage__cmd`,href:`#${id}`,onClick:event=>jump(event,id),children:heading}):signature}),_jsxs(`div`,{className:`cli-cmd__body`,children:[_jsxs(`div`,{className:`cli-cmd__description`,children:[paragraphs.map((paragraph,index)=>_jsx(`p`,{children:inline(paragraph)},index)),children]}),subcommands.length?_jsxs(`div`,{className:`cli-subs`,id:`${id}--subcommands`,children:[_jsx(`h3`,{className:`cli-cmd__table-title`,children:`Subcommands`}),_jsx(`ul`,{className:`cli-subs__list`,children:subcommands.map(sub=>_jsx(`li`,{children:_jsxs(_components.a,{href:`#${sub.id}`,onClick:event=>jump(event,sub.id),children:[`infisical `,sub.command]})},sub.id))})]}):null,renderRows(`arg`,`Arguments`,args),renderRows(`flag`,`Flags`,flags),renderRows(`flag`,`Inherited flags`,inheritedFlags,`${id}--inherited-flags`),renderRows(`env`,`Environment variables`,env)]}),examples.length?_jsx(`aside`,{className:`cli-cmd__examples`,\"aria-label\":`Examples for infisical ${command}`,children:_jsx(`div`,{className:`cli-cmd__examples-inner`,children:examples.map((example,index)=>_jsxs(`figure`,{className:`cli-example`,children:[_jsxs(`figcaption`,{className:`cli-example__title`,children:[_jsx(`span`,{children:example.title}),_jsx(`button`,{type:`button`,className:`cli-example__copy`,\"aria-label\":`Copy: ${example.title}`,onClick:()=>copy(index,example.code),children:copied===index?`Copied`:`Copy`})]}),_jsx(`pre`,{className:`cli-code`,children:_jsx(`code`,{children:highlight(example.code)})}),example.output?_jsx(`pre`,{className:`cli-code cli-code--output`,children:_jsx(`code`,{children:example.output})}):null]},index))})}):null]})};const CLIPage=({title,description,movedAnchors={},children})=>{const rootRef=useRef(null);useEffect(()=>{const root=rootRef.current;if(!root)return undefined;const navbar=document.getElementById(`navbar`);const top=navbar?navbar.getBoundingClientRect().height:64;root.style.setProperty(`--cli-top`,`${Math.round(top)}px`);const sections=Array.from(root.querySelectorAll(`[data-cli-command]`));let stopAligning=()=>{};const commandOf=id=>{const command=id.split(`--`)[0];return command!==id\u0026\u0026document.getElementById(command)?command:null};const movedHash=hash=>{if(!hash||document.getElementById(hash))return null;if(commandOf(hash))return commandOf(hash);const movedFrom=Object.keys(movedAnchors).filter(old=>hash===old||hash.startsWith(`${old}-`)).sort((a,b)=>b.length-a.length)[0];if(!movedFrom)return null;const moved=movedAnchors[movedFrom]+hash.slice(movedFrom.length);return document.getElementById(moved)?moved:commandOf(moved)};let hash=decodeURIComponent(window.location.hash.slice(1));const movedOnLoad=movedHash(hash);if(movedOnLoad){hash=movedOnLoad;window.history.replaceState(window.history.state,``,`#${hash}`)}const target=hash?document.getElementById(hash):null;let pinned=target?target.closest(`[data-cli-command]`):null;const unpinEvents=[`wheel`,`touchstart`,`keydown`,`mousedown`];const unpin=()=>{pinned=null;unpinEvents.forEach(type=>window.removeEventListener(type,unpin))};if(pinned)unpinEvents.forEach(type=>window.addEventListener(type,unpin,{passive:true}));if(target){let aligning=true;const block=target.classList.contains(`cli-row`)?`center`:`start`;const align=()=>{if(aligning)target.scrollIntoView({block})};const alignFrame=requestAnimationFrame(align);const resizes=new ResizeObserver(align);resizes.observe(root);if(document.fonts)document.fonts.ready.then(align);const userEvents=[`wheel`,`touchstart`,`keydown`,`mousedown`];const stop=()=>{aligning=false;cancelAnimationFrame(alignFrame);resizes.disconnect();clearTimeout(timeout);userEvents.forEach(type=>window.removeEventListener(type,stop))};const timeout=setTimeout(stop,2e3);userEvents.forEach(type=>window.addEventListener(type,stop,{passive:true}));stopAligning=stop}let frame=0;let settle=0;let current;const onScroll=()=>{cancelAnimationFrame(frame);frame=requestAnimationFrame(()=>{const line=top+24;let reached=null;for(const el of sections){const box=el.getBoundingClientRect();const head=el.firstElementChild?el.firstElementChild.offsetHeight:0;el.classList.toggle(`cli-cmd--stuck`,box.top\u003ctop\u0026\u0026box.bottom>top+head+1);if(box.top-line\u003c=0)reached=el.id}const atBottom=window.innerHeight+window.scrollY>=document.body.scrollHeight-2;if(atBottom\u0026\u0026sections.length)reached=sections[sections.length-1].id;if(pinned)reached=pinned.id;if(reached===current)return;const lockedFor=Number(document.documentElement.dataset.cliJumpUntil||0)-Date.now();if(lockedFor>0){clearTimeout(settle);settle=setTimeout(onScroll,lockedFor+50);return}current=reached;const path=reached?document.getElementById(reached).dataset.command:null;window.dispatchEvent(new CustomEvent(`cli-reference:active`,{detail:{id:reached,path}}));const hashNow=decodeURIComponent(window.location.hash.slice(1));if(!reached){if(hashNow)window.history.replaceState(window.history.state,``,window.location.pathname);return}if(hashNow!==reached\u0026\u0026!hashNow.startsWith(`${reached}--`)){window.history.replaceState(window.history.state,``,`#${reached}`)}})};onScroll();window.addEventListener(`scroll`,onScroll,{passive:true});const onHashChange=()=>{const hashNow=decodeURIComponent(window.location.hash.slice(1));const moved=movedHash(hashNow);const el=hashNow?document.getElementById(moved||hashNow):null;if(!el)return;if(moved)window.history.replaceState(window.history.state,``,`#${moved}`);pinned=el.closest(`[data-cli-command]`);unpinEvents.forEach(type=>window.addEventListener(type,unpin,{passive:true}));el.scrollIntoView({block:el.classList.contains(`cli-row`)?`center`:`start`})};window.addEventListener(`hashchange`,onHashChange);return()=>{stopAligning();unpin();cancelAnimationFrame(frame);clearTimeout(settle);window.removeEventListener(`scroll`,onScroll);window.removeEventListener(`hashchange`,onHashChange);window.dispatchEvent(new CustomEvent(`cli-reference:active`,{detail:{id:null}}))}},[]);return _jsxs(`div`,{className:`cli-ref`,ref:rootRef,children:[_jsxs(`header`,{className:`cli-ref__hero`,children:[_jsx(`h1`,{className:`cli-ref__title`,children:title}),description?_jsx(`div`,{className:`cli-ref__description`,children:description}):null]}),children]})};function _createMdxContent(props){const _components={a:`a`,code:`code`,h3:`h3`,li:`li`,ol:`ol`,p:`p`,pre:`pre`,span:`span`,strong:`strong`,tbody:`tbody`,td:`td`,th:`th`,thead:`thead`,tr:`tr`,ul:`ul`,..._provideComponents(),...props.components},{CodeBlock,Note,Table,Visibility,Warning,_MdxComponentBoundary}=_components;if(!CodeBlock)_missingMdxReference(`CodeBlock`,true);if(!Note)_missingMdxReference(`Note`,true);if(!Table)_missingMdxReference(`Table`,true);if(!Visibility)_missingMdxReference(`Visibility`,true);if(!Warning)_missingMdxReference(`Warning`,true);if(!_MdxComponentBoundary)_missingMdxReference(`_MdxComponentBoundary`,true);return _jsxs(_Fragment,{children:[_jsx(Visibility,{for:`agents`,children:_jsxs(_components.p,{children:[`The CLI reference for agents is on a separate page. Read the `,_jsx(_components.a,{href:`/cli/reference-agents`,children:`CLI reference for agents`}),`, which has every command’s arguments, flags, and examples. Each command has the same anchor there, so `,_jsx(_components.code,{children:`/cli/reference#secrets-manager-run`}),` is `,_jsx(_components.code,{children:`/cli/reference-agents#secrets-manager-run`}),`.`]})}),`\n`,_jsx(Visibility,{for:`humans`,children:_jsx(_MdxComponentBoundary,{name:`CLIPage`,children:_jsxs(CLIPage,{title:`CLI reference`,description:`Every Infisical CLI command, with its arguments, flags, and examples. Select a command or flag in a heading to jump to its details.`,movedAnchors:{sm:`secrets-manager`,\"sm-projects-list\":`secrets-manager-projects-get`,\"sm-secrets-folders\":`secrets-manager-folders`,\"sm-secrets-set\":`secrets-manager-secrets-create`,\"sm-secrets-folders-create--flag-name\":`secrets-manager-folders-create--arg-name`,\"sm-secrets-folders-delete--flag-name\":`secrets-manager-folders-delete--arg-name`,\"sm-secrets-generate-example-env\":`secrets-manager-secrets`,\"dynamic-secrets\":`secrets-manager-dynamic-secrets`,export:`secrets-manager-secrets-export`,run:`secrets-manager-run`,secrets:`secrets-manager-secrets`,\"secrets-folders\":`secrets-manager-folders`,\"secrets-folders-create--flag-name\":`secrets-manager-folders-create--arg-name`,\"secrets-folders-delete--flag-name\":`secrets-manager-folders-delete--arg-name`,\"secrets-generate-example-env\":`secrets-manager-secrets`,\"secrets-set\":`secrets-manager-secrets-create`},children:[_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsx(CLICommand,{id:`global-flags`,command:`global flags`,heading:`Global flags`,flags:[{name:`--domain`,value:`\u003cstring>`,type:`string`,default:`https://app.infisical.com`,description:\"The Infisical instance to connect to, such as `https://eu.infisical.com` for EU Cloud or your self-hosted URL. Check out [Set the Infisical instance](/cli/project-config#set-the-infisical-instance) for more information.\"},{name:`--log-destination`,value:`\u003cstring>`,type:`string`,description:\"Where to write logs: `stderr` or `stdout`. Defaults to `stderr`. Can also be set with `LOG_DESTINATION`.\"},{name:`--log-format`,value:`\u003cstring>`,type:`string`,description:\"How to format logs: `console` for colored text, `plain` for text without color, or `json` for structured logs. Defaults to `console`. Set `NO_COLOR=1` to drop the colors from `console`. Can also be set with `LOG_FORMAT`.\"},{name:`--log-level`,short:`-l`,value:`\u003cstring>`,type:`string`,description:\"The lowest level of log message to print: `trace`, `debug`, `info`, `warn`, `error`, or `fatal`. Defaults to `info`. Can also be set with `LOG_LEVEL`.\"},{name:`--org`,value:`\u003cstring>`,type:`string`,description:\"The organization to use for this command, by name, slug, or ID. It overrides the profile's organization without changing it. Can also be set with `INFISICAL_ORG`.\"},{name:`--profile`,value:`\u003cstring>`,type:`string`,description:\"The login profile to use for this command. Run `infisical profile list` to see your profiles. Can also be set with `INFISICAL_PROFILE`.\"},{name:`--silent`,type:`bool`,description:`Hide update notices, the notice naming the profile in use, and the warning that a token is overriding your login. Useful in scripts and CI.`},{name:`--telemetry`,type:`bool`,default:`true`,description:`Send usage telemetry to Infisical.`}],children:_jsx(_components.p,{children:`Every command accepts these flags.`})})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsxs(CLICommand,{id:`agent`,command:`agent`,usage:`[flags]`,flags:[{name:`--config`,value:`\u003cstring>`,type:`string`,default:`agent-config.yaml`,description:\"The path to the agent's YAML configuration file. Ignored when `INFISICAL_AGENT_CONFIG_BASE64` is set.\"}],examples:[{title:`Start the agent with the default config file`,code:`infisical agent`},{title:`Start the agent with a config file elsewhere`,code:`infisical agent --config=/etc/infisical/agent-config.yaml`},{title:`Pass the configuration as an environment variable`,code:`export INFISICAL_AGENT_CONFIG_BASE64=$(base64 \u003c agent-config.yaml)\ninfisical agent`}],children:[_jsxs(_components.p,{children:[`Run the `,_jsx(_components.a,{href:`/integrations/platforms/infisical-agent`,children:`Infisical Agent`}),`, a daemon that authenticates as a machine identity and renders secrets into files for your application to read. This command runs the agent in the foreground. To run the agent as a service that starts when the machine boots, use `,_jsx(_components.a,{href:`/cli/reference#agent-service-install`,children:`infisical agent service install`}),`.`]}),_jsxs(_components.p,{children:[`Everything is set in the YAML configuration file, including the auth method, sinks, templates, and the Infisical instance in `,_jsx(_components.code,{children:`infisical.address`}),`, which defaults to Infisical Cloud. The global `,_jsx(_components.code,{children:`--domain`}),` flag has no effect. To pass the configuration without a file, set `,_jsx(_components.code,{children:`INFISICAL_AGENT_CONFIG_BASE64`}),` to the base64-encoded YAML. It takes precedence over `,_jsx(_components.code,{children:`--config`}),`.`]}),_jsxs(_components.p,{children:[`For a daemon that only manages certificates, use `,_jsx(_components.a,{href:`/cli/reference#cert-manager-agent`,children:`infisical cert-manager agent`}),`.`]})]})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsxs(CLICommand,{id:`agent-service`,command:`agent service`,children:[_jsxs(_components.p,{children:[`Install, start, stop, or remove a service that runs the agent, so the agent starts when the machine boots and restarts if it crashes. Each command takes the service’s name, which defaults to `,_jsx(_components.code,{children:`infisical-agent`}),`. To run several agents with different configs on one machine, install each agent with its own name.`]}),_jsxs(_components.ul,{children:[`\n`,_jsxs(_components.li,{children:[`On Linux, you run the commands as root, and the service is a systemd service that logs to the systemd journal (`,_jsx(_components.code,{children:`sudo journalctl -u \u003cname>`}),`)`]}),`\n`,_jsxs(_components.li,{children:[`On Windows, you run the commands from a terminal opened with `,_jsx(_components.strong,{children:`Run as administrator`}),`, and the service is a Windows service that logs to `,_jsx(_components.code,{children:`%ProgramData%\\\\Infisical\\\\Agent\\\\\u003cname>.log`}),` (errors also go to the Windows Event Log)`]}),`\n`]}),_jsxs(_components.p,{children:[`The commands don’t run on macOS. `,_jsx(_components.code,{children:`start`}),`, `,_jsx(_components.code,{children:`stop`}),`, and `,_jsx(_components.code,{children:`uninstall`}),` only act on services that `,_jsx(_components.code,{children:`install`}),` created.`]})]})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsxs(CLICommand,{id:`agent-service-install`,command:`agent service install`,usage:`[name] [flags]`,args:[{name:`name`,usage:`[name]`,description:\"The service's name. Defaults to `infisical-agent`.\"}],flags:[{name:`--config`,value:`\u003cstring>`,type:`string`,default:`agent-config.yaml`,description:\"The path to the agent's YAML configuration file. The service doesn't use `INFISICAL_AGENT_CONFIG_BASE64`.\"}],examples:[{title:`Install a service on Linux`,code:`sudo infisical agent service install my-agent --config=/etc/infisical/agents/my-agent.yaml`},{title:`Install a service on Windows`,code:`infisical agent service install my-agent --config=C:\\\\infisical\\\\agent-config.yaml`}],children:[_jsxs(_components.p,{children:[`Install the agent as a service that starts when the machine boots. The command doesn’t start the service, so run `,_jsx(_components.a,{href:`/cli/reference#agent-service-start`,children:`infisical agent service start`}),` next.`]}),_jsx(_components.p,{children:`The service runs as root on Linux and as LocalSystem on Windows, so it runs its own copy of the config that only administrators can change. Relative paths in the copy still resolve from the directory of the original config. The copy is:`}),_jsxs(_components.ul,{children:[`\n`,_jsxs(_components.li,{children:[_jsx(_components.code,{children:`/etc/infisical/agents/\u003cname>.service-config.yaml`}),` on Linux`]}),`\n`,_jsxs(_components.li,{children:[_jsx(_components.code,{children:`%ProgramFiles%\\\\Infisical\\\\Agent\\\\\u003cname>\\\\service-config.yaml`}),` on Windows, next to the service’s own copy of `,_jsx(_components.code,{children:`infisical.exe`}),` (to upgrade the service, uninstall it and install it again)`]}),`\n`]}),_jsxs(_components.p,{children:[`To change the config, edit the original, then uninstall and install the service again. If you edit the copy instead, stop and start the service to apply the change, and also make the change in the original, because `,_jsx(_components.code,{children:`uninstall`}),` deletes the copy.`]}),_jsxs(_components.p,{children:[_jsx(_components.code,{children:`install`}),` refuses a config that:`]}),_jsxs(_components.ul,{children:[`\n`,_jsxs(_components.li,{children:[`Sets `,_jsx(_components.code,{children:`infisical.exit-after-auth: true`}),`, which would make the agent exit after its first render`]}),`\n`,_jsxs(_components.li,{children:[`Reads or writes files in `,_jsx(_components.code,{children:`/home`}),`, `,_jsx(_components.code,{children:`/tmp`}),`, or `,_jsx(_components.code,{children:`/var/tmp`}),` on Linux, because the service can’t read `,_jsx(_components.code,{children:`/home`}),` and has its own private `,_jsx(_components.code,{children:`/tmp`}),` and `,_jsx(_components.code,{children:`/var/tmp`}),` (keep these files in a directory such as `,_jsx(_components.code,{children:`/etc/infisical/agents`}),`)`]}),`\n`]})]})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsx(CLICommand,{id:`agent-service-start`,command:`agent service start`,usage:`[name]`,args:[{name:`name`,usage:`[name]`,description:\"The service to start. Defaults to `infisical-agent`.\"}],examples:[{title:`Start a service on Linux`,code:`sudo infisical agent service start my-agent`},{title:`Start a service on Windows`,code:`infisical agent service start my-agent`}],children:_jsx(_components.p,{children:`Start an agent service and wait until the agent has loaded its config. If the agent can’t start, the command fails and prints where to find the agent’s logs.`})})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsx(CLICommand,{id:`agent-service-stop`,command:`agent service stop`,usage:`[name]`,args:[{name:`name`,usage:`[name]`,description:\"The service to stop. Defaults to `infisical-agent`.\"}],examples:[{title:`Stop a service on Linux`,code:`sudo infisical agent service stop my-agent`},{title:`Stop a service on Windows`,code:`infisical agent service stop my-agent`}],children:_jsxs(_components.p,{children:[`Stop an agent service and wait for the agent to exit. If the config sets `,_jsx(_components.code,{children:`infisical.revoke-credentials-on-shutdown: true`}),`, the agent revokes its credentials before it exits, which can take up to five minutes. The service starts again the next time the machine boots.`]})})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsx(CLICommand,{id:`agent-service-uninstall`,command:`agent service uninstall`,usage:`[name]`,args:[{name:`name`,usage:`[name]`,description:\"The service to remove. Defaults to `infisical-agent`.\"}],examples:[{title:`Remove a service on Linux`,code:`sudo infisical agent service uninstall my-agent`},{title:`Remove a service on Windows`,code:`infisical agent service uninstall my-agent`}],children:_jsx(_components.p,{children:`Stop an agent service and remove it, along with the service’s copy of the config, so changes made only to the copy are lost. The original config and the agent’s logs stay where they are.`})})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsx(CLICommand,{id:`agent-start`,command:`agent start`,usage:`[flags]`,flags:[{name:`--config`,value:`\u003cstring>`,type:`string`,default:`agent-config.yaml`,description:\"The path to the agent's YAML configuration file. Can also be set with `INFISICAL_AGENT_CONFIG_PATH`.\"}],examples:[{title:`Start the agent with a config set in the environment`,code:`export INFISICAL_AGENT_CONFIG_PATH=/etc/infisical/agents/my-agent.yaml\ninfisical agent start`}],children:_jsxs(_components.p,{children:[`Run the agent in the foreground, as `,_jsx(_components.a,{href:`/cli/reference#agent`,children:`infisical agent`}),` does, with relative paths in the config resolved from the config’s directory. The systemd service that `,_jsx(_components.a,{href:`/cli/reference#agent-service-install`,children:`infisical agent service install`}),` creates runs this command. Unlike `,_jsx(_components.code,{children:`infisical agent`}),`, `,_jsx(_components.code,{children:`agent start`}),` ignores `,_jsx(_components.code,{children:`INFISICAL_AGENT_CONFIG_BASE64`}),`.`]})})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsxs(CLICommand,{id:`agent-vault`,command:`agent-vault`,children:[_jsxs(_components.p,{children:[`Run `,_jsx(_components.a,{href:`/documentation/platform/agent-vault/overview`,children:`Agent Vault`}),`, which lets AI agents call services such as LLM providers, GitHub, and Slack without holding the credentials. A proxy adds the real credential to each request the agent sends. Run the proxy with `,_jsx(_components.a,{href:`/cli/reference#agent-vault-proxy`,children:`infisical agent-vault proxy`}),`, usually where agent traffic leaves your network, and launch agents through it with `,_jsx(_components.a,{href:`/cli/reference#agent-vault-run`,children:`infisical agent-vault run`}),`. Create and revoke sessions on their own with `,_jsx(_components.a,{href:`/cli/reference#agent-vault-sessions-create`,children:`infisical agent-vault sessions create`}),` and `,_jsx(_components.a,{href:`/cli/reference#agent-vault-sessions-revoke`,children:`infisical agent-vault sessions revoke`}),`. Upload skills for those agents with `,_jsx(_components.a,{href:`/cli/reference#agent-vault-skills-push`,children:`infisical agent-vault skills push`}),`.`]}),_jsxs(_components.p,{children:[_jsx(_components.code,{children:`av`}),` is an alias, so `,_jsx(_components.code,{children:`infisical av run`}),` works wherever `,_jsx(_components.code,{children:`infisical agent-vault run`}),` does.`]}),_jsxs(_components.p,{children:[`Agent Vault commands don’t read `,_jsx(_components.code,{children:`domain`}),` from `,_jsx(_components.a,{href:`/cli/project-config#set-the-infisical-instance`,children:`the project config file`}),`. To connect them to an instance other than US Cloud, pass `,_jsx(_components.code,{children:`--domain`}),`, set `,_jsx(_components.code,{children:`INFISICAL_DOMAIN`}),`, or log in to that instance.`]})]})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsxs(CLICommand,{id:`agent-vault-proxy`,command:`agent-vault proxy`,usage:`[flags]`,flags:[{name:`--ca-cert`,value:`\u003cstring>`,type:`string`,description:\"Your own certificate authority to serve instead of the one Infisical generates, as PEM text, PEM encoded as base64, or the path to a PEM file. Pass it with `--ca-key`. Can also be set with `INFISICAL_AGENT_VAULT_CA_CERT`.\"},{name:`--ca-key`,value:`\u003cstring>`,type:`string`,description:\"The ECDSA P-256 private key for `--ca-cert`, in the same formats. Can also be set with `INFISICAL_AGENT_VAULT_CA_KEY`, which keeps the key off the command line.\"},{name:`--data-dir`,value:`\u003cstring>`,type:`string`,description:\"The directory where the proxy keeps a cache of its settings and certificate authority, if the directory is writable. The proxy starts from the cache if it can't reach Infisical. Defaults to `~/.infisical/agent-vault`, or `/etc/infisical/agent-vault` when run as root. Can also be set with `INFISICAL_AGENT_VAULT_DATA_DIR`.\"},{name:`--listen-host`,value:`\u003cstring>`,type:`string`,description:\"The host name or IP address the HTTP proxy listens on, such as `127.0.0.1`, without a port. Defaults to all interfaces. Can also be set with `INFISICAL_AGENT_VAULT_LISTEN_HOST`.\"},{name:`--log-file`,value:`\u003cstring>`,type:`string`,description:`A file to also write logs to, as JSON lines. The file is appended to.`},{name:`--log-format`,value:`\u003cstring>`,type:`string`,default:`console`,description:\"The format of the logs written to stderr: `console` or `json`.\"},{name:`--port`,value:`\u003cint>`,type:`int`,default:`17323`,description:\"The port for the HTTP proxy, on the address `--listen-host` sets. `0` picks any free port, which the startup line reports. Can also be set with `INFISICAL_AGENT_VAULT_PORT`.\"},{name:`--proxy-token`,value:`\u003cstring>`,type:`string`,description:\"The proxy token, which Infisical shows once when you create the proxy or rotate its token. Can also be set with `INFISICAL_AGENT_VAULT_PROXY_TOKEN`, which keeps it off the command line.\"},{name:`--socks5-allow-private-destinations`,type:`bool`,description:\"Turns off the SOCKS5 port's refusal of private and internal addresses, such as loopback, link-local, and the proxy's own network interfaces. Without this flag, the SOCKS5 port refuses those addresses for hosts that no service in the session's access bundle covers. Can also be set with `INFISICAL_AGENT_VAULT_SOCKS5_ALLOW_PRIVATE_DESTINATIONS`.\"},{name:`--socks5-port`,value:`\u003cint>`,type:`int`,description:\"Turns on SOCKS5 over TLS on this port, on all interfaces. The port can be from `1` to `65535`, and has to differ from `--port`. Needs `--socks5-tls-name`, or `--socks5-tls-cert` and `--socks5-tls-key`. Off by default. Can also be set with `INFISICAL_AGENT_VAULT_SOCKS5_PORT`.\"},{name:`--socks5-tls-cert`,value:`\u003cstring>`,type:`string`,description:\"Your own certificate for the SOCKS5 port, as PEM text, PEM encoded as base64, or the path to a PEM file. Pass it with `--socks5-tls-key`, and not with `--socks5-tls-name`. The proxy reads it when it starts, so restart the proxy after you renew it. Can also be set with `INFISICAL_AGENT_VAULT_SOCKS5_TLS_CERT`.\"},{name:`--socks5-tls-key`,value:`\u003cstring>`,type:`string`,description:\"The private key for `--socks5-tls-cert`, in the same formats. Can also be set with `INFISICAL_AGENT_VAULT_SOCKS5_TLS_KEY`, which keeps the key off the command line.\"},{name:`--socks5-tls-name`,value:`\u003cstring>`,type:`string`,description:\"The DNS name or IP address clients reach the SOCKS5 port by. The proxy makes the port's certificate for this name from its certificate authority, and renews it. Can also be set with `INFISICAL_AGENT_VAULT_SOCKS5_TLS_NAME`.\"}],examples:[{title:`Start a proxy`,code:`INFISICAL_AGENT_VAULT_PROXY_TOKEN=\u003cproxy-token> infisical agent-vault proxy`},{title:`Serve your own certificate authority`,code:`INFISICAL_AGENT_VAULT_PROXY_TOKEN=\u003cproxy-token> infisical agent-vault proxy --ca-cert=./ca.crt --ca-key=./ca.key`},{title:`Log JSON to a file on a custom port`,code:`INFISICAL_AGENT_VAULT_PROXY_TOKEN=\u003cproxy-token> infisical agent-vault proxy --port=18000 --log-format=json --log-file=/var/log/infisical/agent-vault.log`},{title:`Accept SOCKS5 over TLS and keep the HTTP port local`,code:`INFISICAL_AGENT_VAULT_PROXY_TOKEN=\u003cproxy-token> infisical agent-vault proxy --listen-host=127.0.0.1 --socks5-port=1080 --socks5-tls-name=proxy.example.com`}],children:[_jsxs(_components.p,{children:[`Run an Agent Vault `,_jsx(_components.a,{href:`/documentation/platform/agent-vault/proxies`,children:`proxy`}),` in the foreground. For each request, the proxy decides whether the agent’s session allows the host and attaches the real credential on the way out, so the agent never holds a secret.`]}),_jsxs(_components.p,{children:[`Start the proxy with its proxy token. You can run the proxy on as many machines as you need with the same token. Each time the proxy starts, it loads its settings and certificate authority from Infisical. If it can’t reach Infisical, it retries for 60 seconds, then starts from the cache in `,_jsx(_components.code,{children:`--data-dir`}),` if there is one, or exits.`]}),_jsxs(_components.p,{children:[`To accept SOCKS5 connections from sandbox providers such as E2B, pass `,_jsx(_components.code,{children:`--socks5-port`}),` and `,_jsx(_components.code,{children:`--socks5-tls-name`}),`. Learn more about `,_jsx(_components.a,{href:`/documentation/platform/agent-vault/proxies#accept-connections-over-socks5`,children:`the SOCKS5 port`}),`.`]}),_jsx(_components.p,{children:`You set the proxy’s traffic policy, exceptions, and poll interval in Infisical, not with flags.`})]})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsxs(CLICommand,{id:`agent-vault-run`,command:`agent-vault run`,usage:`[flags] -- \u003ccommand>`,args:[{name:`command`,usage:`\u003ccommand>`,required:true,description:\"The agent's command, after `--`. Everything after `--` is passed to it unchanged.\"}],flags:[{name:`--access-bundle`,value:`\u003cstringArray>`,type:`stringArray`,description:\"The access bundle to create a session with, by name, such as `coding-agent`. A session holds one access bundle, so pass the flag only once. Can't be combined with `--session-token`. Can also be set with `INFISICAL_AGENT_VAULT_ACCESS_BUNDLE`.\"},{name:`--ca-file`,value:`\u003cstring>`,type:`string`,description:\"Where to write the certificate authority fetched from the proxy. This is an output path, not a certificate to trust. Defaults to `ca-\u003cproxy-id>.pem` in `~/.infisical/agent-vault`, or `/etc/infisical/agent-vault` when run as root, one file per proxy.\"},{name:`--ca-fingerprint`,value:`\u003cstring>`,type:`string`,description:\"The SHA256 fingerprint of the proxy's certificate authority, from the **Proxies** page. The command stops before writing anything or starting the agent if the proxy serves a different one. Accepted with or without the `SHA256:` prefix and colons.\"},{name:`--client-id`,value:`\u003cstring>`,type:`string`,description:\"The client ID of the machine identity that creates the session, for `--access-bundle`. Can also be set with `INFISICAL_UNIVERSAL_AUTH_CLIENT_ID`.\"},{name:`--client-secret`,value:`\u003cstring>`,type:`string`,description:\"The client secret of the machine identity that creates the session, for `--access-bundle`. Can also be set with `INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET`.\"},{name:`--keep-session`,type:`bool`,description:\"Leave a session created with `--access-bundle` active when the agent exits, instead of revoking it. Can't be combined with `--session-token`.\"},{name:`--label`,value:`\u003cstring>`,type:`string`,description:\"A short description of what a session created with `--access-bundle` is for, shown on the **Sessions** page, such as `nightly deploy`. Up to 128 characters, without line breaks, tabs, or invisible characters. Can't be combined with `--session-token`.\"},{name:`--no-ca-trust`,type:`bool`,description:\"Skip writing the certificate authority, setting the trust variables, and adding it to the macOS keychain, for a machine that already trusts this proxy. `--ca-fingerprint` is still checked.