diff --git a/docs/api-reference/overview/examples/create-secrets.mdx b/docs/api-reference/overview/examples/create-secrets.mdx index ab5b39aea..a20e9f2e3 100644 --- a/docs/api-reference/overview/examples/create-secrets.mdx +++ b/docs/api-reference/overview/examples/create-secrets.mdx @@ -142,6 +142,100 @@ const createSecrets = async () => { } createSecrets(); +``` + + + +```Python +import base64 +import requests +from Cryptodome.Cipher import AES +from Cryptodome.Random import get_random_bytes + + +BASE_URL = "https://app.infisical.com" +BLOCK_SIZE_BYTES = 16 + + +def encrypt(text, secret): + iv = get_random_bytes(BLOCK_SIZE_BYTES) + secret = bytes(secret, "utf-8") + cipher = AES.new(secret, AES.MODE_GCM, iv) + ciphertext, tag = cipher.encrypt_and_digest(text.encode("utf-8")) + return { + "ciphertext": base64.standard_b64encode(ciphertext).decode("utf-8"), + "tag": base64.standard_b64encode(tag).decode("utf-8"), + "iv": base64.standard_b64encode(iv).decode("utf-8"), + } + + +def decrypt(ciphertext, iv, tag, secret): + secret = bytes(secret, "utf-8") + iv = base64.standard_b64decode(iv) + tag = base64.standard_b64decode(tag) + ciphertext = base64.standard_b64decode(ciphertext) + + cipher = AES.new(secret, AES.MODE_GCM, iv) + cipher.update(tag) + cleartext = cipher.decrypt(ciphertext).decode("utf-8") + return cleartext + + +def create_secrets(): + service_token = "your_service_token" + service_token_secret = service_token[service_token.rindex(".") + 1 :] + + secret_type = "shared" # "shared or "personal" + secret_key = "some_key" + secret_value = "some_value" + secret_comment = "some_comment" + + # 1. Get your Infisical Token data + service_token_data = requests.get( + f"{BASE_URL}/api/v2/service-token", + headers={"Authorization": f"Bearer {service_token}"}, + ).json() + + # 2. Decrypt the (encrypted) project key with the key from your Infisical Token + project_key = decrypt( + ciphertext=service_token_data["encryptedKey"], + iv=service_token_data["iv"], + tag=service_token_data["tag"], + secret=service_token_secret, + ) + + # 3. Encrypt your secret(s) with the project key + encrypted_key_data = encrypt(text=secret_key, secret=project_key) + encrypted_value_data = encrypt(text=secret_value, secret=project_key) + encrypted_comment_data = encrypt(text=secret_comment, secret=project_key) + + secret = { + "type": secret_type, + "secretKeyCiphertext": encrypted_key_data["ciphertext"], + "secretKeyIV": encrypted_key_data["iv"], + "secretKeyTag": encrypted_key_data["tag"], + "secretValueCiphertext": encrypted_value_data["ciphertext"], + "secretValueIV": encrypted_value_data["iv"], + "secretValueTag": encrypted_value_data["tag"], + "secretCommentCiphertext": encrypted_comment_data["ciphertext"], + "secretCommentIV": encrypted_comment_data["iv"], + "secretCommentTag": encrypted_comment_data["tag"], + } + + # 4. Send (encrypted) secret (s) to Infisical + requests.post( + f"{BASE_URL}/api/v2/secrets", + json={ + "workspaceId": service_token_data["workspace"], + "environment": service_token_data["environment"], + "secrets": [secret], + }, + headers={"Authorization": f"Bearer {service_token}"}, + ) + + +create_secrets() + ``` diff --git a/docs/api-reference/overview/examples/delete-secrets.mdx b/docs/api-reference/overview/examples/delete-secrets.mdx index 312900a63..766f674ca 100644 --- a/docs/api-reference/overview/examples/delete-secrets.mdx +++ b/docs/api-reference/overview/examples/delete-secrets.mdx @@ -13,9 +13,7 @@ Prerequisites: ## Example - - - + ```js const axios = require('axios'); const BASE_URL = 'https://app.infisical.com'; @@ -40,7 +38,32 @@ const deleteSecrets = async () => { deleteSecrets(); ``` + + +```Python +import requests + +BASE_URL = "https://app.infisical.com" + + +def delete_secrets(): + service_token = "" + secret_id = "id_of_secret_to_delete" + + # Send ID(s) of secret(s) to delete to the Infisical API + requests.delete( + f"{BASE_URL}/api/v2/secrets", + json={"secretIds": [secret_id]}, + headers={"Authorization": f"Bearer {service_token}"}, + ) + + +delete_secrets() + +``` + + If using an `API_KEY` to authenticate with the Infisical API, then you should include it in the `X_API_KEY` header. diff --git a/docs/api-reference/overview/examples/retrieve-secrets.mdx b/docs/api-reference/overview/examples/retrieve-secrets.mdx index 813aae9e7..794f76d7a 100644 --- a/docs/api-reference/overview/examples/retrieve-secrets.mdx +++ b/docs/api-reference/overview/examples/retrieve-secrets.mdx @@ -113,9 +113,10 @@ getSecrets(); ```Python import requests import base64 -from Cryptodome.Cipher import AES +from Cryptodome.Cipher import AES -BASE_URL = "http://app.infisical.com" + +BASE_URL = "http://app.infisical.com" def decrypt(ciphertext, iv, tag, secret): @@ -126,20 +127,18 @@ def decrypt(ciphertext, iv, tag, secret): cipher = AES.new(secret, AES.MODE_GCM, iv) cipher.update(tag) - cleartext = cipher.decrypt(ciphertext).decode('utf-8') + cleartext = cipher.decrypt(ciphertext).decode("utf-8") return cleartext def get_secrets(): - service_token = "" - service_token_secret = service_token[service_token.rindex(".") + 1:] + service_token = "your_service_token" + service_token_secret = service_token[service_token.rindex(".") + 1 :] # 1. Get your Infisical Token data service_token_data = requests.get( f"{BASE_URL}/api/v2/service-token", - headers={ - "Authorization": f"Bearer {service_token}" - } + headers={"Authorization": f"Bearer {service_token}"}, ).json() # 2. Get secrets for your project and environment @@ -147,21 +146,19 @@ def get_secrets(): f"{BASE_URL}/api/v2/secrets", params={ "environment": service_token_data["environment"], - "workspaceId": service_token_data["workspace"] + "workspaceId": service_token_data["workspace"], }, - headers={ - "Authorization": f"Bearer {service_token}" - } + headers={"Authorization": f"Bearer {service_token}"}, ).json() - encrypted_secrets = data.get("secrets") + encrypted_secrets = data["secrets"] # 3. Decrypt the (encrypted) project key with the key from your Infisical Token project_key = decrypt( - ciphertext=service_token_data.get("encryptedKey"), - iv=service_token_data.get("iv"), - tag=service_token_data.get("tag"), - secret=service_token_secret + ciphertext=service_token_data["encryptedKey"], + iv=service_token_data["iv"], + tag=service_token_data["tag"], + secret=service_token_secret, ) # 4. Decrypt the (encrypted) secrets @@ -171,25 +168,28 @@ def get_secrets(): ciphertext=secret["secretKeyCiphertext"], iv=secret["secretKeyIV"], tag=secret["secretKeyTag"], - secret=project_key + secret=project_key, ) secret_value = decrypt( ciphertext=secret["secretValueCiphertext"], iv=secret["secretValueIV"], tag=secret["secretValueTag"], - secret=project_key + secret=project_key, + ) + + secrets.append( + { + "secret_key": secret_key, + "secret_value": secret_value, + } ) - secrets.append({ - "secret_key": secret_key, - "secret_value": secret_value, - }) - print("secrets:", secrets) get_secrets() + ``` diff --git a/docs/api-reference/overview/examples/update-secrets.mdx b/docs/api-reference/overview/examples/update-secrets.mdx index b3e16b2e3..13bc4ee3e 100644 --- a/docs/api-reference/overview/examples/update-secrets.mdx +++ b/docs/api-reference/overview/examples/update-secrets.mdx @@ -141,6 +141,98 @@ const updateSecrets = async () => { } updateSecrets(); +``` + + + +```Python +import base64 +import requests +from Cryptodome.Cipher import AES +from Cryptodome.Random import get_random_bytes + + +BASE_URL = "https://app.infisical.com" +BLOCK_SIZE_BYTES = 16 + + +def encrypt(text, secret): + iv = get_random_bytes(BLOCK_SIZE_BYTES) + secret = bytes(secret, "utf-8") + cipher = AES.new(secret, AES.MODE_GCM, iv) + ciphertext, tag = cipher.encrypt_and_digest(text.encode("utf-8")) + return { + "ciphertext": base64.standard_b64encode(ciphertext).decode("utf-8"), + "tag": base64.standard_b64encode(tag).decode("utf-8"), + "iv": base64.standard_b64encode(iv).decode("utf-8"), + } + + +def decrypt(ciphertext, iv, tag, secret): + secret = bytes(secret, "utf-8") + iv = base64.standard_b64decode(iv) + tag = base64.standard_b64decode(tag) + ciphertext = base64.standard_b64decode(ciphertext) + + cipher = AES.new(secret, AES.MODE_GCM, iv) + cipher.update(tag) + cleartext = cipher.decrypt(ciphertext).decode("utf-8") + return cleartext + + +def update_secret(): + service_token = "your_service_token" + service_token_secret = service_token[service_token.rindex(".") + 1 :] + + secret_id = "id_of_secret_to_update" + secret_key = "some_key" + secret_value = "updated_value" + secret_comment = "updated_comment" + + # 1. Get your Infisical Token data + service_token_data = requests.get( + f"{BASE_URL}/api/v2/service-token", + headers={"Authorization": f"Bearer {service_token}"}, + ).json() + + # 2. Decrypt the (encrypted) project key with the key from your Infisical Token + project_key = decrypt( + ciphertext=service_token_data["encryptedKey"], + iv=service_token_data["iv"], + tag=service_token_data["tag"], + secret=service_token_secret, + ) + + # 3. Encrypt your updated secret(s) with the project key + encrypted_key_data = encrypt(text=secret_key, secret=project_key) + encrypted_value_data = encrypt(text=secret_value, secret=project_key) + encrypted_comment_data = encrypt(text=secret_comment, secret=project_key) + + secret = { + "id": secret_id, + "workspace": service_token_data["workspace"], + "environment": service_token_data["environment"], + "secretKeyCiphertext": encrypted_key_data["ciphertext"], + "secretKeyIV": encrypted_key_data["iv"], + "secretKeyTag": encrypted_key_data["tag"], + "secretValueCiphertext": encrypted_value_data["ciphertext"], + "secretValueIV": encrypted_value_data["iv"], + "secretValueTag": encrypted_value_data["tag"], + "secretCommentCiphertext": encrypted_comment_data["ciphertext"], + "secretCommentIV": encrypted_comment_data["iv"], + "secretCommentTag": encrypted_comment_data["tag"], + } + + # 4. Send (encrypted) updated secret(s) to Infisical + requests.patch( + f"{BASE_URL}/api/v2/secrets", + json={"secrets": [secret]}, + headers={"Authorization": f"Bearer {service_token}"}, + ) + + +update_secret() + ```