infisical secrets - Infisical

infisical secrets

Description

This command enables you to perform CRUD (create, read, update, delete) operations on secrets within your Infisical project. With it, you can view, create, update, and delete secrets in your environment.

Sub-commands

infisical secrets

Use this command to print out all of the secrets in your project

$ infisical secrets

Environment variables

INFISICAL_TOKEN

Used to fetch secrets via a machine identity apposed to logged in credentials. Simply, export this variable in the terminal before running this command.

# Example
export INFISICAL_TOKEN=$(infisical login --method=universal-auth --client-id=<identity-client-id> --client-secret=<identity-client-secret> --silent --plain) # --plain flag will output only the token, so it can be fed to an environment variable. --silent will disable any update messages.

Alternatively, you may use service tokens.

# Example
export INFISICAL_TOKEN=<service-token>

INFISICAL_DISABLE_UPDATE_CHECK

Used to disable the check for new CLI versions. This can improve the time it takes to run this command. Recommended for production environments.To use, simply export this variable in the terminal before running this command.

# Example
export INFISICAL_DISABLE_UPDATE_CHECK=true

Flags

--expand

Parse shell parameter expansions in your secretsDefault value: true

--projectId

The project ID to fetch secrets from. This is required when using a machine identity to authenticate.

# Example
infisical secrets --projectId=<project-id>

--env

Used to select the environment name on which actions should be taken onDefault value: dev

--path

The --path flag indicates which project folder secrets will be injected from.

# Example
infisical secrets --path="/" --env=dev

--plain

The --plain flag will output all your secret values without formatting, one per line.

# Example
infisical secrets --plain --silent

--silent

The --silent flag disables output of tip/info messages. Useful when running in scripts or CI/CD pipelines.

# Example
infisical secrets --silent

Can be used inline to replace INFISICAL_DISABLE_UPDATE_CHECK

infisical secrets get

This command allows you selectively print the requested secrets by name

$ infisical secrets get <secret-name-a> <secret-name-b> ...

# Example
$ infisical secrets get DOMAIN
$ infisical secrets get DOMAIN PORT

Flags

--env

Used to select the environment name on which actions should be taken onDefault value: dev

--plain

The --plain flag will output all your requested secret values without formatting, one per line.Default value: false

# Example
infisical secrets get FOO --plain
infisical secrets get FOO BAR --plain

# Fetch a single value and assign it to a variable
API_KEY=$(infisical secrets get FOO --plain --silent)

When running in CI/CD environments or in a script, set INFISICAL_DISABLE_UPDATE_CHECK=true or add the --silent flag. This will help hide any CLI info/debug output and only show the secret value.

--silent

The --silent flag disables output of tip/info messages. Useful when running in scripts or CI/CD pipelines.

# Example
infisical secrets get FOO --plain --silent

Can be used inline to replace INFISICAL_DISABLE_UPDATE_CHECK

--raw-value (deprecated)

Use --plain instead, as it supports single and multiple secrets.Used to print the plain value of a single requested secret without any table style.Default value: falseExample: infisical secrets get DOMAIN --raw-value

When running in CI/CD environments or in a script, set INFISICAL_DISABLE_UPDATE_CHECK=true or add the --silent flag. This will help hide any CLI info/debug output and only show the secret value.

infisical secrets set

This command allows you to set or update secrets in your environment. If the secret key provided already exists, its value will be updated with the new value. If the secret key does not exist, a new secret will be created using both the key and value provided.

$ infisical secrets set <key1=value1> <key2=value2> <key3=@/path/to/file>...

## Example
$ infisical secrets set STRIPE_API_KEY=sjdgwkeudyjwe DOMAIN=example.com HASH=jebhfbwe SECRET_PEM_KEY=@secret.pem

When setting secret values:

Use secretName=@path/to/file to load the secret value from a file
Use secretName=\@value if you need the literal ’@’ character at the beginning of your value

Example:

# Set a secret with the value loaded from a certificate file
$ secrets set CERTIFICATE=@/path/to/certificate.pem

# Set a secret with the literal value "@example.com"
$ secrets set email="\@example.com"

Flags

--env

Used to select the environment name on which actions should be taken onDefault value: dev

--path

Used to select the project folder in which the secrets will be set. This is useful when creating new secrets under a particular path.

# Example
infisical secrets set DOMAIN=example.com --path="common/backend"

--type

Used to select the type of secret to create. This could be either personal or shared (defaults to shared)

# Example
infisical secrets set DOMAIN=example.com --type=personal

--tag

Used to attach tags to the secret. If a tag does not exist on the server, it will be created automatically. This flag overrides any existing tags on the secret. If not provided, existing tags are kept intact. You can specify multiple --tag flags to add multiple tags.

# Example
infisical secrets set DOMAIN=example.com --tag=backend --tag=production

--file

Used to set secrets from a file, supporting both .env and YAML formats. The file path can be either absolute or relative to the current working directory.The file should contain secrets in the following formats:

key=value for .env files
key: value for YAML files

Comments can be written using # comment or // comment. Empty lines will be ignored during processing.

# Example
infisical secrets set --file="./.env"

infisical secrets delete

This command allows you to delete secrets by their name(s).

$ infisical secrets delete <keyName1> <keyName2>...

## Example
$ infisical secrets delete STRIPE_API_KEY DOMAIN HASH

Flags

--env

Used to select the environment name on which actions should be taken onDefault value: dev

--path

The --path flag indicates which project folder secrets will be injected from.

# Example
infisical secrets delete <keyName1> <keyName2>... --path="/"

infisical secrets folders

This command allows you to fetch, create and delete folders from within a path from a given project.

$ infisical secrets folders

sub commands

get

Used to fetch all folders within a path in a given project

infisical secrets folders get --path=/some/path/to/folder

Flags

--path

The path from where folders should be fetched fromDefault value: /

--token

Fetch folders using a machine identity access token.Default value: “

create

Used to create a folder by name within a path.

infisical secrets folders create --path=/some/path/to/folder --name=folder-name

Flags

--path

Path to where the folder should be createdDefault value: /

--name

Name of the folder to be created in selected --pathDefault value: “

delete

Used to delete a folder by name within a path.

infisical secrets folders delete --path=/some/path/to/folder --name=folder-name

Flags

--path

Path to where the folder should be createdDefault value: /

--name

Name of the folder to be deleted within selected --pathDefault value: “

infisical secrets generate-example-env

This command allows you to generate an example .env file from your secrets and with their associated comments and tags. This is useful when you would like to let others who work on the project but do not use Infisical become aware of the required environment variables and their intended values.To place default values in your example .env file, you can simply include the syntax DEFAULT:<value> within your secret’s comment in Infisical. This will result in the specified value being extracted and utilized as the default.

$ infisical secrets generate-example-env

## Example
$ infisical secrets generate-example-env > .example-env

Flags

--env

Used to select the environment name on which actions should be taken onDefault value: dev

​Description

​Sub-commands

​Environment variables

​Flags

​Flags

​Flags

​Flags

​sub commands

​Flags

​Flags

​Flags

​Flags

Description

Sub-commands

Environment variables

Flags

Flags

Flags

Flags

sub commands

Flags

Flags

Flags

Flags