\"},{name:`--no-proxy`,value:`\u003cstring>`,type:`string`,description:\"More hosts for the agent to reach directly instead of through the proxy, separated by commas. Always merged with `localhost,127.0.0.1` and any `NO_PROXY` in your environment.\"},{name:`--no-skills`,type:`bool`,description:\"Start the agent without installing the session's [skills](/documentation/platform/agent-vault/skills), so the command doesn't contact Infisical for them. Use it if the agent's host can't reach Infisical. Can't be combined with `--skills-dir`.\"},{name:`--project-id`,value:`\u003cstring>`,type:`string`,description:\"The ID of the [Agent Vault project](/documentation/platform/agent-vault/projects) to create the session in, for `--access-bundle`. If you leave it out, the CLI reads `INFISICAL_AGENT_VAULT_PROJECT_ID`, then `INFISICAL_PROJECT_ID`. Can't be combined with `--session-token`.\"},{name:`--proxy`,value:`\u003cstring>`,type:`string`,description:\"The Agent Vault proxy's address as `host:port`, such as `10.0.1.5:17323`. A leading `http://` or `https://` is dropped. Required unless `INFISICAL_AGENT_VAULT_PROXY_ADDRESS` is set.\"},{name:`--session-token`,value:`\u003cstring>`,type:`string`,description:\"A session token created in Infisical. The command never revokes this session. Can't be combined with `--access-bundle`. Can also be set with `INFISICAL_AGENT_VAULT_SESSION_TOKEN`, which keeps it off the command line.\"},{name:`--skills-dir`,value:`\u003cstring>`,type:`string`,description:\"The folder to install the session's [skills](/documentation/platform/agent-vault/skills) in, instead of `~/.agents/skills`. The CLI doesn't link skills in this folder for Claude Code or Hermes. Can't be empty, and can't be combined with `--no-skills`.\"},{name:`--ttl`,value:`\u003cstring>`,type:`string`,default:`never`,description:\"How long a session created with `--access-bundle` lasts: one number and one unit, such as `30m`, `8h`, or `7d` (not `2h30m`), or `never`. Defaults to `never` because the session is revoked when the agent exits, so an expiry only governs one that outlives the command. Can't be combined with `--session-token`.\"}],env:[{name:`INFISICAL_AGENT_VAULT_ACCESS_BUNDLE`,description:\"The access bundle to create a session with, by name. Used if neither `--access-bundle` nor `--session-token` is passed.\"},{name:`INFISICAL_AGENT_VAULT_PROJECT_ID`,description:\"The ID of the Agent Vault project to create the session in. Used if `--project-id` isn't passed.\"},{name:`INFISICAL_AGENT_VAULT_PROXY_ADDRESS`,description:\"The Agent Vault proxy's address as `host:port`. Used if `--proxy` isn't passed.\"},{name:`INFISICAL_AGENT_VAULT_SESSION_TOKEN`,description:\"A session token created in Infisical, which keeps the token off the command line. Used if neither `--session-token` nor `--access-bundle` is passed.\"},{name:`INFISICAL_PROJECT_ID`,description:\"The ID of the Agent Vault project to create the session in. Used if `--project-id` and `INFISICAL_AGENT_VAULT_PROJECT_ID` aren't set.\"},{name:`INFISICAL_UNIVERSAL_AUTH_CLIENT_ID`,description:\"The client ID of the machine identity that creates the session. Used if `--client-id` isn't passed.\"},{name:`INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET`,description:\"The client secret of the machine identity that creates the session. Used if `--client-secret` isn't passed.\"}],examples:[{title:`Run an agent with a session token`,code:`infisical agent-vault run --session-token=\u003csession-token> --proxy=10.0.1.5:17323 -- claude`},{title:`Create a session from an access bundle`,code:`infisical agent-vault run --project-id=\u003cproject-id> --access-bundle=code-review --ttl=8h --label=\"review PR 123\" --proxy=10.0.1.5:17323 -- claude`},{title:`Pin the proxy's certificate authority`,code:`infisical agent-vault run --session-token=\u003csession-token> --proxy=10.0.1.5:17323 --ca-fingerprint=SHA256:9F:2C:... -- claude`},{title:`Create the session as a machine identity`,code:`infisical agent-vault run \\\\\n --project-id=\u003cproject-id> \\\\\n --access-bundle=code-review \\\\\n --client-id=\u003cclient-id> \\\\\n --client-secret=\u003cclient-secret> \\\\\n --proxy=10.0.1.5:17323 \\\\\n -- claude`},{title:`Read the settings from environment variables`,code:`export INFISICAL_AGENT_VAULT_PROXY_ADDRESS=10.0.1.5:17323\nexport INFISICAL_AGENT_VAULT_SESSION_TOKEN=\u003csession-token>\ninfisical agent-vault run -- claude`}],children:[_jsx(_components.p,{children:`Launch an agent with its HTTP traffic routed through an Agent Vault proxy.`}),_jsxs(_components.p,{children:[`The agent needs a `,_jsx(_components.a,{href:`/documentation/platform/agent-vault/sessions`,children:`session`}),`. You can provide one in either of the following ways:`]}),_jsxs(_components.ul,{children:[`\n`,_jsxs(_components.li,{children:[`Pass `,_jsx(_components.code,{children:`--session-token`}),` (or set `,_jsx(_components.a,{href:`#agent-vault-run--env-infisical-agent-vault-session-token`,children:_jsx(_components.code,{children:`INFISICAL_AGENT_VAULT_SESSION_TOKEN`})}),`), to use an existing session that already exists in Infisical`]}),`\n`,_jsxs(_components.li,{children:[`Pass `,_jsx(_components.code,{children:`--access-bundle`}),` (or set `,_jsx(_components.a,{href:`#agent-vault-run--env-infisical-agent-vault-access-bundle`,children:_jsx(_components.code,{children:`INFISICAL_AGENT_VAULT_ACCESS_BUNDLE`})}),`), to create a session with that `,_jsx(_components.a,{href:`/documentation/platform/agent-vault/access-bundles`,children:`access bundle`})]}),`\n`]}),_jsxs(_components.p,{children:[`If you pass `,_jsx(_components.code,{children:`--access-bundle`}),`, the command also needs the Agent Vault project that holds the access bundle. It reads the project in this order, and stops with an error if none is set:`]}),_jsxs(_components.ol,{children:[`\n`,_jsx(_components.li,{children:_jsx(_components.code,{children:`--project-id`})}),`\n`,_jsx(_components.li,{children:_jsx(_components.a,{href:`#agent-vault-run--env-infisical-agent-vault-project-id`,children:_jsx(_components.code,{children:`INFISICAL_AGENT_VAULT_PROJECT_ID`})})}),`\n`,_jsx(_components.li,{children:_jsx(_components.a,{href:`#agent-vault-run--env-infisical-project-id`,children:_jsx(_components.code,{children:`INFISICAL_PROJECT_ID`})})}),`\n`]}),_jsxs(_components.p,{children:[`A session token already belongs to a project, so the command doesn’t need a project if you pass `,_jsx(_components.code,{children:`--session-token`}),`.`]}),_jsx(Note,{children:_jsx(_components.p,{children:`The CLI gives flags precedence over environment variables. If you pass either a session token or access bundle as a flag, the CLI will ignore any session token or access bundle that you’ve set as an environment variable.`})}),_jsxs(_components.p,{children:[`The command also needs the proxy’s address. You can provide it either by passing `,_jsx(_components.code,{children:`--proxy`}),` or by setting `,_jsx(_components.a,{href:`#agent-vault-run--env-infisical-agent-vault-proxy-address`,children:_jsx(_components.code,{children:`INFISICAL_AGENT_VAULT_PROXY_ADDRESS`})}),`.`]}),_jsxs(_components.p,{children:[`The command starts the agent with `,_jsx(_components.code,{children:`HTTP_PROXY`}),` and `,_jsx(_components.code,{children:`HTTPS_PROXY`}),` set to the proxy’s address, and sets the `,_jsx(_components.a,{href:`/documentation/platform/agent-vault/proxies#certificate-trust`,children:`variables that make the agent’s HTTP clients trust the proxy’s certificate`}),`. The agent inherits the rest of your environment, and the command exits with the agent’s exit code.`]}),_jsxs(_components.p,{children:[`Before the agent starts, the command installs the `,_jsx(_components.a,{href:`/documentation/platform/agent-vault/skills`,children:`skills`}),` in the session’s access bundle in `,_jsx(_components.code,{children:`~/.agents/skills`}),`, and links them for Claude Code and Hermes. To install the skills in another folder, pass `,_jsx(_components.code,{children:`--skills-dir`}),`, and to start the agent without them, pass `,_jsx(_components.code,{children:`--no-skills`}),`. The installed skills stay after the agent exits. To pick up skills that changed while the agent runs, restart the agent. For which folders the command links and replaces, see `,_jsx(_components.a,{href:`/documentation/platform/agent-vault/skills#how-agents-get-skills`,children:`How agents get skills`}),`.`]})]})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsx(CLICommand,{id:`agent-vault-sessions`,command:`agent-vault sessions`,children:_jsxs(_components.p,{children:[`Create and revoke Agent Vault `,_jsx(_components.a,{href:`/documentation/platform/agent-vault/sessions`,children:`sessions`}),` from a script, for example to create a session in one step of a job and start the agent with `,_jsx(_components.a,{href:`/cli/reference#agent-vault-run`,children:`infisical agent-vault run`}),` in another.`]})})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsxs(CLICommand,{id:`agent-vault-sessions-create`,command:`agent-vault sessions create`,usage:`--access-bundle \u003cname> [flags]`,flags:[{name:`--access-bundle`,value:`\u003cstringArray>`,type:`stringArray`,required:true,description:\"The access bundle to create the session with, by name, such as `coding-agent`. A session holds one access bundle, so pass the flag only once. Can also be set with `INFISICAL_AGENT_VAULT_ACCESS_BUNDLE`.\"},{name:`--client-id`,value:`\u003cstring>`,type:`string`,description:\"The client ID of the machine identity that creates the session. Can also be set with `INFISICAL_UNIVERSAL_AUTH_CLIENT_ID`.\"},{name:`--client-secret`,value:`\u003cstring>`,type:`string`,description:\"The client secret of the machine identity that creates the session. Can also be set with `INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET`.\"},{name:`--label`,value:`\u003cstring>`,type:`string`,description:\"A short description of what the session is for, shown on the **Sessions** page, such as `nightly deploy`. Up to 128 characters.\"},{name:`--output`,short:`-o`,value:`\u003cstring>`,type:`string`,description:\"Print the session's ID, token, project ID, access bundle, label, and expiry as `json` or `yaml`, instead of only the token.\"},{name:`--project-id`,value:`\u003cstring>`,type:`string`,description:\"The ID of the [Agent Vault project](/documentation/platform/agent-vault/projects) to create the session in. If you leave it out, the CLI reads `INFISICAL_AGENT_VAULT_PROJECT_ID`, then `INFISICAL_PROJECT_ID`.\"},{name:`--ttl`,value:`\u003cstring>`,type:`string`,default:`never`,description:\"How long the session lasts: one number and one unit, such as `30m`, `8h`, or `7d` (not `2h30m`), or `never`.\"}],env:[{name:`INFISICAL_AGENT_VAULT_ACCESS_BUNDLE`,description:\"The access bundle to create the session with, by name. Used if `--access-bundle` isn't passed.\"},{name:`INFISICAL_AGENT_VAULT_PROJECT_ID`,description:\"The ID of the Agent Vault project to create the session in. Used if `--project-id` isn't passed.\"},{name:`INFISICAL_PROJECT_ID`,description:\"The ID of the Agent Vault project to create the session in. Used if `--project-id` and `INFISICAL_AGENT_VAULT_PROJECT_ID` aren't set.\"},{name:`INFISICAL_UNIVERSAL_AUTH_CLIENT_ID`,description:\"The client ID of the machine identity that creates the session. Used if `--client-id` isn't passed.\"},{name:`INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET`,description:\"The client secret of the machine identity that creates the session. Used if `--client-secret` isn't passed.\"},{name:`INFISICAL_TOKEN`,description:`A machine identity access token to create the session as. Used if no client ID and client secret are set.`}],examples:[{title:`Create a session and keep its token in a variable`,code:`export INFISICAL_AGENT_VAULT_SESSION_TOKEN=$(infisical agent-vault sessions create \\\\\n --project-id=\u003cproject-id> \\\\\n --access-bundle=code-review \\\\\n --ttl=8h)`},{title:`Print the session's details as JSON`,code:`infisical agent-vault sessions create --project-id=\u003cproject-id> --access-bundle=code-review --label=\"nightly deploy\" -o json`}],children:[_jsxs(_components.p,{children:[`Create a `,_jsx(_components.a,{href:`/documentation/platform/agent-vault/sessions`,children:`session`}),` with an `,_jsx(_components.a,{href:`/documentation/platform/agent-vault/access-bundles`,children:`access bundle`}),` and print its session token. The command prints only the token, so you can save it in a variable and pass it to `,_jsx(_components.a,{href:`/cli/reference#agent-vault-run`,children:`infisical agent-vault run`}),` or to an agent. Pass `,_jsx(_components.code,{children:`-o json`}),` or `,_jsx(_components.code,{children:`-o yaml`}),` to also print the session’s ID, project ID, access bundle, label, and expiry.`]}),_jsx(_components.p,{children:`The command reads the Agent Vault project in this order, and stops with an error if none is set:`}),_jsxs(_components.ol,{children:[`\n`,_jsx(_components.li,{children:_jsx(_components.code,{children:`--project-id`})}),`\n`,_jsx(_components.li,{children:_jsx(_components.a,{href:`#agent-vault-sessions-create--env-infisical-agent-vault-project-id`,children:_jsx(_components.code,{children:`INFISICAL_AGENT_VAULT_PROJECT_ID`})})}),`\n`,_jsx(_components.li,{children:_jsx(_components.a,{href:`#agent-vault-sessions-create--env-infisical-project-id`,children:_jsx(_components.code,{children:`INFISICAL_PROJECT_ID`})})}),`\n`]}),_jsxs(_components.p,{children:[`If the project doesn’t come from `,_jsx(_components.code,{children:`--project-id`}),`, the command prints the project’s ID and where it came from to stderr, unless you pass `,_jsx(_components.code,{children:`--silent`}),` or `,_jsx(_components.code,{children:`-o`}),`.`]}),_jsxs(_components.p,{children:[`The session stays active until it expires or you revoke it with `,_jsx(_components.a,{href:`/cli/reference#agent-vault-sessions-revoke`,children:`infisical agent-vault sessions revoke`}),`. Because `,_jsx(_components.code,{children:`--ttl`}),` defaults to `,_jsx(_components.code,{children:`never`}),`, set a `,_jsx(_components.code,{children:`--ttl`}),` unless you always revoke the session.`]})]})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsxs(CLICommand,{id:`agent-vault-sessions-revoke`,command:`agent-vault sessions revoke`,usage:`[session-id] [flags]`,args:[{name:`session-id`,usage:`[session-id]`,description:`The ID of the session to revoke, as shown on the **Sessions** page. Leave it out to revoke by session token.`}],flags:[{name:`--client-id`,value:`\u003cstring>`,type:`string`,description:\"The client ID of the machine identity to revoke the session as, when you revoke by ID. Can also be set with `INFISICAL_UNIVERSAL_AUTH_CLIENT_ID`.\"},{name:`--client-secret`,value:`\u003cstring>`,type:`string`,description:\"The client secret of the machine identity to revoke the session as, when you revoke by ID. Can also be set with `INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET`.\"},{name:`--session-token`,value:`\u003cstring>`,type:`string`,description:\"The session token of the session to revoke, instead of its ID. Can't be combined with a session ID. Can also be set with `INFISICAL_AGENT_VAULT_SESSION_TOKEN`.\"}],env:[{name:`INFISICAL_AGENT_VAULT_SESSION_TOKEN`,description:\"The session token of the session to revoke. Used if neither a session ID nor `--session-token` is passed.\"}],examples:[{title:`Revoke a session by its ID`,code:`infisical agent-vault sessions revoke \u003csession-id>`},{title:`Revoke the session in INFISICAL_AGENT_VAULT_SESSION_TOKEN`,code:`infisical agent-vault sessions revoke`}],children:[_jsxs(_components.p,{children:[`Revoke an Agent Vault `,_jsx(_components.a,{href:`/documentation/platform/agent-vault/sessions`,children:`session`}),`, so the proxy stops attaching credentials to the agent’s requests within one `,_jsx(_components.a,{href:`/documentation/platform/agent-vault/proxies#poll-interval`,children:`poll interval`}),`. The command doesn’t ask for confirmation.`]}),_jsx(_components.p,{children:`Name the session in one of two ways:`}),_jsxs(_components.ul,{children:[`\n`,_jsx(_components.li,{children:`Pass the session’s ID to revoke it as your logged-in user or as a machine identity that has access to the session`}),`\n`,_jsxs(_components.li,{children:[`Pass `,_jsx(_components.code,{children:`--session-token`}),` with the session token to revoke the session without logging in, such as from the agent that holds the token`]}),`\n`]}),_jsxs(_components.p,{children:[`If you pass neither, the command revokes the session whose token is in `,_jsx(_components.a,{href:`#agent-vault-sessions-revoke--env-infisical-agent-vault-session-token`,children:_jsx(_components.code,{children:`INFISICAL_AGENT_VAULT_SESSION_TOKEN`})}),`. If you pass a session ID, the command ignores that variable.`]}),_jsx(_components.p,{children:`If the session is already revoked or expired, the command still succeeds.`})]})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsx(CLICommand,{id:`agent-vault-skills`,command:`agent-vault skills`,children:_jsxs(_components.p,{children:[`Manage the `,_jsx(_components.a,{href:`/documentation/platform/agent-vault/skills`,children:`skills`}),` that Agent Vault installs for agents. `,_jsx(_components.a,{href:`/cli/reference#agent-vault-skills-push`,children:`infisical agent-vault skills push`}),` adds a skill from a folder or publishes a new version of it.`]})})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsxs(CLICommand,{id:`agent-vault-skills-push`,command:`agent-vault skills push`,usage:`\u003cfolder> [flags]`,args:[{name:`folder`,usage:`\u003cfolder>`,required:true,description:\"The folder that holds one skill, with `SKILL.md` at its root.\"}],flags:[{name:`--client-id`,value:`\u003cstring>`,type:`string`,description:\"The client ID of the machine identity to push as. Can also be set with `INFISICAL_UNIVERSAL_AUTH_CLIENT_ID`.\"},{name:`--client-secret`,value:`\u003cstring>`,type:`string`,description:\"The client secret of the machine identity to push as. Can also be set with `INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET`.\"},{name:`--project-id`,value:`\u003cstring>`,type:`string`,description:\"The ID of the [Agent Vault project](/documentation/platform/agent-vault/projects) to push the skill to. If you leave it out, the CLI reads `INFISICAL_AGENT_VAULT_PROJECT_ID`, then `INFISICAL_PROJECT_ID`.\"}],env:[{name:`INFISICAL_AGENT_VAULT_PROJECT_ID`,description:\"The ID of the Agent Vault project to push the skill to. Used if `--project-id` isn't passed.\"},{name:`INFISICAL_PROJECT_ID`,description:\"The ID of the Agent Vault project to push the skill to. Used if `--project-id` and `INFISICAL_AGENT_VAULT_PROJECT_ID` aren't set.\"},{name:`INFISICAL_UNIVERSAL_AUTH_CLIENT_ID`,description:\"The client ID of the machine identity to push as. Used if `--client-id` isn't passed.\"},{name:`INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET`,description:\"The client secret of the machine identity to push as. Used if `--client-secret` isn't passed.\"},{name:`INFISICAL_UNIVERSAL_AUTH_ACCESS_TOKEN`,description:`A machine identity access token to push as. Used if no client ID and client secret are set.`},{name:`INFISICAL_TOKEN`,description:\"A machine identity access token to push as. Used if no client ID and client secret are set and `INFISICAL_UNIVERSAL_AUTH_ACCESS_TOKEN` isn't set.\"}],examples:[{title:`Push a skill as the logged-in user`,code:`infisical agent-vault skills push ./skills/code-review --project-id=\u003cproject-id>`},{title:`Push a skill as a machine identity`,code:`infisical agent-vault skills push ./skills/code-review \\\\\n --project-id=\u003cproject-id> \\\\\n --client-id=\u003cclient-id> \\\\\n --client-secret=\u003cclient-secret>`}],children:[_jsxs(_components.p,{children:[`Upload a skill folder to an Agent Vault project. Each command pushes one folder, and the `,_jsx(_components.code,{children:`name`}),` in the folder’s `,_jsx(_components.code,{children:`SKILL.md`}),` decides which skill in the project the folder updates:`]}),_jsxs(_components.ul,{children:[`\n`,_jsx(_components.li,{children:`If no skill has that name, the command creates the skill`}),`\n`,_jsx(_components.li,{children:`If a skill has that name, the command publishes the folder as the skill’s next version`}),`\n`,_jsxs(_components.li,{children:[`If the files match the skill’s latest version, the command prints `,_jsx(_components.code,{children:`unchanged`}),` and doesn’t create a version`]}),`\n`]}),_jsxs(_components.p,{children:[`The command skips hidden files and folders, such as `,_jsx(_components.code,{children:`.DS_Store`}),`, and refuses a folder that holds a symbolic link. To push as a machine identity from a script or CI, pass `,_jsx(_components.code,{children:`--client-id`}),` and `,_jsx(_components.code,{children:`--client-secret`}),`, or set `,_jsx(_components.code,{children:`INFISICAL_TOKEN`}),` to the identity’s access token. The user or machine identity needs the Admin role in the Agent Vault project.`]}),_jsxs(_components.p,{children:[`The command reads the project the same way as `,_jsx(_components.a,{href:`/cli/reference#agent-vault-sessions-create`,children:`infisical agent-vault sessions create`}),`: from `,_jsx(_components.code,{children:`--project-id`}),`, then `,_jsx(_components.code,{children:`INFISICAL_AGENT_VAULT_PROJECT_ID`}),`, then `,_jsx(_components.code,{children:`INFISICAL_PROJECT_ID`}),`. It stops with an error if none is set.`]})]})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsxs(CLICommand,{id:`bootstrap`,command:`bootstrap`,usage:`[flags]`,flags:[{name:`--domain`,value:`\u003cstring>`,type:`string`,required:true,description:\"The URL of the Infisical instance to bootstrap. Can also be set with `INFISICAL_DOMAIN`, or the older `INFISICAL_API_URL`.\"},{name:`--email`,value:`\u003cstring>`,type:`string`,required:true,description:\"The email address of the admin user to create. Can also be set with `INFISICAL_ADMIN_EMAIL`.\"},{name:`--ignore-if-bootstrapped`,type:`bool`,description:`Exit without an error message if bootstrapping fails, for example because the instance is already bootstrapped. Use it to make scripts safe to run twice.`},{name:`--k8-secret-name`,value:`\u003cstring>`,type:`string`,description:\"The name of the Kubernetes secret to create or update. Required with `--output=k8-secret`.\"},{name:`--k8-secret-namespace`,value:`\u003cstring>`,type:`string`,description:\"The namespace of the Kubernetes secret. Required with `--output=k8-secret`.\"},{name:`--k8-secret-template`,value:`\u003cstring>`,type:`string`,default:`{\"data\":{\"token\":\"{{.Identity.Credentials.Token}}\"}}`,description:\"A Go template that renders the secret's `data` and `stringData` as JSON, for `--output=k8-secret`. It can read the response fields, such as `.Identity.Credentials.Token`, `.Organization.ID`, and `.User.Email`, and use the `encodeBase64` function.\"},{name:`--organization`,value:`\u003cstring>`,type:`string`,required:true,description:\"The name of the organization to create. Can also be set with `INFISICAL_ADMIN_ORGANIZATION`.\"},{name:`--output`,value:`\u003cstring>`,type:`string`,description:\"Where to send the result. `k8-secret` writes it to a Kubernetes secret. Any other value, or none, prints it as JSON.\"},{name:`--password`,value:`\u003cstring>`,type:`string`,required:true,description:\"The password of the admin user to create. Can also be set with `INFISICAL_ADMIN_PASSWORD`.\"}],examples:[{title:`Bootstrap an instance`,code:`infisical bootstrap \\\\\n --domain=https://infisical.example.com \\\\\n [email protected] \\\\\n --password=\u003cpassword> \\\\\n --organization=\u003corganization>`},{title:`Capture the admin token`,code:`TOKEN=$(infisical bootstrap --domain=https://infisical.example.com [email protected] --password=\u003cpassword> --organization=\u003corganization> | jq -r \".identity.credentials.token\")`},{title:`Store the token in a Kubernetes secret`,code:`infisical bootstrap \\\\\n --domain=https://infisical.example.com \\\\\n [email protected] \\\\\n --password=\u003cpassword> \\\\\n --organization=\u003corganization> \\\\\n --output=k8-secret \\\\\n --k8-secret-name=infisical-bootstrap \\\\\n --k8-secret-namespace=default \\\\\n --ignore-if-bootstrapped`}],children:[_jsxs(_components.p,{children:[`Set up a new self-hosted Infisical instance without the web UI, for `,_jsx(_components.a,{href:`/self-hosting/guides/automated-bootstrapping`,children:`automated deployments`}),`. The command creates an admin user, an organization, and an instance admin machine identity, and prints the result as JSON, including the machine identity’s access token. Bootstrapping works only once per instance.`]}),_jsx(_components.p,{children:`The machine identity has the highest privileges on the instance. Treat its token as a root credential.`}),_jsxs(_components.p,{children:[`With `,_jsx(_components.code,{children:`--output=k8-secret`}),`, the command writes the result to a Kubernetes secret instead, creating it or updating it if it exists. It must run inside a Kubernetes pod whose service account can `,_jsx(_components.code,{children:`get`}),`, `,_jsx(_components.code,{children:`create`}),`, and `,_jsx(_components.code,{children:`update`}),` secrets in the namespace.`]})]})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsx(CLICommand,{id:`cert-manager`,command:`cert-manager`,children:_jsxs(_components.p,{children:[`Manage certificates with the Infisical Agent. `,_jsx(_components.a,{href:`/cli/reference#cert-manager-agent`,children:`infisical cert-manager agent`}),` runs the agent in certificate management mode.`]})})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsxs(CLICommand,{id:`cert-manager-agent`,command:`cert-manager agent`,usage:`[flags]`,flags:[{name:`--config`,value:`\u003cstring>`,type:`string`,default:`certificate-agent-config.yaml`,description:\"The path to the agent's YAML configuration file. Ignored when `INFISICAL_AGENT_CONFIG_BASE64` is set.\"},{name:`--verbose`,short:`-v`,type:`bool`,description:`Log at debug level, for troubleshooting.`}],examples:[{title:`Start the certificate agent`,code:`infisical cert-manager agent --config=/etc/infisical/agent-config.yaml`},{title:`Start it with debug logging`,code:`infisical cert-manager agent --config=/etc/infisical/agent-config.yaml --verbose`}],children:[_jsxs(_components.p,{children:[`Run the Infisical Agent in `,_jsx(_components.a,{href:`/documentation/platform/pki/reference/infisical-agent`,children:`certificate management mode`}),`. The agent authenticates as a machine identity, requests the certificates in its configuration, writes them to disk, and renews them before they expire. It runs until it gets `,_jsx(_components.code,{children:`SIGINT`}),`, `,_jsx(_components.code,{children:`SIGTERM`}),`, or `,_jsx(_components.code,{children:`SIGQUIT`}),`.`]}),_jsxs(_components.p,{children:[`On restart, the agent reuses each certificate it already issued instead of requesting a new one. It tracks each certificate in a hidden state file next to it, named `,_jsx(_components.code,{children:`.\u003ccertificate-file>.infisical-agent-state.json`}),`. The agent issues a new certificate if that file is missing, the certificate files changed on disk, or the certificate’s configuration changed. Certificates configured with `,_jsx(_components.code,{children:`certificate-id`}),`, `,_jsx(_components.code,{children:`csr`}),`, or `,_jsx(_components.code,{children:`csr-path`}),` aren’t reused.`]}),_jsxs(_components.p,{children:[`The configuration can’t include secret templates. To render secrets as well, use `,_jsx(_components.a,{href:`/cli/reference#agent`,children:`infisical agent`}),`. To pass the configuration without a file, set `,_jsx(_components.code,{children:`INFISICAL_AGENT_CONFIG_BASE64`}),` to the base64-encoded YAML.`]})]})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsx(CLICommand,{id:`gateway`,command:`gateway`,children:_jsxs(_components.p,{children:[`Run an Infisical `,_jsx(_components.a,{href:`/documentation/platform/gateways/overview`,children:`gateway`}),`, which lets Infisical reach resources in a private network, such as a database in a private subnet. A gateway either connects out to a relay, so it needs no inbound firewall rules, or listens for Infisical to connect to it directly. Run it in the foreground with `,_jsx(_components.a,{href:`/cli/reference#gateway-start`,children:`infisical gateway start`}),`, or as a systemd service with `,_jsx(_components.a,{href:`/cli/reference#gateway-systemd-install`,children:`infisical gateway systemd install`}),`.`]})})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsxs(CLICommand,{id:`gateway-start`,command:`gateway start`,usage:`\u003cname> [flags]`,args:[{name:`name`,usage:`\u003cname>`,required:true,description:\"The gateway's name. Use the same name on every start so the gateway reuses its saved credentials. Can also be set with `INFISICAL_GATEWAY_NAME`.\"}],flags:[{name:`--auth-method`,value:`\u003cstring>`,type:`string`,description:\"Log in as a machine identity with this method instead of enrolling: `universal-auth`, `kubernetes`, `azure`, `gcp-id-token`, `gcp-iam`, `aws-iam`, or `oidc-auth`. Can also be set with `INFISICAL_AUTH_METHOD`.\"},{name:`--bind`,value:`\u003cstring>`,type:`string`,description:\"The local `host:port` to listen on when Infisical connects to the gateway directly. Defaults to all interfaces on the configured direct port. Can also be set with `INFISICAL_GATEWAY_BIND_ADDRESS`.\"},{name:`--client-id`,value:`\u003cstring>`,type:`string`,description:\"The machine identity's client ID, for `--auth-method=universal-auth`. Can also be set with `INFISICAL_UNIVERSAL_AUTH_CLIENT_ID`.\"},{name:`--client-secret`,value:`\u003cstring>`,type:`string`,description:\"The machine identity's client secret, for `--auth-method=universal-auth`. Can also be set with `INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET`.\"},{name:`--domain`,value:`\u003cstring>`,type:`string`,description:`The Infisical instance to connect to. Without it, the gateway uses the domain it saved when it enrolled, then your active profile's domain.