Skip to main content
This guide shows you how to inject secrets from Infisical into your local application without using a .env file. You’ll install the Infisical CLI, link your codebase to your Infisical project, and start your application through infisical run.
infisical run injects secrets as environment variables, so it works with any language or framework. To read secrets from inside your application code instead, use a framework integration.

​
Prerequisites

  • An Infisical project with secrets in its Development environment. If you don’t have one yet, follow the quickstart first.

​
Step 1: Install the CLI

Install the CLI with the package manager for your operating system.
Check that the installation worked:

​
Step 2: Inject secrets into your application

If you prefer to learn by watching, follow along with our step-by-step video tutorial.

​
Log in to Infisical

Authenticate the CLI with your Infisical account.
The prompt asks which instance you want to use. Select Infisical Cloud (US), Infisical Cloud (EU), or Self-hosted, then finish signing in through your browser.
On a machine with no browser, such as a remote SSH session, WSL 2, or Codespaces, run infisical login -i to log in from the terminal instead.
Go to the directory of the codebase you’re working on and link it to your Infisical project.
Select your organization and project when prompted. This creates an .infisical.json file with your local project settings, so the commands you run next don’t need a project ID.
.infisical.json holds no secret values, so you can safely commit it to version control. Everyone who clones the repository is then pointed at the same project.

​
Start your application with secrets injected

Run your usual start command through infisical run, placing it after the -- separator.
The CLI fetches the secrets you have access to and passes them to your application as environment variables. Your application reads them the same way it always has, through process.env in Node.js or os.environ in Python, so you don’t need to change any application code.
By default, infisical run only injects the secrets sitting at the root of the environment, so anything inside a folder is skipped. If your secrets live in folders, you can specify a folder to include using --path:
If you also need the secrets in that folder’s subfolders, add --recursive:
Add --watch while you work to restart your application automatically whenever one of its secrets changes in Infisical.
A start command that is a shell function or an alias can’t be called directly after --, because it only exists inside your shell. Use the --command flag to run it in a shell instead.For example, if custom.sh defines a yd function that runs yarn dev:
Source the file and call the function in a single command:
The --command flag is also how you chain commands together, as in --command="npm run migrate && npm run dev".
For every available option, see the infisical run reference.

​
Confirm secrets are injected

If your application starts but behaves as though a value is missing, check what the CLI is injecting before you look at your application code. This prints one secret exactly as your application would receive it:
To see every key available in an environment, list the secrets directly:

​
Override secrets locally

Everyone working in a project shares the same values for a given environment, which is what keeps a team in sync. When you need a different value on your machine alone, such as pointing a database URL at a database running on your laptop, create a personal override instead of editing the shared secret:
Your next infisical run uses the override, and your teammates keep receiving the shared value. You can also create an override from the secret’s row in the dashboard.

​
Export secrets to a file

Some tools read secrets from a file and offer no way to accept them from the environment. For those cases, write the secrets to a file with infisical export:
An exported file is plain text, and it goes out of date as soon as someone changes a value in Infisical. Add it to your .gitignore, and regenerate it rather than treating it as the source of truth. We recommend using infisical run wherever possible.

​
Scan commits for secrets

Fetching secrets from Infisical keeps them out of your repository, but a credential can still reach a commit by being pasted into a source file. Install the pre-commit hook to scan your staged changes each time you commit:
The hook stops the commit when it finds something that looks like a secret. Check out Secret Scanning to learn more.

​
Troubleshooting

Your shell reports infisical: command not found, or infisical is not recognized on Windows. The CLI isn’t on your PATH. Run the install command for your platform again, then open a new terminal window so that it picks up the updated PATH.
The CLI is probably reading from a different environment or folder than the one holding your secret. Run infisical secrets --env=dev --path=/ to see what it resolves to, confirm the environment slug in your project settings, and add --path if the secret lives in a folder rather than at the root.
The CLI is pointed at the wrong instance. It uses Infisical Cloud US by default, so an EU or self-hosted account needs the address set through the INFISICAL_DOMAIN environment variable, the --domain flag, or the domain field in .infisical.json.
Your editor’s run configuration starts your application on its own, outside the infisical run process, and the injected variables exist only inside that process and the commands it starts. Change the run configuration to call infisical run --env=dev -- <your-start-command>. Avoid launching the editor itself through infisical run, because its extensions, language servers, and other child processes would also inherit the secrets.

​
Next steps

CLI reference

All available flags for run, export, secrets, and the rest of the CLI.

Docker

Inject the same secrets into containers and Docker Compose services.

Secrets delivery

Choose how to deliver secrets to CI/CD, Kubernetes, and production workloads.

Language SDKs

Fetch secrets from inside your application code instead of the environment.