SPIFFE Auth

const axios = require("axios");

// Obtain JWT-SVID from SPIRE Agent via the Workload API,
// or from your SPIFFE-compatible identity provider.
const jwtSvid = "<your-jwt-svid>";

const infisicalUrl = "https://app.infisical.com"; // or your self-hosted Infisical URL
const identityId = "<your-identity-id>";

const { data } = await axios.post(
  `${infisicalUrl}/api/v1/auth/spiffe-auth/login`,
  {
    identityId,
    jwt: jwtSvid,
  }
);

console.log("Access token:", data.accessToken);
// Use data.accessToken for subsequent Infisical API requests

package main

import (
  "bytes"
  "context"
  "encoding/json"
  "fmt"
  "io"
  "net/http"

  "github.com/spiffe/go-spiffe/v2/workloadapi"
)

func main() {
  ctx := context.Background()

  // Connect to the SPIRE Agent Workload API
  client, err := workloadapi.New(ctx, workloadapi.WithAddr("unix:///tmp/spire-agent/public/api.sock"))
  if err != nil {
    panic(err)
  }
  defer client.Close()

  // Fetch a JWT-SVID with the required audience
  svid, err := client.FetchJWTSVID(ctx, workloadapi.JWTSVIDParams{
    Audience: "infisical",
  })
  if err != nil {
    panic(err)
  }

  // Authenticate with Infisical
  payload, _ := json.Marshal(map[string]string{
    "identityId": "<your-identity-id>",
    "jwt":        svid.Marshal(),
  })

  resp, err := http.Post(
    "https://app.infisical.com/api/v1/auth/spiffe-auth/login",
    "application/json",
    bytes.NewReader(payload),
  )
  if err != nil {
    panic(err)
  }
  defer resp.Body.Close()

  body, _ := io.ReadAll(resp.Body)
  fmt.Println("Response:", string(body))
}