`},{name:`--enroll-method`,value:`\u003cstring>`,type:`string`,description:\"How the gateway authenticates on its own: `token` for a one-time enrollment token from Infisical, `aws`, `gcp`, or `kubernetes`. Can also be set with `INFISICAL_GATEWAY_ENROLL_METHOD`.\"},{name:`--gateway-id`,value:`\u003cstring>`,type:`string`,description:\"The gateway's ID from Infisical. Required with `--enroll-method=aws`, `gcp`, or `kubernetes`, unless the gateway saved it on an earlier start. Can also be set with `INFISICAL_GATEWAY_ID`.\"},{name:`--gcp-auth-type`,value:`\u003cstring>`,type:`string`,description:\"How the gateway proves its GCP identity with `--enroll-method=gcp`: `gce` reads a token from the instance metadata server, covering Compute Engine VMs and GKE workload identity, and `iam` signs a JWT through the IAM Credentials API. Defaults to `gce`. Can also be set with `INFISICAL_GATEWAY_GCP_AUTH_TYPE`.\"},{name:`--jwt`,value:`\u003cstring>`,type:`string`,description:\"The JWT to exchange for an access token, for `--auth-method=oidc-auth`.\"},{name:`--listen-address`,value:`\u003cstring>`,type:`string`,description:\"The stable `host:port` the gateway advertises so Infisical can connect to it directly instead of through a relay. Can also be set with `INFISICAL_GATEWAY_LISTEN_ADDRESS`.\"},{name:`--machine-identity-id`,value:`\u003cstring>`,type:`string`,description:\"The machine identity's ID, for every `--auth-method` except `universal-auth`.\"},{name:`--name`,value:`\u003cstring>`,type:`string`,deprecated:true,description:\"Deprecated: pass the name as an argument instead, as in `infisical gateway start \u003cname>`.\"},{name:`--organization-slug`,value:`\u003cstring>`,type:`string`,description:`The slug of a sub-organization to scope the machine identity's session to. Without it, the session uses the organization the machine identity was created in.`},{name:`--pam-session-recording-path`,value:`\u003cstring>`,type:`string`,description:\"The directory to store PAM session recordings in. Defaults to `/var/lib/infisical/session_recordings`. Can also be set with `INFISICAL_PAM_SESSION_RECORDING_PATH`.\"},{name:`--pkcs11-module`,value:`\u003cstring>`,type:`string`,description:\"The absolute path to a PKCS#11 driver, such as `/opt/fortanix/pkcs11/fortanix_pkcs11.so`. The gateway loads it and serves HSM operations through it. Can also be set with `INFISICAL_PKCS11_MODULE`.\"},{name:`--relay`,value:`\u003cstring>`,type:`string`,deprecated:true,description:\"Deprecated: use `--target-relay-name` instead.\"},{name:`--service-account-key-file-path`,value:`\u003cstring>`,type:`string`,description:\"The path to a GCP service account key file, for `--auth-method=gcp-iam`. Can also be set with `INFISICAL_GCP_IAM_SERVICE_ACCOUNT_KEY_FILE_PATH`.\"},{name:`--service-account-token-path`,value:`\u003cstring>`,type:`string`,description:\"The path to the Kubernetes service account token, for `--auth-method=kubernetes`. Defaults to `/var/run/secrets/kubernetes.io/serviceaccount/token`. Can also be set with `INFISICAL_KUBERNETES_SERVICE_ACCOUNT_TOKEN_PATH`.\"},{name:`--target-relay-name`,value:`\u003cstring>`,type:`string`,description:`The relay to connect through. Without it, the gateway picks the healthy relay with the lowest latency.`},{name:`--token`,value:`\u003cstring>`,type:`string`,description:\"With `--enroll-method=token`, the one-time enrollment token. Otherwise, a machine identity access token to connect with, which can also be set with `INFISICAL_TOKEN`.\"}],examples:[{title:`Enroll and start a gateway`,code:`infisical gateway start my-gateway --enroll-method=token --token=\u003cenrollment-token>`},{title:`Start an enrolled gateway again`,code:`infisical gateway start my-gateway`},{title:`Start a gateway on AWS`,code:`infisical gateway start my-gateway --enroll-method=aws --gateway-id=\u003cgateway-id>`},{title:`Start a gateway in Kubernetes`,code:`infisical gateway start my-gateway --enroll-method=kubernetes --gateway-id=\u003cgateway-id>`}],children:[_jsx(_components.p,{children:`Start a gateway in the foreground. A gateway authenticates in one of two ways.`}),_jsxs(_components.p,{children:[`With `,_jsx(_components.code,{children:`--enroll-method`}),`, the gateway authenticates as itself. With `,_jsx(_components.code,{children:`token`}),`, it exchanges a one-time enrollment token from Infisical for an access token on first start. With `,_jsx(_components.code,{children:`aws`}),`, `,_jsx(_components.code,{children:`gcp`}),`, or `,_jsx(_components.code,{children:`kubernetes`}),`, it proves its cloud identity on each start. It saves its credentials to `,_jsx(_components.code,{children:`~/.infisical/gateways/\u003cname>.conf`}),`, or `,_jsx(_components.code,{children:`/etc/infisical/gateways/\u003cname>.conf`}),` when run as root, so later starts need only the name.`]}),_jsxs(_components.p,{children:[`With `,_jsx(_components.code,{children:`--auth-method`}),` or `,_jsx(_components.code,{children:`--token`}),`, the gateway logs in as a machine identity instead, using the same flags as `,_jsx(_components.a,{href:`/cli/reference#login`,children:`infisical login`}),`.`]})]})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsx(CLICommand,{id:`gateway-systemd`,command:`gateway systemd`,children:_jsx(_components.p,{children:`Install or remove a systemd service that runs a gateway. Both commands run only on Linux, as root.`})})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsx(CLICommand,{id:`gateway-systemd-install`,command:`gateway systemd install`,usage:`\u003cname> [flags]`,args:[{name:`name`,usage:`\u003cname>`,required:true,description:`The gateway's name. The service is named after it.`}],flags:[{name:`--bind`,value:`\u003cstring>`,type:`string`,description:\"The local `host:port` to listen on when Infisical connects to the gateway directly. Defaults to all interfaces on the configured direct port.\"},{name:`--domain`,value:`\u003cstring>`,type:`string`,description:`The Infisical instance to connect to.`},{name:`--enroll-method`,value:`\u003cstring>`,type:`string`,description:\"How the gateway authenticates: `token` for a one-time enrollment token, or `aws` or `gcp` to prove its cloud identity each time the service starts. `kubernetes` isn't available, because in-cluster gateways aren't managed by systemd.\"},{name:`--gateway-id`,value:`\u003cstring>`,type:`string`,description:\"The gateway's ID from Infisical. Required with `--enroll-method=aws` or `--enroll-method=gcp`.\"},{name:`--gcp-auth-type`,value:`\u003cstring>`,type:`string`,description:\"How the gateway proves its GCP identity with `--enroll-method=gcp`: `gce` or `iam`. Defaults to `gce`.\"},{name:`--listen-address`,value:`\u003cstring>`,type:`string`,description:\"The stable `host:port` the gateway advertises so Infisical can connect to it directly instead of through a relay.\"},{name:`--log-file`,value:`\u003cstring>`,type:`string`,description:\"A file to write the service's logs to, such as `/var/log/infisical/gateway.log`. Without it, logs aren't written to a file.\"},{name:`--name`,value:`\u003cstring>`,type:`string`,deprecated:true,description:\"Deprecated: pass the name as an argument instead, as in `infisical gateway systemd install \u003cname>`.\"},{name:`--pkcs11-module`,value:`\u003cstring>`,type:`string`,description:`The absolute path to a PKCS#11 driver. The service starts the gateway with the driver loaded for HSM operations.`},{name:`--relay`,value:`\u003cstring>`,type:`string`,deprecated:true,description:\"Deprecated: use `--target-relay-name` instead.\"},{name:`--service-account-key-file-path`,value:`\u003cstring>`,type:`string`,description:\"The path to a GCP service account key file, for `--gcp-auth-type=iam`. Use an absolute path outside `/home` and `/tmp`, such as one in `/etc/infisical`, because the service can't read those directories.\"},{name:`--target-relay-name`,value:`\u003cstring>`,type:`string`,description:`The relay to connect through. Without it, the gateway picks the healthy relay with the lowest latency.`},{name:`--token`,value:`\u003cstring>`,type:`string`,description:\"With `--enroll-method=token`, the one-time enrollment token. Otherwise, a machine identity access token.\"}],examples:[{title:`Install a gateway service`,code:`sudo infisical gateway systemd install my-gateway --enroll-method=token --token=\u003cenrollment-token> --domain=https://app.infisical.com`},{title:`Start the installed service`,code:`sudo systemctl start my-gateway`}],children:_jsxs(_components.p,{children:[`Install and enable a systemd service that runs the gateway. The service is named after the gateway, and its configuration is written to `,_jsx(_components.code,{children:`/etc/infisical/gateways/\u003cname>.conf`}),`. Start it with `,_jsx(_components.code,{children:`sudo systemctl start \u003cname>`}),`. Run the command as root on Linux.`]})})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsx(CLICommand,{id:`gateway-systemd-uninstall`,command:`gateway systemd uninstall`,usage:`[name]`,args:[{name:`name`,usage:`[name]`,description:\"The gateway whose service to remove. Without it, the command removes the single `infisical-gateway` service that older CLI versions installed.\"}],examples:[{title:`Remove a gateway service`,code:`sudo infisical gateway systemd uninstall my-gateway`}],children:_jsx(_components.p,{children:`Stop and remove a gateway’s systemd service. Run the command as root on Linux.`})})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsxs(CLICommand,{id:`init`,command:`init`,usage:`[flags]`,flags:[{name:`--project-id`,value:`\u003cstring>`,type:`string`,description:\"Project ID to link this directory to. When set, skips the interactive org and project pickers and writes `.infisical.yaml` directly. Find the ID with [infisical secrets-manager projects get](/cli/reference#secrets-manager-projects-get).\"}],examples:[{title:`Link the current directory to a project`,code:`infisical init`},{title:`Link a known project without prompts`,code:`infisical init --project-id \u003cproject-id>`},{title:`Link a project using another profile`,code:`infisical init --profile=\u003cprofile>`}],children:[_jsxs(_components.p,{children:[`Link the current directory to an Infisical project. The command lists the projects in your profile’s organization and writes the one you choose to `,_jsx(_components.code,{children:`.infisical.yaml`}),`, so later commands in this directory and its subdirectories know which project to use. It needs a user login, and starts one if you have no profile.`]}),_jsxs(_components.p,{children:[`If the current directory already has an `,_jsx(_components.code,{children:`.infisical.yaml`}),` or a legacy `,_jsx(_components.code,{children:`.infisical.json`}),`, the command asks before writing a new `,_jsx(_components.code,{children:`.infisical.yaml`}),`. The new file holds only the project ID, and the CLI reads it instead of the old file, so settings you added, such as the default environment, no longer apply. To keep those settings, edit the existing file instead of running `,_jsx(_components.code,{children:`init`}),`. See `,_jsx(_components.a,{href:`/cli/project-config`,children:`project config`}),` for the file format.`]}),_jsx(Note,{children:_jsxs(_components.p,{children:[`If you run `,_jsx(_components.code,{children:`init`}),` without a terminal, such as in CI or from a script, the command never prompts. It exits with an error unless you pass `,_jsx(_components.code,{children:`--project-id`}),`, and it doesn’t replace an existing `,_jsx(_components.code,{children:`.infisical.yaml`}),` or legacy `,_jsx(_components.code,{children:`.infisical.json`}),`. To link a different project, edit `,_jsx(_components.code,{children:`secrets-management.project-id`}),` in `,_jsx(_components.code,{children:`.infisical.yaml`}),`, or `,_jsx(_components.code,{children:`workspaceId`}),` in a legacy `,_jsx(_components.code,{children:`.infisical.json`}),`.`]})})]})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsx(CLICommand,{id:`kmip`,command:`kmip`,children:_jsxs(_components.p,{children:[`Run a `,_jsx(_components.a,{href:`/documentation/platform/kms/kmip`,children:`KMIP`}),` server, which lets clients that use the Key Management Interoperability Protocol (KMIP) use Infisical as their key manager. Run it in the foreground with `,_jsx(_components.a,{href:`/cli/reference#kmip-start`,children:`infisical kmip start`}),`, or as a systemd service with `,_jsx(_components.a,{href:`/cli/reference#kmip-systemd-install`,children:`infisical kmip systemd install`}),`.`]})})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsx(CLICommand,{id:`kmip-start`,command:`kmip start`,usage:`\u003cserver-name> [flags]`,args:[{name:`server-name`,usage:`\u003cserver-name>`,required:true,description:\"The KMIP server's name. Can also be passed with `--server-name` or `INFISICAL_KMIP_SERVER_NAME`.\"}],flags:[{name:`--certificate-ttl`,value:`\u003cstring>`,type:`string`,description:\"How long the server's certificate is valid. Defaults to `1y`. Can also be set with `INFISICAL_KMIP_CERTIFICATE_TTL`.\"},{name:`--domain`,value:`\u003cstring>`,type:`string`,description:`The Infisical instance to connect to.`},{name:`--enroll-method`,value:`\u003cstring>`,type:`string`,description:\"How the server authenticates on its own: `token` for a one-time enrollment token, or `aws`. When set, the machine identity flags are ignored.\"},{name:`--hostnames-or-ips`,value:`\u003cstring>`,type:`string`,description:\"The hostnames or IP addresses clients use to reach the server, separated by commas. They go into its certificate. Can also be set with `INFISICAL_KMIP_HOSTNAMES_OR_IPS`.\"},{name:`--identity-auth-method`,value:`\u003cstring>`,type:`string`,default:`universal-auth`,description:\"How to log in as a machine identity when you don't use `--enroll-method`.\"},{name:`--identity-client-id`,value:`\u003cstring>`,type:`string`,description:\"The machine identity's client ID. Can also be set with `INFISICAL_UNIVERSAL_AUTH_CLIENT_ID`.\"},{name:`--identity-client-secret`,value:`\u003cstring>`,type:`string`,description:\"The machine identity's client secret. Can also be set with `INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET`.\"},{name:`--kmip-server-id`,value:`\u003cstring>`,type:`string`,description:\"The KMIP server's ID from Infisical, for `--enroll-method=aws`.\"},{name:`--listen-address`,value:`\u003cstring>`,type:`string`,description:\"The address to listen on. Defaults to `localhost:5696`. Can also be set with `INFISICAL_KMIP_LISTEN_ADDRESS`.\"},{name:`--server-name`,value:`\u003cstring>`,type:`string`,description:`The server's name, if you don't pass it as an argument.`},{name:`--token`,value:`\u003cstring>`,type:`string`,description:\"The one-time enrollment token, for `--enroll-method=token`.\"}],examples:[{title:`Enroll and start a KMIP server`,code:`infisical kmip start kmip-prod --enroll-method=token --token=\u003cenrollment-token>`},{title:`Start as a machine identity`,code:`infisical kmip start kmip-prod --identity-client-id=\u003cclient-id> --identity-client-secret=\u003cclient-secret> --hostnames-or-ips=kmip.example.com`}],children:_jsxs(_components.p,{children:[`Start a KMIP server in the foreground. It authenticates to Infisical either by enrolling with `,_jsx(_components.code,{children:`--enroll-method`}),`, or as a machine identity with `,_jsx(_components.code,{children:`--identity-client-id`}),` and `,_jsx(_components.code,{children:`--identity-client-secret`}),`.`]})})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsx(CLICommand,{id:`kmip-systemd`,command:`kmip systemd`,children:_jsx(_components.p,{children:`Install or remove a systemd service that runs a KMIP server. Both commands run only on Linux, as root.`})})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsx(CLICommand,{id:`kmip-systemd-install`,command:`kmip systemd install`,usage:`\u003cserver-name> [flags]`,args:[{name:`server-name`,usage:`\u003cserver-name>`,required:true,description:\"The KMIP server's name. Can also be passed with `--server-name`.\"}],flags:[{name:`--certificate-ttl`,value:`\u003cstring>`,type:`string`,description:`How long the server's certificate is valid.`},{name:`--domain`,value:`\u003cstring>`,type:`string`,description:`The Infisical instance to connect to.`},{name:`--enroll-method`,value:`\u003cstring>`,type:`string`,description:\"How the server authenticates on its own: `token` or `aws`. When set, the machine identity flags are ignored.\"},{name:`--hostnames-or-ips`,value:`\u003cstring>`,type:`string`,description:`The hostnames or IP addresses clients use to reach the server, separated by commas.`},{name:`--identity-client-id`,value:`\u003cstring>`,type:`string`,description:\"The machine identity's client ID, when you don't use `--enroll-method`.\"},{name:`--identity-client-secret`,value:`\u003cstring>`,type:`string`,description:\"The machine identity's client secret, when you don't use `--enroll-method`.\"},{name:`--kmip-server-id`,value:`\u003cstring>`,type:`string`,description:\"The KMIP server's ID from Infisical, for `--enroll-method=aws`.\"},{name:`--listen-address`,value:`\u003cstring>`,type:`string`,description:`The address to listen on.`},{name:`--server-name`,value:`\u003cstring>`,type:`string`,description:`The server's name, if you don't pass it as an argument.`},{name:`--token`,value:`\u003cstring>`,type:`string`,description:\"The one-time enrollment token, for `--enroll-method=token`.\"}],examples:[{title:`Install a KMIP server service`,code:`sudo infisical kmip systemd install kmip-prod --enroll-method=token --token=\u003cenrollment-token> --domain=https://app.infisical.com`}],children:_jsx(_components.p,{children:`Install and enable a systemd service that runs the KMIP server. Run the command as root on Linux.`})})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsx(CLICommand,{id:`kmip-systemd-uninstall`,command:`kmip systemd uninstall`,examples:[{title:`Remove the KMIP server service`,code:`sudo infisical kmip systemd uninstall`}],children:_jsx(_components.p,{children:`Stop and remove the KMIP server’s systemd service. Run the command as root on Linux.`})})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsxs(CLICommand,{id:`login`,command:`login`,usage:`[flags]`,flags:[{name:`--clear-domains`,type:`bool`,description:`Remove all saved self-hosted domains from the CLI's config file, then exit without logging in.`},{name:`--client-id`,value:`\u003cstring>`,type:`string`,description:\"The client ID of a machine identity, for `--method=universal-auth`. Can also be set with `INFISICAL_UNIVERSAL_AUTH_CLIENT_ID`.\"},{name:`--client-secret`,value:`\u003cstring>`,type:`string`,description:\"The client secret of a machine identity, for `--method=universal-auth`. Can also be set with `INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET`.\"},{name:`--email`,value:`\u003cstring>`,type:`string`,description:\"Your email address, for logging in without prompts along with `--password` and `--organization-id`. Can also be set with `INFISICAL_EMAIL`.\"},{name:`--interactive`,short:`-i`,type:`bool`,description:`Prompt for your email and password in the terminal instead of opening a browser.`},{name:`--jwt`,value:`\u003cstring>`,type:`string`,description:\"The JWT to exchange for an access token, for `--method=oidc-auth` and `--method=jwt-auth`. Can also be set with `INFISICAL_JWT`.\"},{name:`--machine-identity-id`,value:`\u003cstring>`,type:`string`,description:\"The ID of the machine identity to log in as. Required for every `--method` except `user` and `universal-auth`. Can also be set with `INFISICAL_MACHINE_IDENTITY_ID`.\"},{name:`--method`,value:`\u003cstring>`,type:`string`,default:`user`,description:\"How to authenticate: `user` for your own account, or a machine identity method: `universal-auth`, `kubernetes`, `azure`, `gcp-id-token`, `gcp-iam`, `aws-iam`, `oidc-auth`, or `jwt-auth`.\"},{name:`--oidc-jwt`,value:`\u003cstring>`,type:`string`,deprecated:true,description:\"Deprecated: use `--jwt` instead. The JWT for `--method=oidc-auth`.\"},{name:`--organization-id`,value:`\u003cstring>`,type:`string`,description:\"The organization to log in to, for logging in without prompts. Not needed with `--profile`, which already has one. Can also be set with `INFISICAL_ORGANIZATION_ID`.\"},{name:`--organization-slug`,value:`\u003cstring>`,type:`string`,description:`The slug of a sub-organization to scope a machine identity's session to. Without it, the session uses the organization the machine identity was created in.`},{name:`--password`,value:`\u003cstring>`,type:`string`,description:\"Your password, for logging in without prompts. Can also be set with `INFISICAL_PASSWORD`.\"},{name:`--plain`,type:`bool`,description:\"Print only the access token, with no other output. Combine with `--silent` to capture the token in a variable.\"},{name:`--save-as`,value:`\u003cstring>`,type:`string`,description:\"Store this user login as a profile with this name, creating the profile or replacing its session. To sign back in to an existing profile, pass `--profile` instead.\"},{name:`--service-account-key-file-path`,value:`\u003cstring>`,type:`string`,description:\"The path to a GCP service account key file, for `--method=gcp-iam`. Can also be set with `INFISICAL_GCP_IAM_SERVICE_ACCOUNT_KEY_FILE_PATH`.\"},{name:`--service-account-token-path`,value:`\u003cstring>`,type:`string`,description:\"The path to the Kubernetes service account token, for `--method=kubernetes`. Defaults to `/var/run/secrets/kubernetes.io/serviceaccount/token`. Can also be set with `INFISICAL_KUBERNETES_SERVICE_ACCOUNT_TOKEN_PATH`.\"}],examples:[{title:`Log in through the browser`,code:`infisical login`},{title:`Log in to EU Cloud`,code:`infisical login --domain=https://eu.infisical.com`},{title:`Log in as a machine identity`,code:`export INFISICAL_TOKEN=$(infisical login \\\\\n --method=universal-auth \\\\\n --client-id=\u003cclient-id> \\\\\n --client-secret=\u003cclient-secret> \\\\\n --silent --plain)`},{title:`Log in without prompts`,code:`infisical login \\\\\n [email protected] \\\\\n --password=\u003cpassword> \\\\\n --organization-id=\u003corganization-id>`}],children:[_jsxs(_components.p,{children:[`Log in to Infisical. By default, `,_jsx(_components.code,{children:`infisical login`}),` opens a browser, and falls back to prompts in the terminal if the browser login fails. Pass `,_jsx(_components.code,{children:`--interactive`}),` to go straight to the prompts, or `,_jsx(_components.code,{children:`--email`}),`, `,_jsx(_components.code,{children:`--password`}),`, and `,_jsx(_components.code,{children:`--organization-id`}),` to log in with no prompts at all.`]}),_jsx(_components.p,{children:`Without a terminal (when standard input isn’t a TTY), the browser login waits for the browser to send the session back to the CLI, and doesn’t offer to let you paste a token instead.`}),_jsxs(_components.p,{children:[`A user login is stored as a `,_jsx(_components.a,{href:`/cli/reference#profile`,children:`profile`}),`: an account on an Infisical instance, plus the organization it uses. Without `,_jsx(_components.code,{children:`--save-as`}),` or `,_jsx(_components.code,{children:`--profile`}),`, the profile is named after the account and organization, such as `,_jsx(_components.code,{children:`[email protected]`}),`. Credentials are kept in your system keyring; see `,_jsx(_components.a,{href:`/cli/reference#vault`,children:`infisical vault`}),` to store them elsewhere.`]}),_jsxs(_components.p,{children:[`If you log in as a machine identity (any `,_jsx(_components.code,{children:`--method`}),` other than `,_jsx(_components.code,{children:`user`}),`), the CLI doesn’t create a profile. It prints an access token, which later commands read from `,_jsx(_components.code,{children:`--token`}),` or `,_jsx(_components.code,{children:`INFISICAL_TOKEN`}),`.`]}),_jsxs(_components.p,{children:[`For any instance other than US Cloud, pass `,_jsx(_components.code,{children:`--domain`}),` or set `,_jsx(_components.code,{children:`INFISICAL_DOMAIN`}),`.`]})]})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsx(CLICommand,{id:`login-status`,command:`login status`,usage:`[flags]`,flags:[{name:`--json`,type:`bool`,description:`Print the status as JSON.`},{name:`--token`,value:`\u003cstring>`,type:`string`,description:`A machine identity access token to inspect instead of the active session or environment variables.`}],examples:[{title:`Check the current session`,code:`infisical login status`},{title:`Print the status as JSON`,code:`infisical login status --json`}],children:_jsx(_components.p,{children:`Show whether the CLI is authenticated to Infisical and, when available, the organization the session is scoped to. It checks the session of the profile in effect, or a machine identity token set in the environment.`})})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsxs(CLICommand,{id:`logout`,command:`logout`,usage:`[flags]`,flags:[{name:`--all`,type:`bool`,description:`Log out of every profile on this machine.`},{name:`--local-only`,type:`bool`,description:`Remove the stored credentials without revoking the session on the server. The session stays valid until it expires.`}],examples:[{title:`Log out of the current profile`,code:`infisical logout`},{title:`Log out of a specific profile`,code:`infisical logout --profile acme`},{title:`Log out of every profile`,code:`infisical logout --all`}],children:[_jsx(_components.p,{children:`End a login session. The CLI removes the profile’s stored credentials from this machine, and revokes its session on the server unless another profile still uses that session.`}),_jsx(_components.p,{children:`The command also deletes the secrets the CLI saved for offline use. Every profile on this machine shares them, so they’re deleted even when other profiles stay logged in, and the CLI saves them again the next time a profile fetches secrets.`}),_jsxs(_components.p,{children:[`The profile itself is kept, so `,_jsx(_components.code,{children:`infisical login --profile \u003cname>`}),` signs back in without setting it up again. To remove the profile, run `,_jsx(_components.a,{href:`/cli/reference#profile-delete`,children:`infisical profile delete`}),`.`]}),_jsxs(_components.p,{children:[`Without `,_jsx(_components.code,{children:`--all`}),` or `,_jsx(_components.code,{children:`--profile`}),`, the command logs out of the profile in effect. See `,_jsx(_components.a,{href:`/cli/reference#profile`,children:`infisical profile`}),` for how that profile is chosen.`]})]})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsxs(CLICommand,{id:`migrate-config`,command:`migrate-config`,examples:[{title:`Convert the legacy project config`,code:`infisical migrate-config`}],children:[_jsxs(_components.p,{children:[`Convert a legacy `,_jsx(_components.code,{children:`.infisical.json`}),` into `,_jsx(_components.code,{children:`.infisical.yaml`}),`. The command looks for the project config in the current directory, then in each parent directory. It writes `,_jsx(_components.code,{children:`.infisical.yaml`}),` next to the file it finds, copies every setting into it, and deletes `,_jsx(_components.code,{children:`.infisical.json`}),`.`]}),_jsxs(_components.p,{children:[`If the project already uses `,_jsx(_components.code,{children:`.infisical.yaml`}),`, the command changes nothing. It warns you when a leftover `,_jsx(_components.code,{children:`.infisical.json`}),` sits in the same directory, because `,_jsx(_components.code,{children:`.infisical.yaml`}),` takes precedence and the old file is no longer read. See `,_jsx(_components.a,{href:`/cli/project-config-migration`,children:`Migrate to .infisical.yaml`}),` for the full steps.`]})]})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsxs(CLICommand,{id:`org`,command:`org`,children:[_jsx(_components.p,{children:`List organizations, and change the one your profile uses.`}),_jsxs(_components.p,{children:[`The organization is a setting on your login profile, not a separate login. Run `,_jsx(_components.a,{href:`/cli/reference#profile-current`,children:`infisical profile current`}),` to see the profile and organization in effect, and pass `,_jsx(_components.code,{children:`--org`}),` to any command to use a different organization for that command only.`]})]})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsx(CLICommand,{id:`org-list`,command:`org list`,examples:[{title:`List your organizations`,code:`infisical org list`}],children:_jsx(_components.p,{children:`List the organizations that the current profile’s account can use. The organization the profile uses is marked.`})})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsxs(CLICommand,{id:`org-switch`,command:`org switch`,usage:`[organization] [flags]`,args:[{name:`organization`,usage:`[organization]`,description:`The organization to use, by name, slug, or ID. Without it, the CLI asks you to pick one.`}],flags:[{name:`--org-id`,value:`\u003cstring>`,type:`string`,deprecated:true,description:`Deprecated: pass the organization as an argument instead. The ID of the organization to use.`}],examples:[{title:`Pick an organization from a list`,code:`infisical org switch`},{title:`Switch to an organization by name`,code:`infisical org switch acme`}],children:[_jsxs(_components.p,{children:[`Change the current profile’s organization. This is the same command as `,_jsx(_components.a,{href:`/cli/reference#profile-set-org`,children:`infisical profile set-org`}),`.`]}),_jsxs(_components.p,{children:[`To use a different organization for a single command, pass `,_jsx(_components.code,{children:`--org`}),` to that command instead. To keep a second organization available at the same time, give it its own profile with `,_jsx(_components.a,{href:`/cli/reference#profile-create`,children:`infisical profile create`}),`.`]})]})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsx(CLICommand,{id:`pam`,command:`pam`,children:_jsxs(_components.p,{children:[`Connect to databases, servers, Kubernetes clusters, and cloud accounts managed by `,_jsx(_components.a,{href:`/documentation/platform/pam/overview`,children:`Infisical Privileged Access Management (PAM)`}),` from your terminal. A gateway supplies each account’s credential, so you never see it, and every session is recorded. Open one account for yourself with `,_jsx(_components.a,{href:`/cli/reference#pam-access`,children:`infisical pam access`}),`, or give an AI agent brokered access with `,_jsx(_components.a,{href:`/cli/reference#pam-agentic-access`,children:`infisical pam agentic access`}),`.`]})})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsxs(CLICommand,{id:`pam-access`,command:`pam access`,usage:`\u003cpath> [flags] [-- \u003ccommand>]`,args:[{name:`path`,usage:`\u003cpath>`,required:true,description:\"The account to open, as `folder/account`. A leading `/` is optional.\"},{name:`command`,usage:`[-- \u003ccommand>]`,description:\"A command to run on the target instead of opening a shell, after `--`. SSH accounts only.\"}],flags:[{name:`--duration`,value:`\u003cstring>`,type:`string`,default:`1h`,description:\"How long the session lasts, in Go duration format such as `30m`, `1h`, or `2h30m`.\"},{name:`--port`,value:`\u003cint>`,type:`int`,default:`0`,description:\"The port the local proxy listens on at `127.0.0.1`. `0` picks a free port. For SSH accounts, it applies only when a proxy runs. Has no effect on AWS IAM accounts.\"},{name:`--proxy`,type:`bool`,description:\"Start a local proxy for your own SSH, SCP, or SFTP client instead of opening a shell. It changes only SSH accounts, and you can't combine it with a command after `--`.\"},{name:`--reason`,value:`\u003cstring>`,type:`string`,description:`Why you're accessing the account, recorded for audit. If the account requires a reason and you don't pass one, the CLI prompts for it in an interactive terminal and fails otherwise.`},{name:`--target`,value:`\u003cstring>`,type:`string`,description:`The host to connect to, for accounts that allow several hosts, such as Windows AD accounts.`}],examples:[{title:`Open a database session for two hours`,code:`infisical pam access production/postgres-main --duration=2h`},{title:`Open a shell on a server`,code:`infisical pam access servers/prod-bastion`},{title:`Run one command on a server`,code:`infisical pam access servers/prod-bastion -- systemctl status nginx`},{title:`Start a local SSH proxy`,code:`infisical pam access servers/prod-bastion --proxy`}],children:[_jsxs(_components.p,{children:[`Open a session for one PAM account. The command runs as the user you logged in as with `,_jsx(_components.a,{href:`/cli/reference#login`,children:`infisical login`}),`; it doesn’t accept a machine identity. To open accounts for an agent, use `,_jsx(_components.a,{href:`/cli/reference#pam-agentic-access`,children:`infisical pam agentic access`}),`.`]}),_jsxs(_components.p,{children:[`SSH accounts connect you to a shell on the target. Pass a command after `,_jsx(_components.code,{children:`--`}),` to run only that command, or `,_jsx(_components.code,{children:`--proxy`}),` to start a local proxy instead. If no terminal is attached, the CLI starts the proxy instead of a shell.`]}),_jsxs(_components.p,{children:[`For database, Redis, Snowflake, Kubernetes, GCP, Azure, and Windows accounts, the CLI starts a local proxy on `,_jsx(_components.code,{children:`127.0.0.1`}),` and prints how to connect to it. For AWS IAM accounts, the CLI writes temporary credentials to your AWS credentials file instead. The page for each `,_jsx(_components.a,{href:`/documentation/platform/pam/accounts/account-types`,children:`account type`}),` describes how to connect. A proxy runs until you press `,_jsx(_components.code,{children:`Ctrl+C`}),` or the session expires, and the CLI then restores anything it changed, such as your kubeconfig.`]}),_jsx(_components.p,{children:`If the account requires approval, the CLI offers to submit an access request in an interactive terminal. If it requires MFA, the CLI has you complete MFA in your browser before it continues.`})]})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsx(CLICommand,{id:`pam-agentic`,command:`pam agentic`,children:_jsxs(_components.p,{children:[`Run AI agents against PAM accounts. The agent reaches each account through a local proxy and never holds a credential. Start a run with `,_jsx(_components.a,{href:`/cli/reference#pam-agentic-access`,children:`infisical pam agentic access`}),`, and see `,_jsx(_components.a,{href:`/documentation/platform/pam/ai-agents/overview`,children:`AI agents`}),` for how it works.`]})})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsxs(CLICommand,{id:`pam-agentic-access`,command:`pam agentic access`,usage:`[flags] -- \u003cagent-command>`,args:[{name:`agent-command`,usage:`\u003cagent-command>`,required:true,description:\"The command that starts the agent, such as `claude`, after `--`. Everything after `--` is passed to it unchanged.\"}],flags:[{name:`--account`,value:`\u003cstringArray>`,type:`stringArray`,description:\"An account to expose, as `folder/account`. Repeat the flag or separate paths with commas. Defaults to every account you can launch. If a named account can't be used, the command stops and says why.\"},{name:`--agent`,value:`\u003cstring>`,type:`string`,description:\"The agent type, when the CLI can't detect it from the command name: `claude`, `codex`, `gemini`, or `generic`. It sets how the instructions are delivered.\"},{name:`--auth-method`,value:`\u003cstring>`,type:`string`,description:\"Log in as a machine identity with this method: `universal-auth`, `kubernetes`, `azure`, `gcp-id-token`, `gcp-iam`, `aws-iam`, `oidc-auth`, `jwt-auth`, or `ldap-auth`. The CLI renews the machine identity's token for the whole run. Can also be set with `INFISICAL_AUTH_METHOD`.\"},{name:`--client-id`,value:`\u003cstring>`,type:`string`,description:\"The machine identity's client ID, for `--auth-method=universal-auth`. Can also be set with `INFISICAL_UNIVERSAL_AUTH_CLIENT_ID`.\"},{name:`--client-secret`,value:`\u003cstring>`,type:`string`,description:\"The machine identity's client secret, for `--auth-method=universal-auth`. Can also be set with `INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET`.\"},{name:`--duration`,value:`\u003cstring>`,type:`string`,default:`1h`,description:\"How long each PAM session can last, in Go duration format such as `30m`, `1h`, or `2h30m`. It must be positive.\"},{name:`--jwt`,value:`\u003cstring>`,type:`string`,description:\"The JWT to log in with, for `--auth-method=oidc-auth` or `jwt-auth`. Can also be set with `INFISICAL_JWT`.\"},{name:`--ldap-password`,value:`\u003cstring>`,type:`string`,description:\"The LDAP password, for `--auth-method=ldap-auth`. Can also be set with `INFISICAL_LDAP_PASSWORD`.\"},{name:`--ldap-username`,value:`\u003cstring>`,type:`string`,description:\"The LDAP username, for `--auth-method=ldap-auth`. Can also be set with `INFISICAL_LDAP_USERNAME`.\"},{name:`--log-file`,value:`\u003cstring>`,type:`string`,description:`A file to write proxy logs to while the agent runs. Without it, proxy logs are discarded.`},{name:`--machine-identity-id`,value:`\u003cstring>`,type:`string`,description:\"The machine identity's ID, for every `--auth-method` except `universal-auth`. Can also be set with `INFISICAL_MACHINE_IDENTITY_ID`.\"},{name:`--no-approval-request`,type:`bool`,description:`Don't raise access requests for accounts that need approval, and leave those accounts out of the run. By default, the CLI raises a request the first time the agent connects to one, and the account works once a reviewer approves it.`},{name:`--no-sandbox`,type:`bool`,description:`Run the agent without the OS sandbox, so it can read your Infisical login and other credential files. Required on hosts with no sandbox, such as Windows.`},{name:`--organization-slug`,value:`\u003cstring>`,type:`string`,description:\"The slug of a sub-organization to scope the machine identity's session to. Without it, the session uses the organization the machine identity was created in. Can also be set with `INFISICAL_AUTH_ORGANIZATION_SLUG`.\"},{name:`--reason`,value:`\u003cstring>`,type:`string`,description:`Why the agent needs access, recorded for audit. The CLI can't prompt for a reason while the agent is running in the terminal, so accounts that require a reason need this flag.`},{name:`--service-account-key-file-path`,value:`\u003cstring>`,type:`string`,description:\"The path to a GCP service account key file, for `--auth-method=gcp-iam`. Can also be set with `INFISICAL_GCP_IAM_SERVICE_ACCOUNT_KEY_FILE_PATH`.\"},{name:`--service-account-token-path`,value:`\u003cstring>`,type:`string`,description:\"The path to the Kubernetes service account token, for `--auth-method=kubernetes`. Required with that method. Can also be set with `INFISICAL_KUBERNETES_SERVICE_ACCOUNT_TOKEN_PATH`.\"},{name:`--token`,value:`\u003cstring>`,type:`string`,description:\"A machine identity access token to run as. Service tokens aren't accepted. Without it, the CLI reads `INFISICAL_UNIVERSAL_AUTH_ACCESS_TOKEN`, then `INFISICAL_TOKEN`.\"}],examples:[{title:`Run Claude Code with every account you can launch`,code:`infisical pam agentic access -- claude`},{title:`Run Codex with two accounts`,code:`infisical pam agentic access --account=prod/orders-db,prod/bastion -- codex --model gpt-5`},{title:`Record a reason and keep proxy logs`,code:`infisical pam agentic access --reason=\"investigating INC-4021\" --log-file=/tmp/pam.log -- claude`},{title:`Run your own agent as a machine identity`,code:`export INFISICAL_UNIVERSAL_AUTH_CLIENT_ID=\u003cclient-id>\nexport INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET=\u003cclient-secret>\ninfisical pam agentic access --auth-method=universal-auth -- python triage_agent.py`}],children:[_jsxs(_components.p,{children:[`Start a local proxy for each PAM account you can launch, then start an AI agent with instructions for reaching them. Everything after `,_jsx(_components.code,{children:`--`}),` is the command that starts the agent. The `,_jsx(_components.code,{children:`--`}),` is required when that command has flags of its own.`]}),_jsxs(_components.p,{children:[`The CLI gives each account its own port on `,_jsx(_components.code,{children:`127.0.0.1`}),`, and the agent connects through those ports without ever holding a credential. The CLI skips accounts that require MFA and accounts of `,_jsx(_components.a,{href:`/documentation/platform/pam/ai-agents/run#supported-account-types`,children:`types agentic access doesn’t support`}),`, and lists each skipped account with the reason. To open a skipped account, use `,_jsx(_components.a,{href:`/cli/reference#pam-access`,children:`infisical pam access`}),`.`]}),_jsxs(_components.p,{children:[`The CLI `,_jsx(_components.a,{href:`/documentation/platform/pam/ai-agents/instructions`,children:`adds instructions for reaching the accounts`}),` to the agent’s system prompt or to a file such as `,_jsx(_components.code,{children:`AGENTS.md`}),`, depending on the agent. It runs the agent in an `,_jsx(_components.a,{href:`/documentation/platform/pam/ai-agents/run#sandbox`,children:`OS sandbox`}),`, which stops the agent from reading your Infisical login. On a host without a sandbox, the command fails unless you pass `,_jsx(_components.code,{children:`--no-sandbox`}),`.`]}),_jsxs(_components.p,{children:[`The run authenticates with `,_jsx(_components.code,{children:`--token`}),` when one is set, then as a machine identity when `,_jsx(_components.code,{children:`--auth-method`}),` is set, and otherwise as the user you logged in as with `,_jsx(_components.a,{href:`/cli/reference#login`,children:`infisical login`}),`.`]})]})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsxs(CLICommand,{id:`profile`,command:`profile`,children:[_jsx(_components.p,{children:`Manage login profiles. A profile is one login: an account on one instance, plus the organization it uses by default. Selecting a profile selects all three, so switching between organizations or instances never means logging in again.`}),_jsxs(_components.p,{children:[`Create your first profile with `,_jsx(_components.a,{href:`/cli/reference#login`,children:`infisical login`}),`, one per extra organization with `,_jsx(_components.a,{href:`/cli/reference#profile-create`,children:`infisical profile create`}),`, and one per extra account or instance with `,_jsx(_components.code,{children:`infisical login --save-as \u003cname>`}),`.`]}),_jsx(_components.p,{children:`A command uses the first of these that’s set:`}),_jsxs(_components.ol,{children:[`\n`,_jsxs(_components.li,{children:[_jsx(_components.code,{children:`--profile`}),` on the command`]}),`\n`,_jsxs(_components.li,{children:[`The `,_jsx(_components.code,{children:`INFISICAL_PROFILE`}),` environment variable, set by `,_jsx(_components.a,{href:`/cli/reference#profile-pin`,children:`infisical profile pin`})]}),`\n`,_jsxs(_components.li,{children:[`A directory bound with `,_jsx(_components.a,{href:`/cli/reference#profile-bind`,children:`infisical profile bind`})]}),`\n`,_jsxs(_components.li,{children:[`The machine’s default profile, set with `,_jsx(_components.a,{href:`/cli/reference#profile-use`,children:`infisical profile use`})]}),`\n`]})]})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsxs(CLICommand,{id:`profile-bind`,command:`profile bind`,usage:`[name] [path]`,args:[{name:`name`,usage:`[name]`,description:`The profile to bind. Defaults to the profile in effect.`},{name:`path`,usage:`[path]`,description:`The directory to bind. Defaults to the current directory.`}],examples:[{title:`Bind this directory to the profile in effect`,code:`infisical profile bind`},{title:`Bind this directory to another profile`,code:`infisical profile bind client-a`},{title:`Bind a different directory`,code:`infisical profile bind client-a ~/work/client-a`}],children:[_jsx(_components.p,{children:`Bind a directory, and everything under it, to a profile. Commands run inside that directory select the profile with no flag or environment variable, so moving between projects moves between organizations.`}),_jsxs(_components.p,{children:[`If several parent directories are bound, the closest one applies. Bindings are stored in your CLI configuration, never in the repository. Remove one with `,_jsx(_components.a,{href:`/cli/reference#profile-unbind`,children:`infisical profile unbind`}),`.`]})]})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsxs(CLICommand,{id:`profile-create`,command:`profile create`,usage:`\u003cname> [flags]`,args:[{name:`name`,usage:`\u003cname>`,required:true,description:`The name of the new profile.`}],flags:[{name:`--pin`,type:`bool`,description:\"Also pin this terminal to the new profile. Run the command through `eval` for the pin to take effect.\"},{name:`--use`,type:`bool`,description:`Also make the new profile the default for this machine.`}],examples:[{title:`Create a profile for another organization`,code:`infisical profile create client-b --org acme`},{title:`Create it and use it in this terminal`,code:`eval \"$(infisical profile create client-b --org acme --pin)\"`},{title:`Create it and make it the default`,code:`infisical profile create client-b --org acme --use`}],children:[_jsxs(_components.p,{children:[`Create a profile for another organization without logging in again. The new profile reuses the account and instance you’re signed in to, scoped to the organization you choose, so both organizations stay usable at the same time. Pass the organization with `,_jsx(_components.code,{children:`--org`}),`, or pick it when asked.`]}),_jsxs(_components.p,{children:[`Creating a profile doesn’t change which profile other terminals use. Pass `,_jsx(_components.code,{children:`--pin`}),` to start using it in this terminal, or `,_jsx(_components.code,{children:`--use`}),` to make it the default for the machine.`]}),_jsxs(_components.p,{children:[`To add a different account, or an account on another instance, use `,_jsx(_components.code,{children:`infisical login --save-as \u003cname>`}),` instead.`]})]})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsxs(CLICommand,{id:`profile-current`,command:`profile current`,usage:`[flags]`,flags:[{name:`--plain`,type:`bool`,description:`Print only the profile name, for use in shell prompts.`}],examples:[{title:`Show the profile in effect`,code:`infisical profile current`},{title:`Print only its name`,code:`infisical profile current --plain`}],children:[_jsxs(_components.p,{children:[`Show which profile the CLI uses in this terminal and directory, and why. The output also shows the `,_jsx(_components.a,{href:`/documentation/platform/agent-vault/projects`,children:`Agent Vault project`}),` that commands such as `,_jsx(_components.a,{href:`/cli/reference#agent-vault-run`,children:`infisical agent-vault run`}),` use in this directory, and where the CLI read it from.`]}),_jsxs(_components.p,{children:[`The command also shows the project, environment, and folder that `,_jsx(_components.code,{children:`secrets-manager`}),` commands use in this directory when you don’t pass `,_jsx(_components.code,{children:`--projectId`}),`, `,_jsx(_components.code,{children:`--env`}),`, or `,_jsx(_components.code,{children:`--path`}),`, and where each value comes from, such as `,_jsx(_components.code,{children:`INFISICAL_ENVIRONMENT`}),` or `,_jsx(_components.code,{children:`.infisical.yaml`}),`. Run it before you write secrets, to check where they’ll go.`]}),_jsxs(_components.p,{children:[`If you authenticate as a `,_jsx(_components.a,{href:`/documentation/platform/identities/machine-identities`,children:`machine identity`}),`, `,_jsx(_components.code,{children:`run`}),`, `,_jsx(_components.code,{children:`secrets export`}),`, and `,_jsx(_components.code,{children:`secrets get`}),` don’t read the project from the `,_jsx(_components.a,{href:`/cli/project-config`,children:`project config file`}),`, so pass `,_jsx(_components.code,{children:`--projectId`}),` or set `,_jsx(_components.code,{children:`INFISICAL_PROJECT_ID`}),`.`]})]})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsx(CLICommand,{id:`profile-delete`,command:`profile delete`,usage:`\u003cname> [flags]`,args:[{name:`name`,usage:`\u003cname>`,required:true,description:`The profile to delete.`}],flags:[{name:`--local-only`,type:`bool`,description:`Remove the profile without revoking its session on the server. The session stays valid until it expires.`}],examples:[{title:`Delete a profile`,code:`infisical profile delete old-client`}],children:_jsx(_components.p,{children:`Delete a profile and its stored credentials. The CLI also revokes the profile’s session on the server, unless another profile still uses that session.`})})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsx(CLICommand,{id:`profile-list`,command:`profile list`,examples:[{title:`List your profiles`,code:`infisical profile list`}],children:_jsx(_components.p,{children:`List every login profile on this machine.`})})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsxs(CLICommand,{id:`profile-pin`,command:`profile pin`,usage:`\u003cname>`,args:[{name:`name`,usage:`\u003cname>`,required:true,description:`The profile to pin this terminal to.`}],examples:[{title:`Pin this terminal to a profile`,code:`eval \"$(infisical profile pin acme)\"`}],children:[_jsxs(_components.p,{children:[`Pin the current terminal to a profile. Only this terminal changes: the default profile and every other terminal keep what they were using, so you can work in several organizations at once. Undo it with `,_jsx(_components.a,{href:`/cli/reference#profile-unpin`,children:`infisical profile unpin`}),`.`]}),_jsxs(_components.p,{children:[`The command prints an `,_jsx(_components.code,{children:`export`}),` statement for POSIX shells such as Bash and Zsh, so run it through `,_jsx(_components.code,{children:`eval`}),`. If you run it without `,_jsx(_components.code,{children:`eval`}),`, it prints the `,_jsx(_components.code,{children:`eval`}),` form and changes nothing. In PowerShell, set the variable directly with `,_jsx(_components.code,{children:`$env:INFISICAL_PROFILE = 'acme'`}),`. In scripts and CI, set `,_jsx(_components.code,{children:`INFISICAL_PROFILE`}),` or pass `,_jsx(_components.code,{children:`--profile`}),` instead.`]})]})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsx(CLICommand,{id:`profile-rename`,command:`profile rename`,usage:`\u003cname> \u003cnew-name>`,args:[{name:`name`,usage:`\u003cname>`,required:true,description:`The profile's current name.`},{name:`new-name`,usage:`\u003cnew-name>`,required:true,description:`The name to give it.`}],examples:[{title:`Rename a profile`,code:`infisical profile rename [email protected] acme`}],children:_jsxs(_components.p,{children:[`Rename a profile. Its stored session, the default-profile setting, and directory bindings all follow the new name. Terminals pinned to the old name with `,_jsx(_components.a,{href:`/cli/reference#profile-pin`,children:`infisical profile pin`}),` keep pointing at it and need pinning again.`]})})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsxs(CLICommand,{id:`profile-set-org`,command:`profile set-org`,usage:`[organization] [flags]`,args:[{name:`organization`,usage:`[organization]`,description:`The organization to use, by name, slug, or ID. Without it, the CLI asks you to pick one.`}],flags:[{name:`--org-id`,value:`\u003cstring>`,type:`string`,deprecated:true,description:`Deprecated: pass the organization as an argument instead. The ID of the organization to use.`}],examples:[{title:`Pick an organization from a list`,code:`infisical profile set-org`},{title:`Set the organization by name`,code:`infisical profile set-org acme`}],children:[_jsxs(_components.p,{children:[`Change the current profile’s organization. This is the same command as `,_jsx(_components.a,{href:`/cli/reference#org-switch`,children:`infisical org switch`}),`.`]}),_jsxs(_components.p,{children:[`To use a different organization for a single command, pass `,_jsx(_components.code,{children:`--org`}),` to that command instead. To keep a second organization available at the same time, give it its own profile with `,_jsx(_components.a,{href:`/cli/reference#profile-create`,children:`infisical profile create`}),`.`]})]})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsx(CLICommand,{id:`profile-unbind`,command:`profile unbind`,usage:`[path]`,args:[{name:`path`,usage:`[path]`,description:`The bound directory. Defaults to whichever binding covers the current directory, so running the command inside a bound tree removes that binding.`}],examples:[{title:`Remove the binding that covers this directory`,code:`infisical profile unbind`},{title:`Remove a specific directory's binding`,code:`infisical profile unbind ~/work/client-a`}],children:_jsx(_components.p,{children:`Remove a directory’s profile binding.`})})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsxs(CLICommand,{id:`profile-unpin`,command:`profile unpin`,examples:[{title:`Unpin this terminal`,code:`eval \"$(infisical profile unpin)\"`}],children:[_jsx(_components.p,{children:`Remove the current terminal’s profile pin, so it falls back to a bound directory or the default profile.`}),_jsxs(_components.p,{children:[`The command prints an `,_jsx(_components.code,{children:`unset`}),` statement, so run it through `,_jsx(_components.code,{children:`eval`}),`. If you run it without `,_jsx(_components.code,{children:`eval`}),`, it prints the `,_jsx(_components.code,{children:`eval`}),` form and changes nothing. In PowerShell, run `,_jsx(_components.code,{children:`Remove-Item Env:INFISICAL_PROFILE`}),` instead.`]})]})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsx(CLICommand,{id:`profile-use`,command:`profile use`,usage:`\u003cname>`,args:[{name:`name`,usage:`\u003cname>`,required:true,description:`The profile to make the default.`}],examples:[{title:`Make a profile the default`,code:`infisical profile use work-eu`}],children:_jsxs(_components.p,{children:[`Make a profile the default for this machine. Commands use the default when nothing more specific applies. To choose a profile for one terminal, use `,_jsx(_components.a,{href:`/cli/reference#profile-pin`,children:`infisical profile pin`}),`, and for one directory, use `,_jsx(_components.a,{href:`/cli/reference#profile-bind`,children:`infisical profile bind`}),`.`]})})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsx(CLICommand,{id:`proxy`,command:`proxy`,children:_jsxs(_components.p,{children:[`Run the `,_jsx(_components.a,{href:`/integrations/platforms/infisical-proxy`,children:`Infisical Proxy`}),`, which sits between your applications and Infisical and caches secret responses, so applications keep getting secrets when Infisical is unreachable.`]})})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsx(CLICommand,{id:`proxy-start`,command:`proxy start`,usage:`[flags]`,flags:[{name:`--access-token-check-interval`,value:`\u003cstring>`,type:`string`,default:`5m`,description:\"How often to check that cached access tokens are still valid, such as `5m` or `1h`.\"},{name:`--client-id`,value:`\u003cstring>`,type:`string`,description:\"A universal auth machine identity's client ID. Required with `--enable-event-subscriptions`. Can also be set with `INFISICAL_UNIVERSAL_AUTH_CLIENT_ID`.\"},{name:`--client-secret`,value:`\u003cstring>`,type:`string`,description:\"The machine identity's client secret. Required with `--enable-event-subscriptions`. Can also be set with `INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET`.\"},{name:`--domain`,value:`\u003cstring>`,type:`string`,description:\"The Infisical instance to forward requests to, such as `https://app.infisical.com`.\"},{name:`--enable-event-subscriptions`,type:`bool`,description:\"Invalidate cached secrets in real time from Infisical events instead of refreshing them on a timer. Falls back to polling when events are unavailable. Requires `--client-id` and `--client-secret`.\"},{name:`--eviction-strategy`,value:`\u003cstring>`,type:`string`,default:`optimistic`,description:\"How to handle the cache when Infisical is unreachable. `optimistic`, the only strategy, keeps serving cached data.\"},{name:`--listen-address`,value:`\u003cstring>`,type:`string`,default:`localhost:8081`,description:`The address to listen on.`},{name:`--polling-fallback-interval`,value:`\u003cstring>`,type:`string`,default:`10m`,description:\"How often to poll for secret changes when event subscriptions are unavailable, such as `1m`. Used only with `--enable-event-subscriptions`.\"},{name:`--static-secrets-refresh-interval`,value:`\u003cstring>`,type:`string`,default:`1h`,description:\"How often to refresh cached secrets, such as `30m` or `1h`. Not used with `--enable-event-subscriptions`.\"},{name:`--tls-cert-file`,value:`\u003cstring>`,type:`string`,description:\"The proxy's TLS certificate file. Required while `--tls-enabled` is on.\"},{name:`--tls-enabled`,type:`bool`,default:`true`,description:\"Serve the proxy over TLS. Pass `--tls-enabled=false` to serve plain HTTP.\"},{name:`--tls-key-file`,value:`\u003cstring>`,type:`string`,description:\"The proxy's TLS private key file. Required while `--tls-enabled` is on.\"}],examples:[{title:`Start the proxy with TLS`,code:`infisical proxy start --domain=https://app.infisical.com --tls-cert-file=./proxy.crt --tls-key-file=./proxy.key`},{title:`Start the proxy locally without TLS`,code:`infisical proxy start --domain=https://app.infisical.com --tls-enabled=false`}],children:_jsxs(_components.p,{children:[`Start the Infisical Proxy. Point your applications at its `,_jsx(_components.code,{children:`--listen-address`}),` instead of your Infisical instance. They call the same API endpoints with the same credentials, and the proxy forwards requests, caches the responses, and refreshes the cache.`]})})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsx(CLICommand,{id:`relay`,command:`relay`,children:_jsxs(_components.p,{children:[`Run an Infisical `,_jsx(_components.a,{href:`/documentation/platform/gateways/relay-deployment`,children:`relay`}),`, which carries traffic between Infisical and your gateways, so gateways need only outbound connections. Run it in the foreground with `,_jsx(_components.a,{href:`/cli/reference#relay-start`,children:`infisical relay start`}),`, or as a systemd service with `,_jsx(_components.a,{href:`/cli/reference#relay-systemd-install`,children:`infisical relay systemd install`}),`.`]})})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsx(CLICommand,{id:`relay-start`,command:`relay start`,usage:`[flags]`,flags:[{name:`--auth-method`,value:`\u003cstring>`,type:`string`,description:\"Log in as a machine identity with this method instead of enrolling: `universal-auth`, `kubernetes`, `azure`, `gcp-id-token`, `gcp-iam`, `aws-iam`, or `oidc-auth`. Can also be set with `INFISICAL_AUTH_METHOD`.\"},{name:`--client-id`,value:`\u003cstring>`,type:`string`,description:\"The machine identity's client ID, for `--auth-method=universal-auth`. Can also be set with `INFISICAL_UNIVERSAL_AUTH_CLIENT_ID`.\"},{name:`--client-secret`,value:`\u003cstring>`,type:`string`,description:\"The machine identity's client secret, for `--auth-method=universal-auth`. Can also be set with `INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET`.\"},{name:`--domain`,value:`\u003cstring>`,type:`string`,description:`The Infisical instance to connect to. Without it, the relay uses the domain it saved when it enrolled, then your active profile's domain.`},{name:`--enroll-method`,value:`\u003cstring>`,type:`string`,description:\"How the relay authenticates on its own: `token` for a one-time enrollment token, or `aws`. Can also be set with `INFISICAL_RELAY_ENROLL_METHOD`.\"},{name:`--host`,value:`\u003cstring>`,type:`string`,description:\"The IP address or hostname gateways use to reach the relay. Required unless you use `--enroll-method`. Can also be set with `INFISICAL_RELAY_HOST`.\"},{name:`--jwt`,value:`\u003cstring>`,type:`string`,description:\"The JWT to exchange for an access token, for `--auth-method=oidc-auth`.\"},{name:`--machine-identity-id`,value:`\u003cstring>`,type:`string`,description:\"The machine identity's ID, for every `--auth-method` except `universal-auth`.\"},{name:`--name`,value:`\u003cstring>`,type:`string`,description:\"The relay's name. Can also be set with `INFISICAL_RELAY_NAME`.\"},{name:`--relay-id`,value:`\u003cstring>`,type:`string`,description:\"The relay's ID from Infisical. Required with `--enroll-method=aws`, unless the relay saved it on an earlier start. Can also be set with `INFISICAL_RELAY_ID`.\"},{name:`--service-account-key-file-path`,value:`\u003cstring>`,type:`string`,description:\"The path to a GCP service account key file, for `--auth-method=gcp-iam`.\"},{name:`--service-account-token-path`,value:`\u003cstring>`,type:`string`,description:\"The path to the Kubernetes service account token, for `--auth-method=kubernetes`.\"},{name:`--token`,value:`\u003cstring>`,type:`string`,description:\"With `--enroll-method=token`, the one-time enrollment token. Otherwise, a machine identity access token to connect with.\"},{name:`--type`,value:`\u003cstring>`,type:`string`,description:\"`org` for a relay that belongs to your organization, or `instance` for a relay that serves the whole Infisical instance, run by the instance's admins. Defaults to `org`. Can also be set with `INFISICAL_RELAY_TYPE`.\"}],examples:[{title:`Enroll and start a relay`,code:`infisical relay start --name=my-relay --enroll-method=token --token=\u003cenrollment-token>`},{title:`Start a relay on AWS`,code:`infisical relay start --name=my-relay --enroll-method=aws --relay-id=\u003crelay-id>`},{title:`Start an instance relay`,code:`INFISICAL_RELAY_AUTH_SECRET=\u003csecret> infisical relay start --type=instance --host=relay.example.com --name=my-relay`}],children:_jsxs(_components.p,{children:[`Start a relay in the foreground. An organization relay authenticates by enrolling with `,_jsx(_components.code,{children:`--enroll-method`}),`, or as a machine identity with the same flags as `,_jsx(_components.a,{href:`/cli/reference#login`,children:`infisical login`}),`. An instance relay authenticates with the secret in `,_jsx(_components.code,{children:`INFISICAL_RELAY_AUTH_SECRET`}),`.`]})})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsx(CLICommand,{id:`relay-systemd`,command:`relay systemd`,children:_jsx(_components.p,{children:`Install or remove a systemd service that runs a relay. Both commands run only on Linux, as root.`})})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsx(CLICommand,{id:`relay-systemd-install`,command:`relay systemd install`,usage:`[name] [flags]`,args:[{name:`name`,usage:`[name]`,description:\"The relay's name. Required with `--enroll-method=token`.\"}],flags:[{name:`--domain`,value:`\u003cstring>`,type:`string`,description:`The Infisical instance to connect to.`},{name:`--enroll-method`,value:`\u003cstring>`,type:`string`,description:\"How the relay authenticates: `token` for a one-time enrollment token, or `aws`.\"},{name:`--host`,value:`\u003cstring>`,type:`string`,description:\"The IP address or hostname gateways use to reach the relay. Required with `--type=instance`.\"},{name:`--log-file`,value:`\u003cstring>`,type:`string`,description:\"A file to write the service's logs to, such as `/var/log/infisical/relay.log`.\"},{name:`--relay-auth-secret`,value:`\u003cstring>`,type:`string`,description:\"The secret an instance relay authenticates with. Required with `--type=instance`.\"},{name:`--relay-id`,value:`\u003cstring>`,type:`string`,description:\"The relay's ID from Infisical. Required with `--enroll-method=aws`.\"},{name:`--token`,value:`\u003cstring>`,type:`string`,description:\"The one-time enrollment token, for `--enroll-method=token`.\"},{name:`--type`,value:`\u003cstring>`,type:`string`,default:`org`,description:\"`org` for a relay that belongs to your organization, or `instance` for a relay that serves the whole Infisical instance, run by the instance's admins.\"}],examples:[{title:`Install an organization relay`,code:`sudo infisical relay systemd install my-relay --enroll-method=token --token=\u003cenrollment-token> --domain=https://app.infisical.com`},{title:`Install a relay on AWS`,code:`sudo infisical relay systemd install my-relay --enroll-method=aws --relay-id=\u003crelay-id> --domain=https://app.infisical.com`},{title:`Install an instance relay`,code:`sudo infisical relay systemd install my-relay --type=instance --host=relay.example.com --relay-auth-secret=\u003csecret>`}],children:_jsx(_components.p,{children:`Install and enable a systemd service that runs the relay. Run the command as root on Linux.`})})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsx(CLICommand,{id:`relay-systemd-uninstall`,command:`relay systemd uninstall`,usage:`[name]`,args:[{name:`name`,usage:`[name]`,description:`The relay whose service to remove. Without it, the command removes the single relay service that older CLI versions installed.`}],examples:[{title:`Remove a relay service`,code:`sudo infisical relay systemd uninstall my-relay`}],children:_jsx(_components.p,{children:`Stop and remove a relay’s systemd service. Run the command as root on Linux.`})})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsxs(CLICommand,{id:`reset`,command:`reset`,usage:`[flags]`,flags:[{name:`--local-only`,type:`bool`,description:`Delete local data without revoking the sessions on the server. The sessions stay valid until they expire.`}],examples:[{title:`Reset the CLI`,code:`infisical reset`},{title:`Reset without contacting the server`,code:`infisical reset --local-only`}],children:[_jsx(_components.p,{children:`Delete all the data the CLI stores on your machine and return it to its default state. Use it when a problem persists and you want a clean start.`}),_jsxs(_components.p,{children:[`The command revokes the session of every profile on the server, then deletes every profile’s credentials from your system keyring and deletes the `,_jsx(_components.code,{children:`~/.infisical`}),` directory. That directory also holds cached secrets and the credentials that gateways, relays, and KMIP servers saved when you ran them as a non-root user, so those are deleted too. A session that can’t be revoked stays valid until it expires, and the command prints a warning for it. `,_jsx(_components.code,{children:`.infisical.yaml`}),` and `,_jsx(_components.code,{children:`.infisical.json`}),` files in your projects aren’t touched.`]}),_jsxs(_components.p,{children:[`Log in again with `,_jsx(_components.a,{href:`/cli/reference#login`,children:`infisical login`}),` afterwards. Directory bindings are deleted with the rest of the configuration, and terminals pinned with `,_jsx(_components.a,{href:`/cli/reference#profile-pin`,children:`infisical profile pin`}),` point to a profile that no longer exists.`]})]})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsxs(CLICommand,{id:`scan`,command:`scan`,usage:`[flags]`,flags:[{name:`--baseline-path`,short:`-b`,value:`\u003cstring>`,type:`string`,description:\"A JSON report from an earlier `infisical scan` run. Findings already in it aren't reported again. If the file can't be loaded, the scan logs an error and continues without it.\"},{name:`--confidence`,value:`\u003cstring>`,type:`string`,default:`medium`,description:\"The lowest confidence a finding needs to be reported: `low`, `medium`, or `high`. Findings from rules that don't set a confidence are always reported.\"},{name:`--config`,short:`-c`,value:`\u003cstring>`,type:`string`,description:\"The scan config file to use. Without it, the CLI uses `.infisical-scan.toml` in the `--source` directory, then the built-in rules. Can also be set with `INFISICAL_SCAN_CONFIG`.\"},{name:`--exit-code`,value:`\u003cint>`,type:`int`,default:`1`,description:\"The exit code to use when the scan finds leaks. Pass `0` to exit successfully anyway.\"},{name:`--follow-symlinks`,type:`bool`,description:\"Scan the files that symbolic links point to. Applies only with `--no-git`.\"},{name:`--log-opts`,value:`\u003cstring>`,type:`string`,description:\"Options to pass to `git log -p` to choose the commits to scan, such as `--all commitA..commitB`. They replace the default `--full-history --all`. Has no effect with `--no-git` or `--pipe`.\"},{name:`--max-target-megabytes`,value:`\u003cint>`,type:`int`,default:`0`,description:\"Skip files larger than this many megabytes. `0` means no limit. Applies only with `--no-git`.\"},{name:`--no-color`,type:`bool`,description:`Turn off color in verbose output.`},{name:`--no-git`,type:`bool`,description:\"Scan the files in `--source` as a plain directory instead of reading Git history.\"},{name:`--pipe`,type:`bool`,description:\"Scan standard input instead of `--source`, as in `cat app.log | infisical scan --pipe`. Has no effect with `--no-git`.\"},{name:`--platform`,value:`\u003cstring>`,type:`string`,description:\"The source code platform to link findings to: `github`, `gitlab`, `azuredevops`, `bitbucket`, or `gitea`, or `none` for no links. Without it, the CLI detects the platform from the repository's remote URL. Applies only to Git history scans.\"},{name:`--redact`,type:`bool`,description:\"Replace secrets with `REDACTED` in verbose output. Reports written with `--report-path` still contain the secrets.\"},{name:`--report-format`,short:`-f`,value:`\u003cstring>`,type:`string`,default:`json`,description:\"The report's format: `json`, `csv`, `sarif`, or `junit`.\"},{name:`--report-path`,short:`-r`,value:`\u003cstring>`,type:`string`,description:`The file to write a report of the findings to. Without it, no report is written.`},{name:`--source`,short:`-s`,value:`\u003cstring>`,type:`string`,default:`.`,description:`The repository, directory, or file to scan.`},{name:`--verbose`,short:`-v`,type:`bool`,description:`Print each finding: the file, where in the file, and the secret.`}],examples:[{title:`Scan a repository's history`,code:`infisical scan --verbose`},{title:`Scan a range of commits`,code:`infisical scan --log-opts=\"--all commitA..commitB\"`},{title:`Scan a directory without Git`,code:`infisical scan --no-git --source=./config`},{title:`Write a report, ignoring known findings`,code:`infisical scan --baseline-path=baseline.json --report-path=findings.json`}],children:[_jsx(_components.p,{children:`Scan a Git repository’s history, a directory, or standard input for leaked secrets. The scan runs locally and doesn’t need an Infisical login.`}),_jsxs(_components.p,{children:[`By default, the CLI reads `,_jsx(_components.code,{children:`git log -p`}),` for every commit on every branch of the repository at `,_jsx(_components.code,{children:`--source`}),`. Pass `,_jsx(_components.code,{children:`--log-opts`}),` to choose the commits, `,_jsx(_components.code,{children:`--no-git`}),` to scan the files in their current state, or `,_jsx(_components.code,{children:`--pipe`}),` to scan standard input.`]}),_jsxs(_components.p,{children:[`To change the rules or skip known findings, see `,_jsx(_components.a,{href:`/documentation/platform/secret-scanning/scan-locally`,children:`Scan code locally with the CLI`}),`.`]}),_jsxs(_components.p,{children:[`The command exits with `,_jsx(_components.code,{children:`--exit-code`}),` when it finds leaks, and with `,_jsx(_components.code,{children:`1`}),` when the scan fails.`]})]})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsxs(CLICommand,{id:`scan-git-changes`,command:`scan git-changes`,usage:`[flags]`,flags:[{name:`--confidence`,value:`\u003cstring>`,type:`string`,default:`medium`,description:\"The lowest confidence a finding needs to be reported: `low`, `medium`, or `high`. Findings from rules that don't set a confidence are always reported.\"},{name:`--staged`,type:`bool`,description:\"Scan the changes staged with `git add` instead of the unstaged changes.\"}],inheritedFlags:[{name:`--config`,short:`-c`,value:`\u003cstring>`,type:`string`,description:\"The scan config file to use. Without it, the CLI uses `.infisical-scan.toml` in the `--source` directory, then the built-in rules. Can also be set with `INFISICAL_SCAN_CONFIG`.\"},{name:`--exit-code`,value:`\u003cint>`,type:`int`,default:`1`,description:\"The exit code to use when the scan finds leaks. Pass `0` to exit successfully anyway.\"},{name:`--no-color`,type:`bool`,description:`Turn off color in verbose output.`},{name:`--redact`,type:`bool`,description:\"Replace secrets with `REDACTED` in verbose output. Reports written with `--report-path` still contain the secrets.\"},{name:`--report-format`,short:`-f`,value:`\u003cstring>`,type:`string`,default:`json`,description:\"The report's format: `json`, `csv`, `sarif`, or `junit`.\"},{name:`--report-path`,short:`-r`,value:`\u003cstring>`,type:`string`,description:`The file to write a report of the findings to. Without it, no report is written.`},{name:`--source`,short:`-s`,value:`\u003cstring>`,type:`string`,default:`.`,description:`The Git repository to scan.`},{name:`--verbose`,short:`-v`,type:`bool`,description:`Print each finding: the file, where in the file, and the secret.`}],examples:[{title:`Scan unstaged changes`,code:`infisical scan git-changes --verbose`},{title:`Scan staged changes before a commit`,code:`infisical scan git-changes --staged --verbose`}],children:[_jsxs(_components.p,{children:[`Scan the uncommitted changes in a Git repository for leaked secrets, by reading `,_jsx(_components.code,{children:`git diff`}),`. Without `,_jsx(_components.code,{children:`--staged`}),`, the scan covers changes you haven’t staged yet. With it, the scan covers what the next commit will contain, which makes it suited to a pre-commit hook. `,_jsx(_components.a,{href:`/cli/reference#scan-install`,children:`infisical scan install`}),` sets one up.`]}),_jsxs(_components.p,{children:[`The scan uses the same config and `,_jsx(_components.code,{children:`.infisicalignore`}),` file as `,_jsx(_components.a,{href:`/cli/reference#scan`,children:`infisical scan`}),`, and exits with `,_jsx(_components.code,{children:`--exit-code`}),` when it finds leaks.`]})]})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsxs(CLICommand,{id:`scan-install`,command:`scan install`,usage:`[flags]`,flags:[{name:`--pre-commit-hook`,type:`bool`,description:`Install a Git pre-commit hook that scans staged changes before each commit.`}],examples:[{title:`Install the pre-commit hook`,code:`infisical scan install --pre-commit-hook`}],children:[_jsxs(_components.p,{children:[`Install a Git pre-commit hook in the current repository with `,_jsx(_components.code,{children:`--pre-commit-hook`}),`. Without that flag, the command does nothing.`]}),_jsxs(_components.p,{children:[`The hook runs `,_jsx(_components.code,{children:`infisical scan git-changes -v --staged`}),` before each commit and blocks the commit when it finds secrets. The CLI writes it to `,_jsx(_components.code,{children:`.git/hooks/pre-commit`}),`, or adds it to the end of that file if one exists. To turn the hook off in a repository, run `,_jsx(_components.code,{children:`git config hooks.infisical-scan false`}),`.`]})]})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsxs(CLICommand,{id:`secrets-manager`,command:`secrets-manager`,children:[_jsxs(_components.p,{children:[`Manage secrets, and the projects, environments, and folders that hold them. The `,_jsx(_components.code,{children:`secrets-manager`}),` commands inject secrets into a process, export them to a file, read and write them, and lease credentials from `,_jsx(_components.a,{href:`/documentation/platform/dynamic-secrets/overview`,children:`dynamic secrets`}),`. `,_jsx(_components.code,{children:`sm`}),` is an alias, so `,_jsx(_components.code,{children:`infisical sm run`}),` is the same command as `,_jsx(_components.code,{children:`infisical secrets-manager run`}),`.`]}),_jsx(`br`,{}),_jsx(_components.h3,{children:`Confirm before deleting`}),_jsxs(_components.p,{children:[`Every delete asks you to type the name of what it deletes, or the number of secrets if you delete more than one, and deletes nothing if what you type doesn’t match. Pass `,_jsx(_components.code,{children:`--yes`}),` (`,_jsx(_components.code,{children:`-y`}),`) to skip the question.`]}),_jsxs(_components.p,{children:[`If there’s no terminal to ask in, such as in CI, and you don’t pass `,_jsx(_components.code,{children:`--yes`}),`, the command deletes nothing and fails with `,_jsx(_components.code,{children:`confirmation_required`}),`. Add `,_jsx(_components.code,{children:`--yes`}),` to scripts that delete with `,_jsx(_components.code,{children:`secrets-manager`}),` or `,_jsx(_components.code,{children:`sm`}),`.`]}),_jsx(`br`,{}),_jsx(_components.h3,{children:`Errors in scripts`}),_jsxs(_components.p,{children:[`If one of the following fails, it prints what went wrong and the command to run next, and exits with status `,_jsx(_components.code,{children:`1`}),`:`]}),_jsxs(_components.ul,{children:[`\n`,_jsxs(_components.li,{children:[`The `,_jsx(_components.code,{children:`projects`}),`, `,_jsx(_components.code,{children:`environments`}),`, and `,_jsx(_components.code,{children:`folders`}),` commands`]}),`\n`,_jsxs(_components.li,{children:[_jsx(_components.code,{children:`secrets create`}),` and `,_jsx(_components.code,{children:`secrets update`})]}),`\n`]}),_jsxs(_components.p,{children:[`With `,_jsx(_components.code,{children:`--output=json`}),` or `,_jsx(_components.code,{children:`--output=yaml`}),`, the command prints the error to standard error in that format instead:`]}),_jsx(CodeBlock,{filename:``,numberOfLines:`1`,language:`json`,children:_jsx(_components.pre,{className:`shiki shiki-themes dark-plus dark-plus`,style:{backgroundColor:`#0B0C0E`,\"--shiki-dark-bg\":`#0B0C0E`,color:`#D4D4D4`,\"--shiki-dark\":`#D4D4D4`},language:`json`,children:_jsxs(_components.code,{language:`json`,numberOfLines:`1`,children:[_jsxs(_components.span,{className:`line`,children:[_jsx(_components.span,{style:{color:`#D4D4D4`,\"--shiki-dark\":`#D4D4D4`},children:`{`}),_jsx(_components.span,{style:{color:`#9CDCFE`,\"--shiki-dark\":`#9CDCFE`},children:`\"error\"`}),_jsx(_components.span,{style:{color:`#D4D4D4`,\"--shiki-dark\":`#D4D4D4`},children:`: {`}),_jsx(_components.span,{style:{color:`#9CDCFE`,\"--shiki-dark\":`#9CDCFE`},children:`\"code\"`}),_jsx(_components.span,{style:{color:`#D4D4D4`,\"--shiki-dark\":`#D4D4D4`},children:`: `}),_jsx(_components.span,{style:{color:`#CE9178`,\"--shiki-dark\":`#CE9178`},children:`\"environment_not_found\"`}),_jsx(_components.span,{style:{color:`#D4D4D4`,\"--shiki-dark\":`#D4D4D4`},children:`, `}),_jsx(_components.span,{style:{color:`#9CDCFE`,\"--shiki-dark\":`#9CDCFE`},children:`\"message\"`}),_jsx(_components.span,{style:{color:`#D4D4D4`,\"--shiki-dark\":`#D4D4D4`},children:`: `}),_jsx(_components.span,{style:{color:`#CE9178`,\"--shiki-dark\":`#CE9178`},children:`\"Environment `}),_jsx(_components.span,{style:{color:`#D7BA7D`,\"--shiki-dark\":`#D7BA7D`},children:`\\\\\"`}),_jsx(_components.span,{style:{color:`#CE9178`,\"--shiki-dark\":`#CE9178`},children:`stagng`}),_jsx(_components.span,{style:{color:`#D7BA7D`,\"--shiki-dark\":`#D7BA7D`},children:`\\\\\"`}),_jsx(_components.span,{style:{color:`#CE9178`,\"--shiki-dark\":`#CE9178`},children:` doesn't exist in project payments-api.\"`}),_jsx(_components.span,{style:{color:`#D4D4D4`,\"--shiki-dark\":`#D4D4D4`},children:`, `}),_jsx(_components.span,{style:{color:`#9CDCFE`,\"--shiki-dark\":`#9CDCFE`},children:`\"next\"`}),_jsx(_components.span,{style:{color:`#D4D4D4`,\"--shiki-dark\":`#D4D4D4`},children:`: [`}),_jsx(_components.span,{style:{color:`#CE9178`,\"--shiki-dark\":`#CE9178`},children:`\"infisical secrets-manager environments get --projectId \u003cproject-id>\"`}),_jsx(_components.span,{style:{color:`#D4D4D4`,\"--shiki-dark\":`#D4D4D4`},children:`]}}`})]}),`\n`]})})}),_jsxs(_components.p,{children:[`If Infisical returned the error, the JSON also has `,_jsx(_components.code,{children:`statusCode`}),` and `,_jsx(_components.code,{children:`requestId`}),`. `,_jsx(_components.code,{children:`code`}),` is one of the following:`]}),_jsxs(Table,{children:[_jsx(_components.thead,{children:_jsxs(_components.tr,{children:[_jsx(_components.th,{children:`Code`}),_jsx(_components.th,{children:`Meaning`})]})}),_jsxs(_components.tbody,{children:[_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`auth_required`})}),_jsx(_components.td,{children:`You aren’t logged in, or the token is invalid or expired`})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`permission_denied`})}),_jsx(_components.td,{children:`Your role doesn’t allow the action`})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`project_not_linked`})}),_jsxs(_components.td,{children:[`No `,_jsx(_components.code,{children:`--projectId`}),`, no `,_jsx(_components.code,{children:`INFISICAL_PROJECT_ID`}),`, and no `,_jsx(_components.code,{children:`.infisical.yaml`})]})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`project_config_invalid`})}),_jsxs(_components.td,{children:[`The directory’s `,_jsx(_components.code,{children:`.infisical.yaml`}),` exists but can’t be read`]})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`project_not_found`})}),_jsx(_components.td,{children:`The project doesn’t exist, or you aren’t a member of it`})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`project_type_not_supported`})}),_jsx(_components.td,{children:`The project belongs to another product, such as Certificate Management`})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`project_required`})}),_jsxs(_components.td,{children:[`An `,_jsx(_components.code,{children:`environments`}),` or `,_jsx(_components.code,{children:`folders`}),` delete ran without `,_jsx(_components.code,{children:`--projectId`})]})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`project_delete_protected`})}),_jsx(_components.td,{children:`The project has delete protection on, so nothing was deleted`})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`environment_not_found`})}),_jsx(_components.td,{children:`No environment in the project has that slug`})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`environment_exists`})}),_jsx(_components.td,{children:`Another environment already has that slug`})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`environment_pending_deletion`})}),_jsx(_components.td,{children:`The slug belongs to an environment that’s pending deletion`})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`folder_not_found`})}),_jsxs(_components.td,{children:[`No folder in `,_jsx(_components.code,{children:`--path`}),` has that name`]})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`folder_exists`})}),_jsxs(_components.td,{children:[`Another folder in `,_jsx(_components.code,{children:`--path`}),` already has that name`]})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`secret_exists`})}),_jsxs(_components.td,{children:[`A secret passed to `,_jsx(_components.code,{children:`secrets create`}),` already exists, so nothing was written`]})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`secret_not_found`})}),_jsxs(_components.td,{children:[`A secret passed to `,_jsx(_components.code,{children:`secrets update`}),` doesn’t exist, so nothing was written`]})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`invalid_argument`})}),_jsxs(_components.td,{children:[`The command can’t use an argument, such as the same secret name given twice, a secret with no value, or a folder name with a `,_jsx(_components.code,{children:`/`})]})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`invalid_flag_value`})}),_jsxs(_components.td,{children:[`A flag is missing or has a value the command can’t use, such as an empty `,_jsx(_components.code,{children:`--name`}),` or a `,_jsx(_components.code,{children:`--file`}),` that doesn’t exist or isn’t a valid `,_jsx(_components.code,{children:`.env`}),` or YAML file`]})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`nothing_to_update`})}),_jsxs(_components.td,{children:[`An `,_jsx(_components.code,{children:`update`}),` command got no flag that changes anything`]})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`service_token_not_supported`})}),_jsx(_components.td,{children:`The command doesn’t accept service tokens`})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`token_project_mismatch`})}),_jsx(_components.td,{children:`The service token belongs to a different project than the one you selected`})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`confirmation_required`})}),_jsxs(_components.td,{children:[`A delete ran without a terminal and without `,_jsx(_components.code,{children:`--yes`})]})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`confirmation_declined`})}),_jsx(_components.td,{children:`What you typed didn’t match what the question asked for, you cancelled the question, or the project, environment, or folder changed before you answered`})]})]})]})]})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsx(CLICommand,{id:`secrets-manager-dynamic-secrets`,command:`secrets-manager dynamic-secrets`,usage:`[flags]`,flags:[{name:`--env`,value:`\u003cstring>`,type:`string`,default:`dev`,description:\"The environment to work in. Every `infisical secrets-manager dynamic-secrets` subcommand accepts it. Defaults to `INFISICAL_ENVIRONMENT`, then the [default environment](/cli/project-config#set-the-environment) in `.infisical.yaml`, then `dev`.\"},{name:`--output`,short:`-o`,value:`\u003cstring>`,type:`string`,description:\"Print the dynamic secrets as `json`, `yaml`, or `dotenv` instead of a table.\"},{name:`--path`,value:`\u003cstring>`,type:`string`,default:`/`,description:\"The folder to list dynamic secrets from. Defaults to `INFISICAL_SECRET_PATH`, then the [default folder](/cli/project-config#set-the-folder) in `.infisical.yaml`, then `/`.\"},{name:`--project-slug`,value:`\u003cstring>`,type:`string`,description:\"The slug of the project to list dynamic secrets from. Takes precedence over `--projectId`.\"},{name:`--projectId`,value:`\u003cstring>`,type:`string`,description:\"The ID of the project to list dynamic secrets from. Without it or `--project-slug`, the CLI uses the project in `.infisical.yaml`. Can also be set with `INFISICAL_PROJECT_ID`.\"},{name:`--token`,value:`\u003cstring>`,type:`string`,description:\"A machine identity access token to authenticate with, instead of your login. Without it, the CLI reads `INFISICAL_UNIVERSAL_AUTH_ACCESS_TOKEN`, then `INFISICAL_TOKEN`.\"}],examples:[{title:`List dynamic secrets in dev`,code:`infisical secrets-manager dynamic-secrets`},{title:`List dynamic secrets in a production folder`,code:`infisical secrets-manager dynamic-secrets --env=prod --path=/databases`},{title:`Print dynamic secrets as JSON`,code:`infisical secrets-manager dynamic-secrets --projectId=\u003cproject-id> --output=json`}],children:_jsxs(_components.p,{children:[`List the `,_jsx(_components.a,{href:`/documentation/platform/dynamic-secrets/overview`,children:`dynamic secrets`}),` in an environment and folder, with each one’s provider, default TTL, and max TTL. A dynamic secret generates credentials on demand, such as a database user, and each set of credentials it generates is a lease. Manage leases with `,_jsx(_components.a,{href:`/cli/reference#secrets-manager-dynamic-secrets-lease`,children:`infisical secrets-manager dynamic-secrets lease`}),`.`]})})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsx(CLICommand,{id:`secrets-manager-dynamic-secrets-lease`,command:`secrets-manager dynamic-secrets lease`,inheritedFlags:[{name:`--env`,value:`\u003cstring>`,type:`string`,default:`dev`,description:`The environment that holds the dynamic secret.`}],children:_jsx(_components.p,{children:`Create, list, renew, and delete the leases of a dynamic secret.`})})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsxs(CLICommand,{id:`secrets-manager-dynamic-secrets-lease-create`,command:`secrets-manager dynamic-secrets lease create`,usage:`\u003cname> [flags]`,args:[{name:`name`,usage:`\u003cname>`,required:true,description:`The name of the dynamic secret to lease.`}],flags:[{name:`--kubernetes-namespace`,value:`\u003cstring>`,type:`string`,description:`The namespace to create the lease in. Used only by Kubernetes dynamic secrets.`},{name:`--output`,short:`-o`,value:`\u003cstring>`,type:`string`,description:\"Print only the credentials, as `json`, `yaml`, or `dotenv`, instead of the lease details and a table.\"},{name:`--path`,short:`-p`,value:`\u003cstring>`,type:`string`,default:`/`,description:\"The folder that holds the dynamic secret. Defaults to `INFISICAL_SECRET_PATH`, then the [default folder](/cli/project-config#set-the-folder) in `.infisical.yaml`, then `/`.\"},{name:`--plain`,type:`bool`,description:\"Print each credential as `KEY=value`, one per line, with no other output. Ignored when you pass `--output`.\"},{name:`--principals`,value:`\u003cstring>`,type:`string`,description:`The principals to put in the certificate, separated by commas. Required by SSH dynamic secrets, and each one must be allowed by the dynamic secret.`},{name:`--project-slug`,value:`\u003cstring>`,type:`string`,description:\"The slug of the project that holds the dynamic secret. Takes precedence over `--projectId`.\"},{name:`--projectId`,value:`\u003cstring>`,type:`string`,description:\"The ID of the project that holds the dynamic secret. Without it or `--project-slug`, the CLI uses the project in `.infisical.yaml`. Can also be set with `INFISICAL_PROJECT_ID`.\"},{name:`--token`,value:`\u003cstring>`,type:`string`,description:\"A machine identity access token to authenticate with, instead of your login. Without it, the CLI reads `INFISICAL_UNIVERSAL_AUTH_ACCESS_TOKEN`, then `INFISICAL_TOKEN`.\"},{name:`--ttl`,value:`\u003cstring>`,type:`string`,description:\"How long the lease lasts, such as `30m` or `1h`. Defaults to the dynamic secret's default TTL, and can't exceed its max TTL.\"}],inheritedFlags:[{name:`--env`,value:`\u003cstring>`,type:`string`,default:`dev`,description:`The environment that holds the dynamic secret.`}],examples:[{title:`Lease database credentials for an hour`,code:`infisical secrets-manager dynamic-secrets lease create postgres-app --env=prod --ttl=1h`},{title:`Lease credentials as JSON`,code:`infisical secrets-manager dynamic-secrets lease create postgres-app --output=json`},{title:`Lease an SSH certificate`,code:`infisical secrets-manager dynamic-secrets lease create ssh-prod \\\\\n --projectId=\u003cproject-id> \\\\\n --env=prod \\\\\n --principals=root,deploy`}],children:[_jsxs(_components.p,{children:[`Generate a new set of credentials from a dynamic secret. The command prints the lease ID, when the lease expires, and the credentials. Keep the lease ID to renew or delete the lease later, or find it with `,_jsx(_components.a,{href:`/cli/reference#secrets-manager-dynamic-secrets-lease-list`,children:`infisical secrets-manager dynamic-secrets lease list`}),`.`]}),_jsxs(_components.p,{children:[`The table and `,_jsx(_components.code,{children:`--plain`}),` show only credentials whose values are strings. Pass `,_jsx(_components.code,{children:`--output`}),` to get every credential the provider returns.`]})]})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsx(CLICommand,{id:`secrets-manager-dynamic-secrets-lease-delete`,command:`secrets-manager dynamic-secrets lease delete`,usage:`\u003clease-id> [flags]`,args:[{name:`lease-id`,usage:`\u003clease-id>`,required:true,description:`The ID of the lease to delete.`}],flags:[{name:`--output`,short:`-o`,value:`\u003cstring>`,type:`string`,description:\"Print the deleted lease as `json`, `yaml`, or `dotenv` instead of a table.\"},{name:`--path`,short:`-p`,value:`\u003cstring>`,type:`string`,default:`/`,description:\"The folder that holds the lease's dynamic secret. Defaults to `INFISICAL_SECRET_PATH`, then the [default folder](/cli/project-config#set-the-folder) in `.infisical.yaml`, then `/`.\"},{name:`--project-slug`,value:`\u003cstring>`,type:`string`,description:\"The slug of the project that holds the lease. Takes precedence over `--projectId`.\"},{name:`--projectId`,value:`\u003cstring>`,type:`string`,description:\"The ID of the project that holds the lease. Without it or `--project-slug`, the CLI uses the project in `.infisical.yaml`. Can also be set with `INFISICAL_PROJECT_ID`.\"},{name:`--token`,value:`\u003cstring>`,type:`string`,description:\"A machine identity access token to authenticate with, instead of your login. Without it, the CLI reads `INFISICAL_UNIVERSAL_AUTH_ACCESS_TOKEN`, then `INFISICAL_TOKEN`.\"},{name:`--yes`,short:`-y`,type:`bool`,description:`Delete without asking for confirmation. Required when there's no terminal to ask in, such as in CI.`}],inheritedFlags:[{name:`--env`,value:`\u003cstring>`,type:`string`,default:`dev`,description:`The environment that holds the lease's dynamic secret.`}],examples:[{title:`Delete a lease`,code:`infisical secrets-manager dynamic-secrets lease delete \u003clease-id> --env=prod`}],children:_jsxs(_components.p,{children:[`Delete a lease before it expires, and revoke its credentials with the provider. The command asks you to type the lease ID before it deletes anything, unless you pass `,_jsx(_components.code,{children:`--yes`}),`. `,_jsx(_components.code,{children:`--env`}),` and `,_jsx(_components.code,{children:`--path`}),` must point to the folder that holds the lease’s dynamic secret, or Infisical reports that the lease doesn’t exist.`]})})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsx(CLICommand,{id:`secrets-manager-dynamic-secrets-lease-list`,command:`secrets-manager dynamic-secrets lease list`,usage:`\u003cname> [flags]`,args:[{name:`name`,usage:`\u003cname>`,required:true,description:`The name of the dynamic secret to list leases for.`}],flags:[{name:`--output`,short:`-o`,value:`\u003cstring>`,type:`string`,description:\"Print the leases as `json`, `yaml`, or `dotenv` instead of a table.\"},{name:`--path`,short:`-p`,value:`\u003cstring>`,type:`string`,default:`/`,description:\"The folder that holds the dynamic secret. Defaults to `INFISICAL_SECRET_PATH`, then the [default folder](/cli/project-config#set-the-folder) in `.infisical.yaml`, then `/`.\"},{name:`--project-slug`,value:`\u003cstring>`,type:`string`,description:\"The slug of the project that holds the dynamic secret. Takes precedence over `--projectId`.\"},{name:`--projectId`,value:`\u003cstring>`,type:`string`,description:\"The ID of the project that holds the dynamic secret. Without it or `--project-slug`, the CLI uses the project in `.infisical.yaml`. Can also be set with `INFISICAL_PROJECT_ID`.\"},{name:`--token`,value:`\u003cstring>`,type:`string`,description:\"A machine identity access token to authenticate with, instead of your login. Without it, the CLI reads `INFISICAL_UNIVERSAL_AUTH_ACCESS_TOKEN`, then `INFISICAL_TOKEN`.\"}],inheritedFlags:[{name:`--env`,value:`\u003cstring>`,type:`string`,default:`dev`,description:`The environment that holds the dynamic secret.`}],examples:[{title:`List a dynamic secret's leases`,code:`infisical secrets-manager dynamic-secrets lease list postgres-app --env=prod`}],children:_jsx(_components.p,{children:`List the active leases of a dynamic secret, with each lease’s ID, expiry time, and creation time.`})})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsx(CLICommand,{id:`secrets-manager-dynamic-secrets-lease-renew`,command:`secrets-manager dynamic-secrets lease renew`,usage:`\u003clease-id> [flags]`,args:[{name:`lease-id`,usage:`\u003clease-id>`,required:true,description:`The ID of the lease to renew.`}],flags:[{name:`--output`,short:`-o`,value:`\u003cstring>`,type:`string`,description:\"Print the renewed lease as `json`, `yaml`, or `dotenv` instead of a table.\"},{name:`--path`,short:`-p`,value:`\u003cstring>`,type:`string`,default:`/`,description:\"The folder that holds the lease's dynamic secret. Defaults to `INFISICAL_SECRET_PATH`, then the [default folder](/cli/project-config#set-the-folder) in `.infisical.yaml`, then `/`.\"},{name:`--project-slug`,value:`\u003cstring>`,type:`string`,description:\"The slug of the project that holds the lease. Takes precedence over `--projectId`.\"},{name:`--projectId`,value:`\u003cstring>`,type:`string`,description:\"The ID of the project that holds the lease. Without it or `--project-slug`, the CLI uses the project in `.infisical.yaml`. Can also be set with `INFISICAL_PROJECT_ID`.\"},{name:`--token`,value:`\u003cstring>`,type:`string`,description:\"A machine identity access token to authenticate with, instead of your login. Without it, the CLI reads `INFISICAL_UNIVERSAL_AUTH_ACCESS_TOKEN`, then `INFISICAL_TOKEN`.\"},{name:`--ttl`,value:`\u003cstring>`,type:`string`,description:\"How long to extend the lease by, from its current expiry, such as `30m` or `1h`. Defaults to the dynamic secret's default TTL.\"}],inheritedFlags:[{name:`--env`,value:`\u003cstring>`,type:`string`,default:`dev`,description:`The environment that holds the lease's dynamic secret.`}],examples:[{title:`Extend a lease by 30 minutes`,code:`infisical secrets-manager dynamic-secrets lease renew \u003clease-id> --env=prod --ttl=30m`}],children:_jsxs(_components.p,{children:[`Extend a lease before it expires, and print its new expiry time. A renewal can’t push the lease past the dynamic secret’s max TTL, counted from when the lease was created. `,_jsx(_components.code,{children:`--env`}),` and `,_jsx(_components.code,{children:`--path`}),` must point to the folder that holds the lease’s dynamic secret, or Infisical reports that the lease doesn’t exist.`]})})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsxs(CLICommand,{id:`secrets-manager-environments`,command:`secrets-manager environments`,children:[_jsxs(_components.p,{children:[`List, create, rename, and delete the `,_jsx(_components.a,{href:`/documentation/platform/secrets-mgmt/project#project-environments`,children:`environments`}),` of a Secrets Management project, such as `,_jsx(_components.code,{children:`dev`}),` and `,_jsx(_components.code,{children:`prod`}),`. Other commands take an environment’s slug with `,_jsx(_components.code,{children:`--env`}),`. `,_jsx(_components.code,{children:`environment`}),` is an alias, so `,_jsx(_components.code,{children:`infisical secrets-manager environment get`}),` also works.`]}),_jsxs(_components.p,{children:[`The commands take the project from `,_jsx(_components.code,{children:`--projectId`}),`, then `,_jsx(_components.code,{children:`INFISICAL_PROJECT_ID`}),`, then `,_jsx(_components.code,{children:`.infisical.yaml`}),`, except `,_jsx(_components.code,{children:`delete`}),`, which takes it only from `,_jsx(_components.code,{children:`--projectId`}),`. They don’t accept service tokens. If `,_jsx(_components.code,{children:`INFISICAL_TOKEN`}),` holds a service token, the commands use your login instead.`]})]})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsx(CLICommand,{id:`secrets-manager-environments-create`,command:`secrets-manager environments create`,usage:`\u003cslug> [flags]`,args:[{name:`slug`,usage:`\u003cslug>`,required:true,description:\"The slug of the new environment, such as `qa`.\"}],flags:[{name:`--name`,value:`\u003cstring>`,type:`string`,description:`The environment's display name. Defaults to the slug.`},{name:`--output`,short:`-o`,value:`\u003cstring>`,type:`string`,description:\"Print the created environment as `json` or `yaml` instead of a table.\"},{name:`--projectId`,value:`\u003cstring>`,type:`string`,description:\"The project to create the environment in. Defaults to `INFISICAL_PROJECT_ID`, then the project linked in `.infisical.yaml`.\"},{name:`--token`,value:`\u003cstring>`,type:`string`,description:\"A machine identity access token to authenticate with, instead of your login. Without it, the CLI reads `INFISICAL_UNIVERSAL_AUTH_ACCESS_TOKEN`, then `INFISICAL_TOKEN`.\"}],examples:[{title:`Create an environment`,code:`infisical secrets-manager environments create qa --projectId=\u003cproject-id>`},{title:`Create an environment with a display name`,code:`infisical secrets-manager environments create qa --name=\"Quality Assurance\" --projectId=\u003cproject-id>`}],children:_jsxs(_components.p,{children:[`Create an environment in a project. If an environment already has the slug, the command fails with `,_jsx(_components.code,{children:`environment_exists`}),`.`]})})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsxs(CLICommand,{id:`secrets-manager-environments-delete`,command:`secrets-manager environments delete`,usage:`\u003cslug> [flags]`,args:[{name:`slug`,usage:`\u003cslug>`,required:true,description:`The slug of the environment to delete.`}],flags:[{name:`--force`,type:`bool`,description:`Delete the environment permanently now, instead of after 14 days. Also deletes an environment that's already pending deletion, which frees its slug.`},{name:`--output`,short:`-o`,value:`\u003cstring>`,type:`string`,description:\"Print the deleted environment as `json` or `yaml` instead of a table.\"},{name:`--projectId`,value:`\u003cstring>`,type:`string`,required:true,description:\"The project that holds the environment. The command doesn't read `INFISICAL_PROJECT_ID` or `.infisical.yaml`.\"},{name:`--token`,value:`\u003cstring>`,type:`string`,description:\"A machine identity access token to authenticate with, instead of your login. Without it, the CLI reads `INFISICAL_UNIVERSAL_AUTH_ACCESS_TOKEN`, then `INFISICAL_TOKEN`.\"},{name:`--yes`,short:`-y`,type:`bool`,description:`Delete without asking for confirmation. Required when there's no terminal to ask in, such as in CI.`}],examples:[{title:`Delete an environment`,code:`infisical secrets-manager environments delete qa --projectId=\u003cproject-id>`},{title:`Delete an environment permanently in a script`,code:`infisical secrets-manager environments delete qa --force --yes --projectId=\u003cproject-id>`}],children:[_jsxs(_components.p,{children:[`Delete an environment and every secret in it. The command asks you to type the environment’s slug before it deletes anything, unless you pass `,_jsx(_components.code,{children:`--yes`}),`.`]}),_jsxs(_components.p,{children:[`The environment stays pending deletion for 14 days, and is deleted permanently after that. Until then, you can restore it from the project’s settings in Infisical, and no other environment can use its slug. Pass `,_jsx(_components.code,{children:`--force`}),` to delete it permanently now.`]})]})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsx(CLICommand,{id:`secrets-manager-environments-get`,command:`secrets-manager environments get`,usage:`[slug] [flags]`,args:[{name:`slug`,usage:`[slug]`,description:`The slug of the environment to show. Without it, the command lists every environment in the project.`}],flags:[{name:`--output`,short:`-o`,value:`\u003cstring>`,type:`string`,description:\"Print the environments as `json` or `yaml` instead of a table.\"},{name:`--projectId`,value:`\u003cstring>`,type:`string`,description:\"The project to read environments from. Defaults to `INFISICAL_PROJECT_ID`, then the project linked in `.infisical.yaml`.\"},{name:`--token`,value:`\u003cstring>`,type:`string`,description:\"A machine identity access token to authenticate with, instead of your login. Without it, the CLI reads `INFISICAL_UNIVERSAL_AUTH_ACCESS_TOKEN`, then `INFISICAL_TOKEN`.\"}],examples:[{title:`List the environments of the linked project`,code:`infisical secrets-manager environments get`},{title:`Show one environment as JSON`,code:`infisical secrets-manager environments get staging --projectId=\u003cproject-id> --output=json`}],children:_jsxs(_components.p,{children:[`List a project’s environments with each one’s name, slug, and ID, or show the environment you name. The list also shows the environments pending deletion, with the day each one will be deleted permanently. In JSON and YAML, those environments are in `,_jsx(_components.code,{children:`pendingDeletion`}),`.`]})})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsx(CLICommand,{id:`secrets-manager-environments-update`,command:`secrets-manager environments update`,usage:`\u003cslug> [flags]`,args:[{name:`slug`,usage:`\u003cslug>`,required:true,description:`The current slug of the environment to change.`}],flags:[{name:`--name`,value:`\u003cstring>`,type:`string`,description:`The environment's new display name.`},{name:`--output`,short:`-o`,value:`\u003cstring>`,type:`string`,description:\"Print the updated environment as `json` or `yaml` instead of a table.\"},{name:`--projectId`,value:`\u003cstring>`,type:`string`,description:\"The project that holds the environment. Defaults to `INFISICAL_PROJECT_ID`, then the project linked in `.infisical.yaml`.\"},{name:`--slug`,value:`\u003cstring>`,type:`string`,description:\"The environment's new slug. Commands that pass the old slug with `--env` stop working.\"},{name:`--token`,value:`\u003cstring>`,type:`string`,description:\"A machine identity access token to authenticate with, instead of your login. Without it, the CLI reads `INFISICAL_UNIVERSAL_AUTH_ACCESS_TOKEN`, then `INFISICAL_TOKEN`.\"}],examples:[{title:`Change an environment's display name`,code:`infisical secrets-manager environments update qa --name=\"Quality Assurance\" --projectId=\u003cproject-id>`},{title:`Change an environment's slug`,code:`infisical secrets-manager environments update qa --slug=testing --projectId=\u003cproject-id>`}],children:_jsxs(_components.p,{children:[`Change an environment’s display name, its slug, or both. Pass at least one of `,_jsx(_components.code,{children:`--name`}),` and `,_jsx(_components.code,{children:`--slug`}),`, or the command fails with `,_jsx(_components.code,{children:`nothing_to_update`}),`. If another environment already has the new slug, the command fails with `,_jsx(_components.code,{children:`environment_exists`}),`.`]})})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsxs(CLICommand,{id:`secrets-manager-folders`,command:`secrets-manager folders`,children:[_jsxs(_components.p,{children:[`List, create, rename, and delete the folders in an environment. Folders organize an environment’s secrets into paths such as `,_jsx(_components.code,{children:`/backend/api`}),`, which other commands take with `,_jsx(_components.code,{children:`--path`}),`. Each `,_jsx(_components.code,{children:`folders`}),` command works on the folders directly inside `,_jsx(_components.code,{children:`--path`}),`, so to work on `,_jsx(_components.code,{children:`/backend/api`}),`, pass `,_jsx(_components.code,{children:`api`}),` as the name and `,_jsx(_components.code,{children:`--path=/backend`}),`. A folder name can contain only letters, numbers, dashes, and underscores.`]}),_jsxs(_components.p,{children:[`The commands take the project from `,_jsx(_components.code,{children:`--projectId`}),`, then `,_jsx(_components.code,{children:`INFISICAL_PROJECT_ID`}),`, then `,_jsx(_components.code,{children:`.infisical.yaml`}),`, except `,_jsx(_components.code,{children:`delete`}),`, which takes it only from `,_jsx(_components.code,{children:`--projectId`}),`. A service token works only in its own project. If you select a different project, the command fails with `,_jsx(_components.code,{children:`token_project_mismatch`}),`.`]})]})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsx(CLICommand,{id:`secrets-manager-folders-create`,command:`secrets-manager folders create`,usage:`\u003cname> [flags]`,args:[{name:`name`,usage:`\u003cname>`,required:true,description:`The name of the new folder.`}],flags:[{name:`--description`,value:`\u003cstring>`,type:`string`,description:`A description of the folder.`},{name:`--env`,value:`\u003cstring>`,type:`string`,default:`dev`,description:\"The environment to create the folder in. Defaults to `INFISICAL_ENVIRONMENT`, then the [default environment](/cli/project-config#set-the-environment) in `.infisical.yaml`, then `dev`.\"},{name:`--output`,short:`-o`,value:`\u003cstring>`,type:`string`,description:\"Print the created folder as `json` or `yaml` instead of a table.\"},{name:`--path`,value:`\u003cstring>`,type:`string`,default:`/`,description:\"The folder to create the new folder in. Folders in the path that don't exist yet are created too. Defaults to `INFISICAL_SECRET_PATH`, then the [default folder](/cli/project-config#set-the-folder) in `.infisical.yaml`, then `/`.\"},{name:`--projectId`,value:`\u003cstring>`,type:`string`,description:\"The project to create the folder in. Defaults to `INFISICAL_PROJECT_ID`, then the project linked in `.infisical.yaml`. A service token always uses its own project.\"},{name:`--token`,value:`\u003cstring>`,type:`string`,description:\"A machine identity access token or service token to authenticate with, instead of your login. Without it, the CLI reads `INFISICAL_UNIVERSAL_AUTH_ACCESS_TOKEN`, then `INFISICAL_TOKEN`.\"}],examples:[{title:`Create a folder`,code:`infisical secrets-manager folders create api --env=prod --path=/backend`},{title:`Create a folder and its missing parents, with a description`,code:`infisical secrets-manager folders create api --path=/backend/services --description=\"Public API\"`}],children:_jsxs(_components.p,{children:[`Create a folder inside `,_jsx(_components.code,{children:`--path`}),`. If a folder with that name already exists there, the command fails with `,_jsx(_components.code,{children:`folder_exists`}),` and creates nothing.`]})})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsx(CLICommand,{id:`secrets-manager-folders-delete`,command:`secrets-manager folders delete`,usage:`\u003cname> [flags]`,args:[{name:`name`,usage:`\u003cname>`,required:true,description:`The name of the folder to delete.`}],flags:[{name:`--env`,value:`\u003cstring>`,type:`string`,default:`dev`,description:\"The environment that holds the folder. Defaults to `INFISICAL_ENVIRONMENT`, then the [default environment](/cli/project-config#set-the-environment) in `.infisical.yaml`, then `dev`.\"},{name:`--output`,short:`-o`,value:`\u003cstring>`,type:`string`,description:\"Print the deleted folder as `json` or `yaml` instead of a table.\"},{name:`--path`,value:`\u003cstring>`,type:`string`,default:`/`,description:\"The folder that contains the folder to delete. Defaults to `INFISICAL_SECRET_PATH`, then the [default folder](/cli/project-config#set-the-folder) in `.infisical.yaml`, then `/`.\"},{name:`--projectId`,value:`\u003cstring>`,type:`string`,required:true,description:\"The project that holds the folder. The command doesn't read `INFISICAL_PROJECT_ID` or `.infisical.yaml`.\"},{name:`--token`,value:`\u003cstring>`,type:`string`,description:\"A machine identity access token or service token to authenticate with, instead of your login. Without it, the CLI reads `INFISICAL_UNIVERSAL_AUTH_ACCESS_TOKEN`, then `INFISICAL_TOKEN`.\"},{name:`--yes`,short:`-y`,type:`bool`,description:`Delete without asking for confirmation. Required when there's no terminal to ask in, such as in CI.`}],examples:[{title:`Delete a folder`,code:`infisical secrets-manager folders delete api --env=prod --path=/backend --projectId=\u003cproject-id>`},{title:`Delete a folder in a script`,code:`infisical secrets-manager folders delete api --env=prod --path=/backend --projectId=\u003cproject-id> --yes`}],children:_jsxs(_components.p,{children:[`Delete a folder and everything in it: its secrets, its dynamic secrets, and the folders inside it. The command asks you to type the folder’s name before it deletes anything, unless you pass `,_jsx(_components.code,{children:`--yes`}),`.`]})})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsx(CLICommand,{id:`secrets-manager-folders-get`,command:`secrets-manager folders get`,usage:`[name] [flags]`,args:[{name:`name`,usage:`[name]`,description:\"The name of the folder to show. Without it, the command lists the folders inside `--path`.\"}],flags:[{name:`--env`,value:`\u003cstring>`,type:`string`,default:`dev`,description:\"The environment to read folders from. Defaults to `INFISICAL_ENVIRONMENT`, then the [default environment](/cli/project-config#set-the-environment) in `.infisical.yaml`, then `dev`.\"},{name:`--output`,short:`-o`,value:`\u003cstring>`,type:`string`,description:\"Print the folders as `json` or `yaml` instead of a table.\"},{name:`--path`,value:`\u003cstring>`,type:`string`,default:`/`,description:\"The folder to list folders from. Defaults to `INFISICAL_SECRET_PATH`, then the [default folder](/cli/project-config#set-the-folder) in `.infisical.yaml`, then `/`.\"},{name:`--projectId`,value:`\u003cstring>`,type:`string`,description:\"The project to read folders from. Defaults to `INFISICAL_PROJECT_ID`, then the project linked in `.infisical.yaml`. A service token always uses its own project.\"},{name:`--token`,value:`\u003cstring>`,type:`string`,description:\"A machine identity access token or service token to authenticate with, instead of your login. Without it, the CLI reads `INFISICAL_UNIVERSAL_AUTH_ACCESS_TOKEN`, then `INFISICAL_TOKEN`.\"}],examples:[{title:`List the folders at the root`,code:`infisical secrets-manager folders get`},{title:`Show one folder as JSON`,code:`infisical secrets-manager folders get api --env=prod --path=/backend --output=json`}],children:_jsxs(_components.p,{children:[`List the folders inside `,_jsx(_components.code,{children:`--path`}),`, or show the folder you name. In JSON and YAML, each folder’s `,_jsx(_components.code,{children:`path`}),` is its own full path, such as `,_jsx(_components.code,{children:`/backend/api`}),`, which you can pass to `,_jsx(_components.code,{children:`--path`}),` to work inside the folder.`]})})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsx(CLICommand,{id:`secrets-manager-folders-update`,command:`secrets-manager folders update`,usage:`\u003cname> [flags]`,args:[{name:`name`,usage:`\u003cname>`,required:true,description:`The current name of the folder to change.`}],flags:[{name:`--description`,value:`\u003cstring>`,type:`string`,description:'The folder\\'s new description. Pass `--description=\"\"` to remove it.'},{name:`--env`,value:`\u003cstring>`,type:`string`,default:`dev`,description:\"The environment that holds the folder. Defaults to `INFISICAL_ENVIRONMENT`, then the [default environment](/cli/project-config#set-the-environment) in `.infisical.yaml`, then `dev`.\"},{name:`--name`,value:`\u003cstring>`,type:`string`,description:\"The folder's new name. Commands that pass the folder's old path with `--path` stop working.\"},{name:`--output`,short:`-o`,value:`\u003cstring>`,type:`string`,description:\"Print the updated folder as `json` or `yaml` instead of a table.\"},{name:`--path`,value:`\u003cstring>`,type:`string`,default:`/`,description:\"The folder that contains the folder to change. Defaults to `INFISICAL_SECRET_PATH`, then the [default folder](/cli/project-config#set-the-folder) in `.infisical.yaml`, then `/`.\"},{name:`--projectId`,value:`\u003cstring>`,type:`string`,description:\"The project that holds the folder. Defaults to `INFISICAL_PROJECT_ID`, then the project linked in `.infisical.yaml`. A service token always uses its own project.\"},{name:`--token`,value:`\u003cstring>`,type:`string`,description:\"A machine identity access token or service token to authenticate with, instead of your login. Without it, the CLI reads `INFISICAL_UNIVERSAL_AUTH_ACCESS_TOKEN`, then `INFISICAL_TOKEN`.\"}],examples:[{title:`Rename a folder`,code:`infisical secrets-manager folders update api --name=public-api --env=prod --path=/backend`},{title:`Remove a folder's description`,code:`infisical secrets-manager folders update api --description=\"\" --path=/backend`}],children:_jsxs(_components.p,{children:[`Rename a folder, change its description, or both. Pass at least one of `,_jsx(_components.code,{children:`--name`}),` and `,_jsx(_components.code,{children:`--description`}),`, or the command fails with `,_jsx(_components.code,{children:`nothing_to_update`}),`. If another folder in `,_jsx(_components.code,{children:`--path`}),` already has the new name, the command fails with `,_jsx(_components.code,{children:`folder_exists`}),`.`]})})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsxs(CLICommand,{id:`secrets-manager-projects`,command:`secrets-manager projects`,children:[_jsxs(_components.p,{children:[`Find, create, change, and delete Secrets Management `,_jsx(_components.a,{href:`/documentation/platform/project`,children:`projects`}),`. Use these commands to find the project ID that `,_jsx(_components.a,{href:`/cli/reference#init`,children:`infisical init`}),` and the `,_jsx(_components.code,{children:`--projectId`}),` flag take, or to manage projects without opening Infisical.`]}),_jsxs(_components.p,{children:[`The commands don’t accept service tokens, except `,_jsx(_components.code,{children:`projects get`}),` with a project ID. If `,_jsx(_components.code,{children:`INFISICAL_TOKEN`}),` holds a service token, the commands use your login instead.`]})]})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsxs(CLICommand,{id:`secrets-manager-projects-create`,command:`secrets-manager projects create`,usage:`[flags]`,flags:[{name:`--description`,value:`\u003cstring>`,type:`string`,description:`A description of the project, up to 1024 characters.`},{name:`--name`,value:`\u003cstring>`,type:`string`,required:true,description:`The name of the project, up to 64 characters.`},{name:`--output`,short:`-o`,value:`\u003cstring>`,type:`string`,description:\"Print the created project as `json` or `yaml` instead of a table.\"},{name:`--slug`,value:`\u003cstring>`,type:`string`,description:`The project's slug, from 5 to 64 characters. Without it, Infisical generates a slug from the name.`},{name:`--token`,value:`\u003cstring>`,type:`string`,description:\"A machine identity access token to authenticate with, instead of your login. Without it, the CLI reads `INFISICAL_UNIVERSAL_AUTH_ACCESS_TOKEN`, then `INFISICAL_TOKEN`.\"}],examples:[{title:`Create a project and link this directory to it`,code:`infisical secrets-manager projects create --name=my-app\ninfisical init --project-id=\u003cproject-id>`},{title:`Create a project with a description and slug`,code:`infisical secrets-manager projects create --name=my-app --description=\"Backend service\" --slug=my-app-backend`}],children:[_jsx(_components.p,{children:`Create a Secrets Management project in your organization with the Development, Staging, and Production environments.`}),_jsxs(_components.p,{children:[`The user or machine identity that creates the project becomes the project’s admin. The command prints the project and its environments, followed by the `,_jsx(_components.code,{children:`infisical init`}),` command that links the current directory to the project.`]})]})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsx(CLICommand,{id:`secrets-manager-projects-delete`,command:`secrets-manager projects delete`,usage:`\u003cslug> [flags]`,args:[{name:`slug`,usage:`\u003cslug>`,required:true,description:`The slug of the project to delete. Find it with [infisical secrets-manager projects get](/cli/reference#secrets-manager-projects-get).`}],flags:[{name:`--output`,short:`-o`,value:`\u003cstring>`,type:`string`,description:\"Print the deleted project as `json` or `yaml` instead of a table.\"},{name:`--token`,value:`\u003cstring>`,type:`string`,description:\"A machine identity access token to authenticate with, instead of your login. Without it, the CLI reads `INFISICAL_UNIVERSAL_AUTH_ACCESS_TOKEN`, then `INFISICAL_TOKEN`.\"},{name:`--yes`,short:`-y`,type:`bool`,description:`Delete without asking for confirmation. Required when there's no terminal to ask in, such as in CI.`}],examples:[{title:`Delete a project`,code:`infisical secrets-manager projects delete my-app`},{title:`Delete a project in a script`,code:`infisical secrets-manager projects delete my-app --yes`}],children:_jsxs(_components.p,{children:[`Delete a project, with all of its environments, folders, and secrets. The command asks you to type the project’s slug before it deletes anything, unless you pass `,_jsx(_components.code,{children:`--yes`}),`.`]})})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsxs(CLICommand,{id:`secrets-manager-projects-get`,command:`secrets-manager projects get`,usage:`[slug-or-id] [flags]`,args:[{name:`slug-or-id`,usage:`[slug-or-id]`,description:`The slug or ID of the project to show. Without it, the command lists your projects.`}],flags:[{name:`--output`,short:`-o`,value:`\u003cstring>`,type:`string`,description:\"Print the projects as `json` or `yaml` instead of a table.\"},{name:`--projectId`,value:`\u003cstring>`,type:`string`,deprecated:true,description:`Deprecated: pass the project's ID as the argument instead. The ID of the project to show.`},{name:`--token`,value:`\u003cstring>`,type:`string`,description:\"A machine identity access token to authenticate with, instead of your login. Without it, the CLI reads `INFISICAL_UNIVERSAL_AUTH_ACCESS_TOKEN`, then `INFISICAL_TOKEN`.\"}],examples:[{title:`List your projects`,code:`infisical secrets-manager projects get`},{title:`Show a project and its environments`,code:`infisical secrets-manager projects get my-app`},{title:`List a machine identity's projects as JSON`,code:`infisical secrets-manager projects get --token=\u003caccess-token> --output=json`}],children:[_jsxs(_components.p,{children:[`List the name, slug, and ID of each Secrets Management project you’re a member of, or show one project with the name, slug, and ID of each of its environments. With a machine identity, the list has the projects the identity is a member of. Use an environment’s slug with the `,_jsx(_components.code,{children:`--env`}),` flag of other `,_jsx(_components.code,{children:`secrets-manager`}),` commands.`]}),_jsxs(_components.p,{children:[`Without an argument, the command lists your projects, even in a directory linked to one. It doesn’t use `,_jsx(_components.code,{children:`INFISICAL_PROJECT_ID`}),` or `,_jsx(_components.code,{children:`.infisical.yaml`}),`.`]})]})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsx(CLICommand,{id:`secrets-manager-projects-update`,command:`secrets-manager projects update`,usage:`\u003cslug-or-id> [flags]`,args:[{name:`slug-or-id`,usage:`\u003cslug-or-id>`,required:true,description:`The slug or ID of the project to change.`}],flags:[{name:`--description`,value:`\u003cstring>`,type:`string`,description:'The project\\'s new description, up to 1024 characters. Pass `--description=\"\"` to remove it.'},{name:`--name`,value:`\u003cstring>`,type:`string`,description:`The project's new name, up to 64 characters.`},{name:`--output`,short:`-o`,value:`\u003cstring>`,type:`string`,description:\"Print the updated project as `json` or `yaml` instead of a table.\"},{name:`--slug`,value:`\u003cstring>`,type:`string`,description:`The project's new slug, up to 64 characters. Commands that name the project by its old slug stop working.`},{name:`--token`,value:`\u003cstring>`,type:`string`,description:\"A machine identity access token to authenticate with, instead of your login. Without it, the CLI reads `INFISICAL_UNIVERSAL_AUTH_ACCESS_TOKEN`, then `INFISICAL_TOKEN`.\"}],examples:[{title:`Rename a project`,code:`infisical secrets-manager projects update my-app --name=\"My App\"`},{title:`Change a project's slug`,code:`infisical secrets-manager projects update my-app --slug=my-app-backend`},{title:`Remove a project's description`,code:`infisical secrets-manager projects update \u003cproject-id> --description=\"\"`}],children:_jsxs(_components.p,{children:[`Change a project’s name, slug, or description. Pass at least one of `,_jsx(_components.code,{children:`--name`}),`, `,_jsx(_components.code,{children:`--slug`}),`, and `,_jsx(_components.code,{children:`--description`}),`, or the command fails with `,_jsx(_components.code,{children:`nothing_to_update`}),`.`]})})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsxs(CLICommand,{id:`secrets-manager-run`,command:`secrets-manager run`,usage:`[flags] -- [command]`,args:[{name:`command`,usage:`[command]`,description:\"The command to run, after `--`. Everything after `--` is passed to it unchanged. Required unless you pass `--command`.\"}],flags:[{name:`--command`,short:`-c`,value:`\u003cstring>`,type:`string`,description:'A shell command to run instead of the arguments after `--`, such as `\"npm run build \u0026\u0026 npm start\"`. Use it to chain several commands.'},{name:`--env`,short:`-e`,value:`\u003cstring>`,type:`string`,default:`dev`,description:\"The environment to fetch secrets from, such as `dev`, `staging`, or `prod`. Defaults to `INFISICAL_ENVIRONMENT`, then the [default environment](/cli/project-config#set-the-environment) in `.infisical.yaml`, then `dev`.\"},{name:`--expand`,type:`bool`,default:`true`,description:\"Resolve secret references and shell parameter expansions in secret values before injecting them. Pass `--expand=false` to inject values exactly as stored.\"},{name:`--include-imports`,type:`bool`,default:`true`,description:`Include secrets imported into the environment from other environments or folders.`},{name:`--path`,value:`\u003cstringArray>`,type:`stringArray`,default:`/`,description:\"The folder to fetch secrets from. Repeat the flag to inject secrets from several folders. When a secret exists in more than one, the value from the last `--path` wins. Defaults to `INFISICAL_SECRET_PATH`, then the [default folder](/cli/project-config#set-the-folder) in `.infisical.yaml`, then `/`.\"},{name:`--project-config-dir`,value:`\u003cstring>`,type:`string`,description:\"The directory that contains `.infisical.yaml`. Use it when the file isn't in the directory you run the command from, such as in a monorepo.\"},{name:`--projectId`,value:`\u003cstring>`,type:`string`,description:\"The project to fetch secrets from. Required when you authenticate with a machine identity. Can also be set with `INFISICAL_PROJECT_ID`.\"},{name:`--recursive`,type:`bool`,description:\"Also inject the secrets in every subfolder of each `--path`.\"},{name:`--secret-overriding`,type:`bool`,default:`true`,description:\"Use your personal secrets in place of shared secrets with the same name. Pass `--secret-overriding=false` to use only shared secrets.\"},{name:`--tags`,short:`-t`,value:`\u003cstring>`,type:`string`,description:`Only inject secrets with these tag slugs, separated by commas.`},{name:`--token`,value:`\u003cstring>`,type:`string`,description:\"A machine identity access token to fetch secrets with, instead of your login. Without it, the CLI reads `INFISICAL_UNIVERSAL_AUTH_ACCESS_TOKEN`, then `INFISICAL_TOKEN`.\"},{name:`--watch`,type:`bool`,description:`Restart the command whenever secrets change in Infisical. Intended for local development.`},{name:`--watch-interval`,value:`\u003cint>`,type:`int`,default:`10`,description:\"How often, in seconds, `--watch` checks for changes. The minimum is `5`.\"}],examples:[{title:`Start a dev server with secrets`,code:`infisical secrets-manager run -- npm run dev`},{title:`Use another environment and two folders`,code:`infisical secrets-manager run --env=prod --path=/shared --path=/backend -- node server.js`},{title:`Run in CI with a machine identity`,code:`export INFISICAL_TOKEN=\u003caccess-token>\ninfisical secrets-manager run --projectId=\u003cproject-id> --env=prod -- npm start`},{title:`Restart when secrets change`,code:`infisical secrets-manager run --watch -- npm run dev`}],children:[_jsxs(_components.p,{children:[`Inject secrets from Infisical into a process as environment variables. The CLI fetches the secrets for the project linked in `,_jsx(_components.a,{href:`/cli/project-config`,children:_jsx(_components.code,{children:`.infisical.yaml`})}),`, or the one you pass with `,_jsx(_components.code,{children:`--projectId`}),`, and starts your command with them set.`]}),_jsxs(_components.p,{children:[`Secrets override variables that are already set in your shell. Secrets named `,_jsx(_components.code,{children:`HOME`}),`, `,_jsx(_components.code,{children:`PATH`}),`, `,_jsx(_components.code,{children:`PS1`}),`, `,_jsx(_components.code,{children:`PS2`}),`, `,_jsx(_components.code,{children:`PWD`}),`, `,_jsx(_components.code,{children:`EDITOR`}),`, `,_jsx(_components.code,{children:`XAUTHORITY`}),`, `,_jsx(_components.code,{children:`USER`}),`, `,_jsx(_components.code,{children:`TERM`}),`, `,_jsx(_components.code,{children:`TERMINFO`}),`, `,_jsx(_components.code,{children:`SHELL`}),`, or `,_jsx(_components.code,{children:`MAIL`}),`, or starting with `,_jsx(_components.code,{children:`XDG_`}),` or `,_jsx(_components.code,{children:`LC_`}),`, are never injected.`]})]})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsx(CLICommand,{id:`secrets-manager-secrets`,command:`secrets-manager secrets`,usage:`[flags]`,flags:[{name:`--env`,value:`\u003cstring>`,type:`string`,default:`dev`,description:\"The environment to list secrets from. Every `infisical secrets-manager secrets` subcommand accepts it. Defaults to `INFISICAL_ENVIRONMENT`, then the [default environment](/cli/project-config#set-the-environment) in `.infisical.yaml`, then `dev`.\"},{name:`--expand`,type:`bool`,default:`true`,description:`Resolve secret references and shell parameter expansions in secret values.`},{name:`--include-imports`,type:`bool`,default:`true`,description:`Include secrets imported into the environment from other environments or folders.`},{name:`--output`,short:`-o`,value:`\u003cstring>`,type:`string`,description:\"Print the secrets as `json`, `yaml`, or `dotenv` instead of a table.\"},{name:`--path`,value:`\u003cstring>`,type:`string`,default:`/`,description:\"The folder to list secrets from. Defaults to `INFISICAL_SECRET_PATH`, then the [default folder](/cli/project-config#set-the-folder) in `.infisical.yaml`, then `/`.\"},{name:`--plain`,type:`bool`,deprecated:true,description:\"Deprecated: use `--output` instead. Print each secret as `KEY=value`, one per line.\"},{name:`--projectId`,value:`\u003cstring>`,type:`string`,description:\"The project to list secrets from. Required when you authenticate with a machine identity. Can also be set with `INFISICAL_PROJECT_ID`.\"},{name:`--recursive`,type:`bool`,description:\"Also list the secrets in every subfolder of `--path`.\"},{name:`--secret-overriding`,type:`bool`,default:`true`,description:\"Show your personal secrets in place of shared secrets with the same name. Pass `--secret-overriding=false` to show only shared secrets.\"},{name:`--tags`,short:`-t`,value:`\u003cstring>`,type:`string`,description:\"Only list secrets with these tag slugs, separated by commas. `infisical secrets-manager secrets get` accepts it too.\"},{name:`--token`,value:`\u003cstring>`,type:`string`,description:\"A machine identity access token to fetch secrets with, instead of your login. Without it, the CLI reads `INFISICAL_UNIVERSAL_AUTH_ACCESS_TOKEN`, then `INFISICAL_TOKEN`.\"}],examples:[{title:`List secrets in dev`,code:`infisical secrets-manager secrets`},{title:`List every secret in a folder tree`,code:`infisical secrets-manager secrets --env=staging --path=/ --recursive`},{title:`Print production secrets as JSON`,code:`infisical secrets-manager secrets --env=prod --output=json`}],children:_jsxs(_components.p,{children:[`Print the secrets in an environment and folder as a table. Pass `,_jsx(_components.code,{children:`--output`}),` to print them as JSON, YAML, or dotenv instead.`]})})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsxs(CLICommand,{id:`secrets-manager-secrets-create`,command:`secrets-manager secrets create`,usage:`\u003cname=value>... [flags]`,args:[{name:`name=value`,usage:`\u003cname=value>...`,repeatable:true,description:\"A secret to create. Use `NAME=@path/to/file` to read the value from a file, and `NAME=\\\\@value` for a value that starts with `@`. Required unless you pass `--file`.\"}],flags:[{name:`--file`,value:`\u003cstring>`,type:`string`,description:\"A `.env` or YAML file to read secrets from, instead of arguments. Lines starting with `#` or `//` are comments.\"},{name:`--output`,short:`-o`,value:`\u003cstring>`,type:`string`,description:\"Print the created secrets as `json`, `yaml`, or `dotenv` instead of a table.\"},{name:`--path`,value:`\u003cstring>`,type:`string`,default:`/`,description:\"The folder that holds the new secrets. Defaults to `INFISICAL_SECRET_PATH`, then the [default folder](/cli/project-config#set-the-folder) in `.infisical.yaml`, then `/`.\"},{name:`--projectId`,value:`\u003cstring>`,type:`string`,description:\"The project that holds the new secrets. Defaults to `INFISICAL_PROJECT_ID`, then the project linked in `.infisical.yaml`. A service token always writes to its own project, and fails with `token_project_mismatch` if you select another one.\"},{name:`--show-values`,type:`bool`,description:`Show secret values in the result table instead of masking them.`},{name:`--tag`,value:`\u003cstringArray>`,type:`stringArray`,description:`A tag to attach, created if it doesn't exist. Repeat the flag for several tags.`},{name:`--token`,value:`\u003cstring>`,type:`string`,description:\"A machine identity access token or service token to authenticate with, instead of your login. Without it, the CLI reads `INFISICAL_UNIVERSAL_AUTH_ACCESS_TOKEN`, then `INFISICAL_TOKEN`.\"},{name:`--type`,value:`\u003cstring>`,type:`string`,default:`shared`,description:\"`shared` for secrets everyone on the project sees, or `personal` for secrets that override them only for you.\"}],inheritedFlags:[{name:`--env`,value:`\u003cstring>`,type:`string`,default:`dev`,description:`The environment to create the secrets in.`},{name:`--tags`,short:`-t`,value:`\u003cstring>`,type:`string`,description:\"Has no effect on this command. Use `--tag` to attach tags.\"}],examples:[{title:`Create two secrets`,code:`infisical secrets-manager secrets create DOMAIN=example.com PORT=443`},{title:`Load a value from a file`,code:`infisical secrets-manager secrets create TLS_CERT=@./cert.pem --env=prod`},{title:`Import a .env file`,code:`infisical secrets-manager secrets create --file=./.env`},{title:`Override a secret only for yourself`,code:`infisical secrets-manager secrets create API_URL=http://localhost:3000 --type=personal`}],children:[_jsxs(_components.p,{children:[`Create secrets. If any of them already exists, the command fails with `,_jsx(_components.code,{children:`secret_exists`}),` and writes none of them. To change a secret that exists, run `,_jsx(_components.a,{href:`/cli/reference#secrets-manager-secrets-update`,children:`infisical secrets-manager secrets update`}),`. The result table masks values unless you pass `,_jsx(_components.code,{children:`--show-values`}),`.`]}),_jsxs(_components.p,{children:[`Your shell saves the values you pass on the command line in its history file. To keep them out, pass `,_jsx(_components.code,{children:`--file`}),` or `,_jsx(_components.code,{children:`NAME=@path`}),`, or `,_jsx(_components.a,{href:`/cli/faq`,children:`set your shell to skip these commands`}),`.`]})]})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsxs(CLICommand,{id:`secrets-manager-secrets-delete`,command:`secrets-manager secrets delete`,usage:`\u003cname>... [flags]`,args:[{name:`name`,usage:`\u003cname>...`,required:true,repeatable:true,description:`The names of the secrets to delete.`}],flags:[{name:`--output`,short:`-o`,value:`\u003cstring>`,type:`string`,description:\"Print the result as `json`, `yaml`, or `dotenv` instead of a table.\"},{name:`--path`,value:`\u003cstring>`,type:`string`,default:`/`,description:\"The folder to delete from. Defaults to `INFISICAL_SECRET_PATH`, then the [default folder](/cli/project-config#set-the-folder) in `.infisical.yaml`, then `/`.\"},{name:`--projectId`,value:`\u003cstring>`,type:`string`,description:\"The project to delete from. Required when you authenticate with a machine identity. Can also be set with `INFISICAL_PROJECT_ID`.\"},{name:`--token`,value:`\u003cstring>`,type:`string`,description:\"A machine identity access token to authenticate with, instead of your login. Without it, the CLI reads `INFISICAL_UNIVERSAL_AUTH_ACCESS_TOKEN`, then `INFISICAL_TOKEN`.\"},{name:`--type`,value:`\u003cstring>`,type:`string`,default:`personal`,description:\"Which secrets to delete: `personal` or `shared`.\"},{name:`--yes`,short:`-y`,type:`bool`,description:`Delete without asking for confirmation. Required when there's no terminal to ask in, such as in CI.`}],inheritedFlags:[{name:`--env`,value:`\u003cstring>`,type:`string`,default:`dev`,description:`The environment to delete from.`}],examples:[{title:`Delete two shared secrets`,code:`infisical secrets-manager secrets delete STRIPE_API_KEY DOMAIN --type=shared`},{title:`Delete a secret in a script`,code:`infisical secrets-manager secrets delete OLD_API_KEY --type=shared --yes`},{title:`Remove your personal override of a secret`,code:`infisical secrets-manager secrets delete API_URL`}],children:[_jsxs(_components.p,{children:[`Delete secrets by name. The command asks you to type the secret’s name, or the number of secrets if you name more than one, before it deletes anything, unless you pass `,_jsx(_components.code,{children:`--yes`}),`.`]}),_jsxs(_components.p,{children:[`Without `,_jsx(_components.code,{children:`--type`}),`, the command deletes your personal secrets with those names. Pass `,_jsx(_components.code,{children:`--type=shared`}),` to delete the shared secrets that everyone on the project sees.`]})]})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsxs(CLICommand,{id:`secrets-manager-secrets-export`,command:`secrets-manager secrets export`,usage:`[flags]`,flags:[{name:`--env`,short:`-e`,value:`\u003cstring>`,type:`string`,default:`dev`,description:\"The environment to export secrets from, such as `dev`, `staging`, or `prod`. Defaults to `INFISICAL_ENVIRONMENT`, then the [default environment](/cli/project-config#set-the-environment) in `.infisical.yaml`, then `dev`.\"},{name:`--expand`,type:`bool`,default:`true`,description:\"Resolve secret references and shell parameter expansions in secret values. Pass `--expand=false` to export values exactly as stored.\"},{name:`--format`,short:`-f`,value:`\u003cstring>`,type:`string`,default:`dotenv`,description:\"The output format: `dotenv`, `dotenv-export`, `dotenv-eval`, `csv`, `json`, or `yaml`.\"},{name:`--include-imports`,type:`bool`,default:`true`,description:`Include secrets imported into the environment from other environments or folders.`},{name:`--output-file`,short:`-o`,value:`\u003cstring>`,type:`string`,description:\"A file or directory to write to, instead of standard output. In a directory, the CLI writes `.env`, `secrets.json`, `secrets.csv`, or `secrets.yaml`, depending on the format. A file name without an extension gets the format's extension, and missing parent directories are created.\"},{name:`--path`,value:`\u003cstring>`,type:`string`,default:`/`,description:\"The folder to export secrets from. Defaults to `INFISICAL_SECRET_PATH`, then the [default folder](/cli/project-config#set-the-folder) in `.infisical.yaml`, then `/`.\"},{name:`--projectId`,value:`\u003cstring>`,type:`string`,description:\"The project to export secrets from. Required when you authenticate with a machine identity. Can also be set with `INFISICAL_PROJECT_ID`.\"},{name:`--secret-overriding`,type:`bool`,default:`true`,description:\"Export your personal secrets in place of shared secrets with the same name. Pass `--secret-overriding=false` to export only shared secrets.\"},{name:`--tags`,short:`-t`,value:`\u003cstring>`,type:`string`,description:`Only export secrets with these tag slugs, separated by commas.`},{name:`--template`,value:`\u003cstring>`,type:`string`,description:\"The path to a Go template to render and print instead of a file format. The template chooses its own project, environment, and folder, so every other `export` flag except `--token` is ignored.\"},{name:`--token`,value:`\u003cstring>`,type:`string`,description:\"A machine identity access token to authenticate with, instead of your login. Without it, the CLI reads `INFISICAL_UNIVERSAL_AUTH_ACCESS_TOKEN`, then `INFISICAL_TOKEN`.\"}],examples:[{title:`Write a .env file`,code:`infisical secrets-manager secrets export --output-file=./.env`},{title:`Export production secrets as JSON`,code:`infisical secrets-manager secrets export --env=prod --format=json > secrets.json`},{title:`Load secrets into the current shell`,code:`eval \"$(infisical secrets-manager secrets export --format=dotenv-eval)\"`},{title:`Render secrets through a template`,code:`infisical secrets-manager secrets export --template=./secrets.tmpl`}],children:[_jsxs(_components.p,{children:[`Print an environment’s secrets in a file format such as `,_jsx(_components.code,{children:`.env`}),` or JSON, for tools that read configuration from a file. Output goes to standard output unless you pass `,_jsx(_components.code,{children:`--output-file`}),`.`]}),_jsxs(_components.p,{children:[`This command used to be `,_jsx(_components.code,{children:`infisical export`}),`, which still works.`]}),_jsxs(_components.p,{children:[_jsx(_components.code,{children:`dotenv`}),` writes each secret as `,_jsx(_components.code,{children:`KEY='value'`}),`, and `,_jsx(_components.code,{children:`dotenv-export`}),` adds `,_jsx(_components.code,{children:`export`}),` in front. Neither escapes quotes inside values. `,_jsx(_components.code,{children:`dotenv-eval`}),` also writes `,_jsx(_components.code,{children:`export`}),` statements, but quotes each value so the output is safe to load with `,_jsx(_components.code,{children:`eval`}),` or `,_jsx(_components.code,{children:`source`}),`. No format escapes secret names, so load output into a shell only when every name is a valid shell variable name.`]}),_jsxs(_components.p,{children:[_jsx(_components.code,{children:`--template`}),` takes a Go template that fetches secrets with the functions the `,_jsx(_components.a,{href:`/integrations/platforms/infisical-agent#available-secret-template-functions`,children:`Infisical Agent`}),` provides, such as `,_jsx(_components.code,{children:`listSecrets`}),` and `,_jsx(_components.code,{children:`getSecretByName`}),`.`]})]})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsxs(CLICommand,{id:`secrets-manager-secrets-get`,command:`secrets-manager secrets get`,usage:`[name]... [flags]`,args:[{name:`name`,usage:`[name]...`,repeatable:true,description:\"The names of the secrets to print. Without names, the command prints every secret in `--path`.\"}],flags:[{name:`--expand`,type:`bool`,default:`true`,description:`Resolve secret references and shell parameter expansions in secret values.`},{name:`--include-imports`,type:`bool`,default:`true`,description:`Also look for the names among secrets imported from other environments or folders.`},{name:`--output`,short:`-o`,value:`\u003cstring>`,type:`string`,description:\"Print the secrets as `json`, `yaml`, or `dotenv` instead of a table.\"},{name:`--path`,value:`\u003cstring>`,type:`string`,default:`/`,description:\"The folder to read from. Defaults to `INFISICAL_SECRET_PATH`, then the [default folder](/cli/project-config#set-the-folder) in `.infisical.yaml`, then `/`.\"},{name:`--plain`,type:`bool`,description:`Print only the values, one per line.`},{name:`--projectId`,value:`\u003cstring>`,type:`string`,description:\"The project to read from. Required when you authenticate with a machine identity. Can also be set with `INFISICAL_PROJECT_ID`.\"},{name:`--recursive`,type:`bool`,description:\"Also look for the names in every subfolder of `--path`.\"},{name:`--secret-overriding`,type:`bool`,default:`true`,description:\"Return your personal secret in place of a shared secret with the same name. Pass `--secret-overriding=false` to return only shared secrets.\"},{name:`--token`,value:`\u003cstring>`,type:`string`,description:\"A machine identity access token to authenticate with, instead of your login. Without it, the CLI reads `INFISICAL_UNIVERSAL_AUTH_ACCESS_TOKEN`, then `INFISICAL_TOKEN`.\"}],inheritedFlags:[{name:`--env`,value:`\u003cstring>`,type:`string`,default:`dev`,description:`The environment to read from.`},{name:`--tags`,short:`-t`,value:`\u003cstring>`,type:`string`,description:`Only return secrets with these tag slugs, separated by commas.`}],examples:[{title:`List the secrets in a folder`,code:`infisical secrets-manager secrets get --path=/backend`},{title:`Show two secrets`,code:`infisical secrets-manager secrets get DOMAIN PORT`},{title:`Read a value into a variable`,code:`API_KEY=$(infisical secrets-manager secrets get API_KEY --plain --silent)`},{title:`Print production secrets as JSON`,code:`infisical secrets-manager secrets get DB_HOST DB_PASSWORD --env=prod --output=json`}],children:[_jsxs(_components.p,{children:[`Print the secrets you name, or every secret in `,_jsx(_components.code,{children:`--path`}),` if you don’t name any. A name that doesn’t exist prints as `,_jsx(_components.code,{children:`*not found*`}),`.`]}),_jsxs(_components.p,{children:[`In scripts, pass `,_jsx(_components.code,{children:`--plain --silent`}),` to print only the values, with no other output.`]})]})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsxs(CLICommand,{id:`secrets-manager-secrets-update`,command:`secrets-manager secrets update`,usage:`\u003cname=value>... [flags]`,args:[{name:`name=value`,usage:`\u003cname=value>...`,repeatable:true,description:\"A secret to change, with its new value. Use `NAME=@path/to/file` to read the value from a file, and `NAME=\\\\@value` for a value that starts with `@`. Required unless you pass `--file`.\"}],flags:[{name:`--file`,value:`\u003cstring>`,type:`string`,description:\"A `.env` or YAML file to read secrets from, instead of arguments. Lines starting with `#` or `//` are comments.\"},{name:`--output`,short:`-o`,value:`\u003cstring>`,type:`string`,description:\"Print the updated secrets as `json`, `yaml`, or `dotenv` instead of a table.\"},{name:`--path`,value:`\u003cstring>`,type:`string`,default:`/`,description:\"The folder that holds the secrets. Defaults to `INFISICAL_SECRET_PATH`, then the [default folder](/cli/project-config#set-the-folder) in `.infisical.yaml`, then `/`.\"},{name:`--projectId`,value:`\u003cstring>`,type:`string`,description:\"The project that holds the secrets. Defaults to `INFISICAL_PROJECT_ID`, then the project linked in `.infisical.yaml`. A service token always writes to its own project, and fails with `token_project_mismatch` if you select another one.\"},{name:`--show-values`,type:`bool`,description:`Show secret values in the result table instead of masking them.`},{name:`--tag`,value:`\u003cstringArray>`,type:`stringArray`,description:`A tag to attach, created if it doesn't exist. Repeat the flag for several tags. The tags replace the secret's existing tags.`},{name:`--token`,value:`\u003cstring>`,type:`string`,description:\"A machine identity access token or service token to authenticate with, instead of your login. Without it, the CLI reads `INFISICAL_UNIVERSAL_AUTH_ACCESS_TOKEN`, then `INFISICAL_TOKEN`.\"},{name:`--type`,value:`\u003cstring>`,type:`string`,default:`shared`,description:\"`shared` for secrets everyone on the project sees, or `personal` for secrets that override them only for you.\"}],inheritedFlags:[{name:`--env`,value:`\u003cstring>`,type:`string`,default:`dev`,description:`The environment that holds the secrets.`},{name:`--tags`,short:`-t`,value:`\u003cstring>`,type:`string`,description:\"Has no effect on this command. Use `--tag` to attach tags.\"}],examples:[{title:`Change a secret's value`,code:`infisical secrets-manager secrets update API_URL=https://api.example.com --env=prod`},{title:`Change a value and replace its tags`,code:`infisical secrets-manager secrets update DB_URL=postgres://db/app --tag=backend --env=prod`},{title:`Update secrets from a .env file`,code:`infisical secrets-manager secrets update --file=./.env`}],children:[_jsxs(_components.p,{children:[`Change the values of secrets that already exist. If any of them doesn’t exist, the command fails with `,_jsx(_components.code,{children:`secret_not_found`}),` and writes none of them. To add a secret, run `,_jsx(_components.a,{href:`/cli/reference#secrets-manager-secrets-create`,children:`infisical secrets-manager secrets create`}),`. The result table masks values unless you pass `,_jsx(_components.code,{children:`--show-values`}),`.`]}),_jsxs(_components.p,{children:[`Your shell saves the values you pass on the command line in its history file. To keep them out, pass `,_jsx(_components.code,{children:`--file`}),` or `,_jsx(_components.code,{children:`NAME=@path`}),`, or `,_jsx(_components.a,{href:`/cli/faq`,children:`set your shell to skip these commands`}),`.`]})]})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsx(CLICommand,{id:`service-token`,command:`service-token`,children:_jsxs(_components.p,{children:[`Manage service tokens. Service tokens are deprecated and will be removed in a future release. Use a `,_jsx(_components.a,{href:`/documentation/platform/identities/machine-identities`,children:`machine identity`}),` instead, and log in as it with `,_jsx(_components.a,{href:`/cli/reference#login`,children:`infisical login`}),`.`]})})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsxs(CLICommand,{id:`service-token-create`,command:`service-token create`,usage:`[flags]`,flags:[{name:`--access-level`,short:`-a`,value:`\u003cstringSlice>`,type:`stringSlice`,required:true,description:\"What the token can do: `read`, `write`, or both. Repeat the flag or separate the values with commas.\"},{name:`--expiry-seconds`,short:`-e`,value:`\u003cint>`,type:`int`,default:`86400`,description:\"How long the token lasts, in seconds from now. Pass `0` for a token that never expires.\"},{name:`--name`,short:`-n`,value:`\u003cstring>`,type:`string`,default:`Service token generated via CLI`,description:`The token's name.`},{name:`--projectId`,value:`\u003cstring>`,type:`string`,description:\"The project to create the token for. Without it, the CLI uses the project in `.infisical.yaml`. Can also be set with `INFISICAL_PROJECT_ID`.\"},{name:`--scope`,short:`-s`,value:`\u003cstringSlice>`,type:`stringSlice`,required:true,description:\"An environment and folder the token can access, as `\u003cenv-slug>:\u003cfolder-path>`, such as `dev:/backend`. The folder path can be a glob pattern. Repeat the flag for several scopes.\"},{name:`--token-only`,type:`bool`,description:`Print only the token, to standard output, with no other details.`}],examples:[{title:`Create a read-only token for two folders`,code:`infisical service-token create --scope=dev:/global --scope=dev:/backend --access-level=read`},{title:`Create a read and write token that never expires`,code:`infisical service-token create --scope='prod:/**' --access-level=read,write --expiry-seconds=0`},{title:`Capture the token in a variable`,code:`TOKEN=$(infisical service-token create --scope=dev:/ --access-level=read --token-only)`}],children:[_jsxs(_components.p,{children:[`Create a service token for a project with your user login. Service tokens are deprecated; create a `,_jsx(_components.a,{href:`/documentation/platform/identities/machine-identities`,children:`machine identity`}),` instead.`]}),_jsxs(_components.p,{children:[`Without `,_jsx(_components.code,{children:`--token-only`}),`, the command prints the token’s name, project, access, scopes, and the token itself to standard error, so capturing standard output gets nothing.`]})]})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsx(CLICommand,{id:`ssh`,command:`ssh`,children:_jsx(Warning,{children:_jsxs(_components.p,{children:[`Infisical SSH has been removed, so these commands no longer work. SSH access is now part of Infisical PAM: set up an `,_jsx(_components.a,{href:`/documentation/platform/pam/accounts/ssh`,children:`SSH account`}),`, then connect to it with `,_jsx(_components.a,{href:`/cli/reference#pam-access`,children:`infisical pam access`}),`.`]})})})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsx(CLICommand,{id:`ssh-add-host`,command:`ssh add-host`,usage:`[flags]`,flags:[{name:`--alias`,value:`\u003cstring>`,type:`string`,description:\"A friendly name for the host, shown instead of the hostname when `infisical ssh connect` asks you to pick one.\"},{name:`--configure-sshd`,type:`bool`,description:\"Add `TrustedUserCAKeys`, `HostKey`, and `HostCertificate` entries to `/etc/ssh/sshd_config`. Requires `--write-user-ca-to-file` and `--write-host-cert-to-file`. The command doesn't restart `sshd`.\"},{name:`--force`,type:`bool`,description:\"Overwrite the user CA file, the host certificate, and existing `sshd_config` entries instead of stopping when they already exist.\"},{name:`--hostname`,value:`\u003cstring>`,type:`string`,required:true,description:`The host's hostname.`},{name:`--projectId`,value:`\u003cstring>`,type:`string`,required:true,description:\"The project to register the host in. Can also be set with `INFISICAL_PROJECT_ID`.\"},{name:`--token`,value:`\u003cstring>`,type:`string`,description:\"A machine identity access token to authenticate with, instead of your login. Without it, the CLI reads `INFISICAL_UNIVERSAL_AUTH_ACCESS_TOKEN`, then `INFISICAL_TOKEN`.\"},{name:`--user-ca-out-file-path`,value:`\u003cstring>`,type:`string`,default:`/etc/ssh/infisical_user_ca.pub`,description:\"The file to write the user CA public key to, with `--write-user-ca-to-file`.\"},{name:`--write-host-cert-to-file`,type:`bool`,description:\"Have Infisical sign the host's public key and write the host certificate next to it, as `/etc/ssh/ssh_host_\u003ctype>_key-cert.pub`. The CLI uses the first host key it finds in `/etc/ssh`, checking `ed25519`, then `ecdsa`, then `rsa`.\"},{name:`--write-user-ca-to-file`,type:`bool`,description:\"Write the public key of the CA that signs user certificates to `--user-ca-out-file-path`, so `sshd` can trust certificates issued for this host.\"}],children:_jsx(Warning,{children:_jsxs(_components.p,{children:[`Removed along with Infisical SSH, so this command no longer works. See `,_jsx(_components.a,{href:`/cli/reference#ssh`,children:`infisical ssh`}),`.`]})})})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsx(CLICommand,{id:`ssh-connect`,command:`ssh connect`,usage:`[flags]`,flags:[{name:`--hostname`,value:`\u003cstring>`,type:`string`,description:`The host to connect to, matched exactly against its hostname. Without it, the CLI asks you to pick one of the hosts you can access.`},{name:`--login-user`,value:`\u003cstring>`,type:`string`,description:`The user to log in to the host as. It must be one of the host's login users. Without it, the CLI asks you to pick one.`},{name:`--out-file-path`,value:`\u003cstring>`,type:`string`,description:\"Write the private key, public key, and certificate to files instead of connecting. Pass a directory to name them `id_ed25519`, `id_ed25519.pub`, and `id_ed25519-cert.pub`, or a path ending in `-cert.pub` to name the certificate, with the keys next to it.\"},{name:`--token`,value:`\u003cstring>`,type:`string`,description:\"A machine identity access token to authenticate with, instead of your login. Without it, the CLI reads `INFISICAL_UNIVERSAL_AUTH_ACCESS_TOKEN`, then `INFISICAL_TOKEN`.\"},{name:`--write-host-ca-to-file`,type:`bool`,default:`true`,description:\"Add the host CA's public key to `~/.ssh/known_hosts` as a `@cert-authority` entry for the host, if it isn't there yet. Pass `--write-host-ca-to-file=false` to leave `known_hosts` unchanged.\"}],children:_jsx(Warning,{children:_jsxs(_components.p,{children:[`Removed along with Infisical SSH, so this command no longer works. To reach SSH hosts through Infisical, use `,_jsx(_components.a,{href:`/cli/reference#pam-access`,children:`infisical pam access`}),`. See `,_jsx(_components.a,{href:`/cli/reference#ssh`,children:`infisical ssh`}),`.`]})})})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsx(CLICommand,{id:`ssh-issue-credentials`,command:`ssh issue-credentials`,usage:`[flags]`,flags:[{name:`--addToAgent`,type:`bool`,description:\"Add the issued key and certificate to your SSH agent. Needs `SSH_AUTH_SOCK` to be set. Pass this, `--outFilePath`, or both.\"},{name:`--certType`,value:`\u003cstring>`,type:`string`,default:`user`,description:\"The kind of certificate to issue: `user` or `host`.\"},{name:`--certificateTemplateId`,value:`\u003cstring>`,type:`string`,required:true,description:`The ID of the SSH certificate template to issue against.`},{name:`--keyAlgorithm`,value:`\u003cstring>`,type:`string`,default:`RSA_2048`,description:\"The algorithm of the key pair to generate: `RSA_2048`, `RSA_4096`, `EC_prime256v1`, or `EC_secp384r1`.\"},{name:`--keyId`,value:`\u003cstring>`,type:`string`,description:`The key ID to put in the certificate.`},{name:`--outFilePath`,value:`\u003cstring>`,type:`string`,description:\"The directory to write the private key, public key, and certificate to. It's created if it doesn't exist. The files are named after the key algorithm, such as `id_rsa_2048`, `id_rsa_2048.pub`, and `id_rsa_2048-cert.pub`. Pass this, `--addToAgent`, or both.\"},{name:`--principals`,value:`\u003cstring>`,type:`string`,required:true,description:`The principals to issue the certificate for, separated by commas.`},{name:`--token`,value:`\u003cstring>`,type:`string`,description:\"A machine identity access token to authenticate with, instead of your login. Without it, the CLI reads `INFISICAL_UNIVERSAL_AUTH_ACCESS_TOKEN`, then `INFISICAL_TOKEN`.\"},{name:`--ttl`,value:`\u003cstring>`,type:`string`,description:`How long the certificate is valid for. Without it, the certificate template's default applies.`}],children:_jsx(Warning,{children:_jsxs(_components.p,{children:[`Removed along with Infisical SSH, so this command no longer works. See `,_jsx(_components.a,{href:`/cli/reference#ssh`,children:`infisical ssh`}),`.`]})})})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsx(CLICommand,{id:`ssh-sign-key`,command:`ssh sign-key`,usage:`[flags]`,flags:[{name:`--certType`,value:`\u003cstring>`,type:`string`,default:`user`,description:\"The kind of certificate to issue: `user` or `host`.\"},{name:`--certificateTemplateId`,value:`\u003cstring>`,type:`string`,required:true,description:`The ID of the SSH certificate template to sign against.`},{name:`--keyId`,value:`\u003cstring>`,type:`string`,description:`The key ID to put in the certificate.`},{name:`--outFilePath`,value:`\u003cstring>`,type:`string`,description:\"The file to write the certificate to. It must end in `-cert.pub`. Required with `--publicKey`. With `--publicKeyFilePath`, it defaults to the public key's path with `.pub` replaced by `-cert.pub`.\"},{name:`--principals`,value:`\u003cstring>`,type:`string`,required:true,description:`The principals to sign the certificate for, separated by commas.`},{name:`--publicKey`,value:`\u003cstring>`,type:`string`,description:\"The public key to sign, as text. Pass this or `--publicKeyFilePath`, not both.\"},{name:`--publicKeyFilePath`,value:`\u003cstring>`,type:`string`,description:\"The path to the public key file to sign. It must end in `.pub`. Pass this or `--publicKey`, not both.\"},{name:`--token`,value:`\u003cstring>`,type:`string`,description:\"A machine identity access token to authenticate with, instead of your login. Without it, the CLI reads `INFISICAL_UNIVERSAL_AUTH_ACCESS_TOKEN`, then `INFISICAL_TOKEN`.\"},{name:`--ttl`,value:`\u003cstring>`,type:`string`,description:`How long the certificate is valid for. Without it, the certificate template's default applies.`}],children:_jsx(Warning,{children:_jsxs(_components.p,{children:[`Removed along with Infisical SSH, so this command no longer works. See `,_jsx(_components.a,{href:`/cli/reference#ssh`,children:`infisical ssh`}),`.`]})})})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsx(CLICommand,{id:`token`,command:`token`,children:_jsxs(_components.p,{children:[`Manage machine identity access tokens. The only subcommand is `,_jsx(_components.a,{href:`/cli/reference#token-renew`,children:`infisical token renew`}),`.`]})})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsxs(CLICommand,{id:`token-renew`,command:`token renew`,usage:`\u003ctoken>`,args:[{name:`token`,usage:`\u003ctoken>`,required:true,description:`The machine identity access token to renew.`}],examples:[{title:`Renew an access token`,code:`infisical token renew \u003caccess-token>`},{title:`Renew a token on another instance`,code:`infisical token renew \u003caccess-token> --domain=https://eu.infisical.com`}],children:[_jsxs(_components.p,{children:[`Renew a machine identity access token, such as one printed by `,_jsx(_components.code,{children:`infisical login --method=universal-auth`}),`, and print the renewed token. How long a token can be renewed for is set by the machine identity’s `,_jsx(_components.strong,{children:`Access Token TTL`}),` and `,_jsx(_components.strong,{children:`Access Token Max TTL`}),`. Service tokens, which start with `,_jsx(_components.code,{children:`st.`}),`, can’t be renewed.`]}),_jsxs(_components.p,{children:[`The command doesn’t use your login profile, so for any instance other than US Cloud, pass `,_jsx(_components.code,{children:`--domain`}),` or set `,_jsx(_components.code,{children:`INFISICAL_DOMAIN`}),`.`]})]})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsx(CLICommand,{id:`user`,command:`user`,children:_jsxs(_components.p,{children:[`Print a profile’s session token, pick the default profile from a list, or move a profile to another instance. For everything else, use `,_jsx(_components.a,{href:`/cli/reference#profile`,children:`infisical profile`}),`.`]})})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsx(CLICommand,{id:`user-get`,command:`user get`,children:_jsxs(_components.p,{children:[`Print details of a login profile. The only subcommand is `,_jsx(_components.a,{href:`/cli/reference#user-get-token`,children:`infisical user get token`}),`.`]})})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsxs(CLICommand,{id:`user-get-token`,command:`user get token`,usage:`[flags]`,flags:[{name:`--plain`,type:`bool`,description:`Print only the access token, with no labels, session ID, or expiry.`}],examples:[{title:`Show the session token and its expiry`,code:`infisical user get token`},{title:`Capture the token in a variable`,code:`TOKEN=$(infisical user get token --plain)`},{title:`Get the token of a specific profile`,code:`infisical user get token --profile acme --plain`}],children:[_jsxs(_components.p,{children:[`Print the access token of the profile in effect, along with its session ID, expiry time, and remaining lifetime. Pass `,_jsx(_components.code,{children:`--profile`}),` to read another profile’s token, or `,_jsx(_components.code,{children:`--org`}),` to get a token for a different organization. See `,_jsx(_components.a,{href:`/cli/reference#profile`,children:`infisical profile`}),` for how the profile in effect is chosen.`]}),_jsxs(_components.p,{children:[`If the session has expired, or you have no profile yet, the CLI runs `,_jsx(_components.code,{children:`infisical login`}),` first.`]})]})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsxs(CLICommand,{id:`user-switch`,command:`user switch`,examples:[{title:`Pick the default profile from a list`,code:`infisical user switch`}],children:[_jsxs(_components.p,{children:[`Pick the machine’s default profile from a list of your profiles, each shown with its account, organization, and instance. This does the same as `,_jsx(_components.a,{href:`/cli/reference#profile-use`,children:`infisical profile use`}),`, which takes the profile name instead of asking.`]}),_jsxs(_components.p,{children:[`A terminal pinned with `,_jsx(_components.a,{href:`/cli/reference#profile-pin`,children:`infisical profile pin`}),` or a directory bound with `,_jsx(_components.a,{href:`/cli/reference#profile-bind`,children:`infisical profile bind`}),` keeps using its own profile.`]})]})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsx(CLICommand,{id:`user-update`,command:`user update`,children:_jsxs(_components.p,{children:[`Change a login profile. The only subcommand is `,_jsx(_components.a,{href:`/cli/reference#user-update-domain`,children:`infisical user update domain`}),`.`]})})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsxs(CLICommand,{id:`user-update-domain`,command:`user update domain`,examples:[{title:`Move a profile to another instance`,code:`infisical user update domain`}],children:[_jsx(_components.p,{children:`Point a profile at a different Infisical instance, such as moving it from Infisical Cloud to your self-hosted instance. The command asks which profile to change, then for the new instance’s URL. Only the profile you pick changes, even when other profiles use the same account and instance.`}),_jsxs(_components.p,{children:[`A session issued by the old instance isn’t valid on the new one, so the CLI clears the profile’s stored credentials and its organization. Sign in again with `,_jsx(_components.code,{children:`infisical login --profile \u003cname> --domain \u003curl>`}),`.`]})]})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsxs(CLICommand,{id:`vault`,command:`vault`,examples:[{title:`Show the vault in use`,code:`infisical vault`}],children:[_jsxs(_components.p,{children:[`Show where the CLI stores your login credentials, and list the vaults you can switch to with `,_jsx(_components.a,{href:`/cli/reference#vault-set`,children:`infisical vault set`}),`.`]}),_jsxs(_components.p,{children:[`There are two vaults. `,_jsx(_components.code,{children:`auto`}),`, the default, uses your system keyring: the macOS Keychain, Windows Credential Manager, or the Secret Service on Linux. If the CLI can’t write to the system keyring the first time it stores credentials, it switches to `,_jsx(_components.code,{children:`file`}),` on its own. `,_jsx(_components.code,{children:`file`}),` stores credentials encrypted in `,_jsx(_components.code,{children:`~/infisical-keyring`}),`, with a random passphrase kept in the CLI’s config file, `,_jsx(_components.code,{children:`~/.infisical/infisical-config.json`}),`.`]})]})}),_jsx(_MdxComponentBoundary,{name:`CLICommand`,children:_jsxs(CLICommand,{id:`vault-set`,command:`vault set`,usage:`\u003cvault>`,args:[{name:`vault`,usage:`\u003cvault>`,required:true,description:\"The vault to store credentials in: `auto` for the system keyring, or `file` for an encrypted file.\"}],examples:[{title:`Store credentials in an encrypted file`,code:`infisical vault set file`},{title:`Go back to the system keyring`,code:`infisical vault set auto`}],children:[_jsxs(_components.p,{children:[`Change where the CLI stores your login credentials. See `,_jsx(_components.a,{href:`/cli/reference#vault`,children:`infisical vault`}),` for what each vault is.`]}),_jsxs(_components.p,{children:[`Credentials in the previous vault can’t be read from the new one, so switching removes every profile, the default profile, and every directory binding. Log in again with `,_jsx(_components.a,{href:`/cli/reference#login`,children:`infisical login`}),` afterwards. Credentials already in the previous vault aren’t deleted.`]})]})})]})})})]})}function MDXContent(props={}){const{wrapper:MDXLayout}={..._provideComponents(),...props.components};return MDXLayout?_jsx(MDXLayout,{...props,children:_jsx(_createMdxContent,{...props})}):_createMdxContent(props)}return{CLICommand,CLIPage,default:MDXContent};function _missingMdxReference(id,component){throw new Error(`Expected `+(component?`component`:`object`)+\" `\"+id+\"` to be defined: you likely forgot to import, pass, or provide it.\")}","frontmatter":{},"scope":{"codeStyling":"dark","config":{},"pageMetadata":{"title":"CLI reference","hidden":true,"description":"Every Infisical CLI command, with its flags and examples.","mode":"frame","href":"/cli/reference","hiddenSetByFrontmatter":true}}},"mdxSourceWithNoJs":null,"noJsSplices":[[146,13040,")=>null;const CLIPage=()=>null;function "]]},"mdxExtracts":{"tableOfContents":[],"codeExamples":{}},"jsLinks":["/docs/_mintlify/custom/infisical/b13a5df316344f52/unify.js","/docs/_mintlify/custom/infisical/bc9046d1d11b5448/field-name-copy.js","/docs/_mintlify/custom/infisical/fdfdc80c034be768/cli-reference-nav.js"],"subdomain":"infisical","siteName":"Infisical","title":"CLI reference - Infisical","navMaps":{"firstHrefInVersion":{},"firstHrefInLanguage":{}},"lastModified":"2026-11-06T00:07:13.906Z","originalFileLocation":"cli/reference.mdx"},"headHtml":"\u003cscript data-mint-head>(function(){var d=document.documentElement,p=null;if(!p){try{p=localStorage.getItem(\"isDarkMode\")}catch(e){}if(p==='true')p='dark';else if(p==='false')p='light';if(p!=='light'\u0026\u0026p!=='dark'\u0026\u0026p!=='system')p=\"light\"}var r=p==='system'?(matchMedia(\"(prefers-color-scheme: dark)\").matches?'dark':'light'):p;d.classList.remove(r==='dark'?'light':'dark');d.classList.add(r);d.setAttribute(\"data-theme-preference\",p)})();\u003c/script>\u003cmeta data-mint-head name=\"description\" content=\"Every Infisical CLI command, with its flags and examples.\">\u003cmeta data-mint-head name=\"application-name\" content=\"Infisical\">\u003cmeta data-mint-head name=\"generator\" content=\"Mintlify\">\u003cmeta data-mint-head name=\"robots\" content=\"noindex\">\u003clink data-mint-head rel=\"apple-touch-icon\" type=\"image/x-icon\" sizes=\"180x180\" href=\"https://mintlify.s3.us-west-1.amazonaws.com/infisical/favicon.ico\">\u003clink data-mint-head rel=\"icon\" type=\"image/x-icon\" sizes=\"32x32\" href=\"https://mintlify.s3.us-west-1.amazonaws.com/infisical/favicon.ico\">\u003clink data-mint-head rel=\"icon\" type=\"image/x-icon\" sizes=\"16x16\" href=\"https://mintlify.s3.us-west-1.amazonaws.com/infisical/favicon.ico\">\u003clink data-mint-head rel=\"shortcut icon\" type=\"image/x-icon\" href=\"https://mintlify.s3.us-west-1.amazonaws.com/infisical/favicon.ico\">\u003cmeta data-mint-head property=\"og:title\" content=\"CLI reference - Infisical\">\u003cmeta data-mint-head property=\"og:description\" content=\"Every Infisical CLI command, with its flags and examples.\">\u003cmeta data-mint-head property=\"og:site_name\" content=\"Infisical\">\u003cmeta data-mint-head property=\"og:url\" content=\"https://infisical.com/docs/cli/reference\">\u003cmeta data-mint-head property=\"og:type\" content=\"website\">\u003cmeta data-mint-head property=\"og:image\" content=\"https://infisical.mintlify.site/docs/_mintlify/api/og/v2?division=Command+reference\u0026amp;title=CLI+reference\u0026amp;description=Every+Infisical+CLI+command%2C+with+its+flags+and+examples.\u0026amp;theme=48a50df3ba2e68203e367e83\u0026amp;signature=ec7755181738f4b7ef72076085e944b13be481f42a567cb13d29e887417ec2ca\">\u003cmeta data-mint-head property=\"og:image:width\" content=\"1200\">\u003cmeta data-mint-head property=\"og:image:height\" content=\"630\">\u003cmeta data-mint-head name=\"twitter:card\" content=\"summary_large_image\">\u003cmeta data-mint-head name=\"twitter:title\" content=\"CLI reference - Infisical\">\u003cmeta data-mint-head name=\"twitter:description\" content=\"Every Infisical CLI command, with its flags and examples.\">\u003cmeta data-mint-head name=\"twitter:image\" content=\"https://infisical.mintlify.site/docs/_mintlify/api/og/v2?division=Command+reference\u0026amp;title=CLI+reference\u0026amp;description=Every+Infisical+CLI+command%2C+with+its+flags+and+examples.\u0026amp;theme=48a50df3ba2e68203e367e83\u0026amp;signature=ec7755181738f4b7ef72076085e944b13be481f42a567cb13d29e887417ec2ca\">\u003cmeta data-mint-head name=\"twitter:image:width\" content=\"1200\">\u003cmeta data-mint-head name=\"twitter:image:height\" content=\"630\">\u003cmeta data-mint-head name=\"msapplication-config\" content=\"https://mintlify.s3.us-west-1.amazonaws.com/infisical/_generated/favicon/browserconfig.xml?v=3\">\u003cmeta data-mint-head name=\"apple-mobile-web-app-title\" content=\"Infisical\">\u003cmeta data-mint-head name=\"msapplication-TileColor\" content=\"#26272b\">\u003clink data-mint-head rel=\"canonical\" href=\"https://infisical.com/docs/cli/reference\">\u003clink data-mint-head rel=\"alternate\" type=\"application/xml\" href=\"/docs/sitemap.xml\">\u003clink data-mint-head rel=\"alternate\" type=\"text/markdown\" href=\"/docs/cli/reference.md\">\u003cscript data-mint-head type=\"application/ld+json\">{\"@context\":\"https://schema.org\",\"@graph\":[{\"@type\":\"Organization\",\"@id\":\"https://infisical.com/#organization\",\"name\":\"Infisical\",\"url\":\"https://infisical.com\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https://mintlify.s3.us-west-1.amazonaws.com/infisical/logo/light.svg\"}},{\"@type\":\"WebSite\",\"@id\":\"https://infisical.com/docs#website\",\"name\":\"Infisical\",\"url\":\"https://infisical.com/docs\",\"publisher\":{\"@id\":\"https://infisical.com/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https://infisical.com/docs/cli/reference#webpage\",\"url\":\"https://infisical.com/docs/cli/reference\",\"name\":\"CLI reference\",\"description\":\"Every Infisical CLI command, with its flags and examples.\",\"dateModified\":\"2026-11-06T00:07:13.906Z\",\"isPartOf\":{\"@id\":\"https://infisical.com/docs#website\"},\"breadcrumb\":{\"@id\":\"https://infisical.com/docs/cli/reference#breadcrumb\"}},{\"@type\":\"BreadcrumbList\",\"@id\":\"https://infisical.com/docs/cli/reference#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Infisical\",\"item\":\"https://infisical.com/docs\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"CLI reference\",\"item\":\"https://infisical.com/docs/cli/reference\"}]},{\"@type\":[\"Article\",\"TechArticle\"],\"@id\":\"https://infisical.com/docs/cli/reference#article\",\"headline\":\"CLI reference\",\"name\":\"CLI reference\",\"description\":\"Every Infisical CLI command, with its flags and examples.\",\"url\":\"https://infisical.com/docs/cli/reference\",\"mainEntityOfPage\":{\"@id\":\"https://infisical.com/docs/cli/reference#webpage\"},\"dateModified\":\"2026-11-06T00:07:13.906Z\",\"publisher\":{\"@id\":\"https://infisical.com/#organization\"},\"isPartOf\":{\"@id\":\"https://infisical.com/docs#website\"}}]}\u003c/script>\u003cscript data-mint-head type=\"application/ld+json\">{\"@context\":\"https://schema.org\",\"@type\":\"WebSite\",\"name\":\"Infisical\",\"creator\":{\"@type\":\"Organization\",\"name\":\"Mintlify\",\"url\":\"https://mintlify.com\"}}\u003c/script>","siteName":"Infisical","nav":{"global":null,"tabs":[{"tab":"Get started","pages":[{"title":"Get started","href":"/documentation/getting-started/overview"}]},{"tab":"Products","menu":[{"item":"Secrets Management","icon":"key","pages":[{"title":"Secrets Management","href":"/documentation/platform/secrets-mgmt/overview"}]},{"item":"Certificate Management","icon":"file-key","pages":[{"title":"Certificate Management","href":"/documentation/platform/pki/overview"}]},{"item":"Privileged Access Management (PAM)","icon":"users","pages":[{"title":"Privileged Access Management (PAM)","href":"/documentation/platform/pam/overview"}]},{"item":"Agent Vault","icon":"vault","pages":[{"title":"Agent Vault","href":"/documentation/platform/agent-vault/overview"}]},{"item":"Key Management Service (KMS)","icon":"lock","pages":[{"title":"Key Management Service (KMS)","href":"/documentation/platform/kms/overview"}]},{"item":"Secret Scanning","icon":"radar","pages":[{"title":"Secret Scanning","href":"/documentation/platform/secret-scanning/overview"}]}],"pages":[{"title":"Products","href":"/documentation/platform/secrets-mgmt/overview"}]},{"tab":"Platform","menu":[{"item":"Organizations","icon":"building","pages":[{"title":"Organizations","href":"/documentation/platform/organization"}]},{"item":"Identity and access","icon":"id-card","pages":[{"title":"Identity and access","href":"/documentation/platform/identities/overview"}]},{"item":"App connections","icon":"plug","pages":[{"title":"App connections","href":"/integrations/app-connections/overview"}]},{"item":"Networking","icon":"network","pages":[{"title":"Networking","href":"/documentation/platform/gateways/overview"}]},{"item":"Self-hosting","icon":"server","pages":[{"title":"Self-hosting","href":"/self-hosting/overview"}]},{"item":"Internals","icon":"workflow","pages":[{"title":"Internals","href":"/internals/overview"}]},{"item":"Contributing","icon":"git-pull-request","pages":[{"title":"Contributing","href":"/contributing/getting-started/overview"}]}],"pages":[{"title":"Platform","href":"/documentation/platform/organization"}]},{"tab":"Reference","icon":{"name":"code","library":"lucide"},"menu":[{"item":"CLI","icon":"terminal","pages":[{"title":"Infisical CLI","sidebarTitle":"CLI","icon":"terminal","href":"/cli/overview"},{"title":"Migrate off Cloudsmith","href":"/cli/cloudsmith-migration"},{"group":"Get started","pages":[{"title":"Install the CLI","sidebarTitle":"Install","href":"/cli/install"},{"title":"CLI quickstart","sidebarTitle":"Quickstart","href":"/cli/usage"},{"title":"Upgrade the CLI","sidebarTitle":"Upgrade","href":"/cli/upgrade"},{"title":"CLI project configuration","sidebarTitle":"Project configuration","href":"/cli/project-config"},{"title":"Infisical CLI FAQ","sidebarTitle":"FAQ","href":"/cli/faq"},{"title":"Troubleshoot CLI errors","sidebarTitle":"Troubleshooting errors","description":"Find out why a CLI command failed.","href":"/cli/troubleshooting"}]},{"group":"Command reference","pages":[{"title":"CLI reference","hidden":true,"mode":"frame","href":"/cli/reference"},{"title":"Global flags","url":"/cli/reference#global-flags","description":null,"href":"/cli/reference/global-flags"},{"title":"infisical agent","url":"/cli/reference#agent","href":"/cli/reference/agent"},{"title":"infisical agent-vault","url":"/cli/reference#agent-vault","href":"/cli/reference/agent-vault"},{"title":"infisical bootstrap","url":"/cli/reference#bootstrap","href":"/cli/reference/bootstrap"},{"title":"infisical cert-manager","url":"/cli/reference#cert-manager","href":"/cli/reference/cert-manager"},{"title":"infisical gateway","url":"/cli/reference#gateway","href":"/cli/reference/gateway"},{"title":"infisical init","url":"/cli/reference#init","href":"/cli/reference/init"},{"title":"infisical kmip","url":"/cli/reference#kmip","href":"/cli/reference/kmip"},{"title":"infisical login","url":"/cli/reference#login","href":"/cli/reference/login"},{"title":"infisical logout","url":"/cli/reference#logout","href":"/cli/reference/logout"},{"title":"infisical migrate-config","url":"/cli/reference#migrate-config","href":"/cli/reference/migrate-config"},{"title":"infisical org","url":"/cli/reference#org","href":"/cli/reference/org"},{"title":"infisical pam","url":"/cli/reference#pam","href":"/cli/reference/pam"},{"title":"infisical profile","url":"/cli/reference#profile","href":"/cli/reference/profile"},{"title":"infisical proxy","url":"/cli/reference#proxy","href":"/cli/reference/proxy"},{"title":"infisical relay","url":"/cli/reference#relay","href":"/cli/reference/relay"},{"title":"infisical reset","url":"/cli/reference#reset","href":"/cli/reference/reset"},{"title":"infisical scan","url":"/cli/reference#scan","href":"/cli/reference/scan"},{"group":"infisical secrets-manager","expanded":true,"pages":[{"title":"infisical secrets-manager","sidebarTitle":"Overview","url":"/cli/reference#secrets-manager","href":"/cli/reference/secrets-manager"},{"title":"infisical secrets-manager dynamic-secrets","sidebarTitle":"dynamic-secrets","url":"/cli/reference#secrets-manager-dynamic-secrets","href":"/cli/reference/secrets-manager/dynamic-secrets"},{"title":"infisical secrets-manager environments","sidebarTitle":"environments","url":"/cli/reference#secrets-manager-environments","href":"/cli/reference/secrets-manager/environments"},{"title":"infisical secrets-manager folders","sidebarTitle":"folders","url":"/cli/reference#secrets-manager-folders","href":"/cli/reference/secrets-manager/folders"},{"title":"infisical secrets-manager projects","sidebarTitle":"projects","url":"/cli/reference#secrets-manager-projects","href":"/cli/reference/secrets-manager/projects"},{"title":"infisical secrets-manager run","sidebarTitle":"run","url":"/cli/reference#secrets-manager-run","href":"/cli/reference/secrets-manager/run"},{"title":"infisical secrets-manager secrets","sidebarTitle":"secrets","url":"/cli/reference#secrets-manager-secrets","href":"/cli/reference/secrets-manager/secrets"}]},{"title":"infisical service-token","url":"/cli/reference#service-token","href":"/cli/reference/service-token"},{"title":"infisical ssh","url":"/cli/reference#ssh","href":"/cli/reference/ssh"},{"title":"infisical token","url":"/cli/reference#token","href":"/cli/reference/token"},{"title":"infisical user","url":"/cli/reference#user","href":"/cli/reference/user"},{"title":"infisical vault","url":"/cli/reference#vault","href":"/cli/reference/vault"}]}]},{"item":"API","icon":"book-open","pages":[{"title":"API","href":"/api-reference/overview/introduction"}]},{"item":"SDKs","icon":"boxes","pages":[{"title":"SDKs","href":"/sdks/overview"}]}]}]},"basePath":"","title":"CLI reference - Infisical","buildId":"dpl_CEsowfH15TDzsBT2BFbX312Be4Ct","deploymentId":"dpl_CEsowfH15TDzsBT2BFbX312Be4Ct","dynamics":[],"chunks":[]}
