From 3d65d121c082ce37eb08d82ed973c7d9540d2d05 Mon Sep 17 00:00:00 2001
From: Daniel Hougaard <62331820+DanielHougaard@users.noreply.github.com>
Date: Thu, 23 May 2024 04:45:33 +0200
Subject: [PATCH] docs: updated docs to reflect new SDK structure
---
docs/documentation/guides/node.mdx | 2 +-
docs/documentation/guides/python.mdx | 16 +-
docs/sdks/languages/csharp.mdx | 166 +++++++++++--
docs/sdks/languages/java.mdx | 146 ++++++++++-
docs/sdks/languages/node.mdx | 143 +++++++++--
docs/sdks/languages/python.mdx | 356 ++++++++++++++++++---------
6 files changed, 657 insertions(+), 172 deletions(-)
diff --git a/docs/documentation/guides/node.mdx b/docs/documentation/guides/node.mdx
index 8b78cde5e..8bd9e743b 100644
--- a/docs/documentation/guides/node.mdx
+++ b/docs/documentation/guides/node.mdx
@@ -36,7 +36,7 @@ Initialize a new Node.js project with a default `package.json` file.
npm init -y
```
-Install `express` and [infisical-node](https://github.com/Infisical/infisical-node), the client Node SDK for Infisical.
+Install `express` and [@infisical/sdk](https://www.npmjs.com/package/@infisical/sdk), the client Node SDK for Infisical.
```console
npm install express @infisical/sdk
diff --git a/docs/documentation/guides/python.mdx b/docs/documentation/guides/python.mdx
index 696f0a7ee..00b3d6089 100644
--- a/docs/documentation/guides/python.mdx
+++ b/docs/documentation/guides/python.mdx
@@ -5,7 +5,7 @@ title: "Python"
This guide demonstrates how to use Infisical to manage secrets for your Python stack from local development to production. It uses:
- Infisical (you can use [Infisical Cloud](https://app.infisical.com) or a [self-hosted instance of Infisical](https://infisical.com/docs/self-hosting/overview)) to store your secrets.
-- The [infisical-python](https://github.com/Infisical/sdk/tree/main/crates/infisical-py) Python client SDK to fetch secrets back to your Python application on demand.
+- The [infisical-python](https://pypi.org/project/infisical-python/) Python client SDK to fetch secrets back to your Python application on demand.
## Project Setup
@@ -36,23 +36,27 @@ python3 -m venv env
source env/bin/activate
```
-Install Flask and [infisical-python](https://github.com/Infisical/sdk/tree/main/crates/infisical-py), the client Python SDK for Infisical.
+Install Flask and [infisical-python](https://pypi.org/project/infisical-python/), the client Python SDK for Infisical.
```console
-pip install Flask infisical-python
+pip install flask infisical-python
```
Finally, create an `app.py` file containing the application code.
```py
from flask import Flask
-from infisical_client import ClientSettings, InfisicalClient, GetSecretOptions
+from infisical_client import ClientSettings, InfisicalClient, GetSecretOptions, AuthenticationOptions, UniversalAuthMethod
app = Flask(__name__)
client = InfisicalClient(ClientSettings(
- client_id="MACHINE_IDENTITY_CLIENT_ID",
- client_secret="MACHINE_IDENTITY_CLIENT_SECRET",
+ auth=AuthenticationOptions(
+ universal_auth=UniversalAuthMethod(
+ client_id="CLIENT_ID",
+ client_secret="CLIENT_SECRET",
+ )
+ )
))
@app.route("/")
diff --git a/docs/sdks/languages/csharp.mdx b/docs/sdks/languages/csharp.mdx
index b3a1d2086..fc87a1efe 100644
--- a/docs/sdks/languages/csharp.mdx
+++ b/docs/sdks/languages/csharp.mdx
@@ -21,21 +21,28 @@ namespace Example
static void Main(string[] args)
{
- var settings = new ClientSettings
+ ClientSettings settings = new ClientSettings
+ {
+ Auth = new AuthenticationOptions
{
- ClientId = "CLIENT_ID",
- ClientSecret = "CLIENT_SECRET",
- // SiteUrl = "http://localhost:8080", <-- This line can be omitted if you're using Infisical Cloud.
- };
- var infisical = new InfisicalClient(settings);
+ UniversalAuth = new UniversalAuthMethod
+ {
+ ClientId = "your-client-id",
+ ClientSecret = "your-client-secret"
+ }
+ }
+ };
- var options = new GetSecretOptions
+
+ var infisicalClient = new InfisicalClient(settings);
+
+ var getSecretOptions = new GetSecretOptions
{
SecretName = "TEST",
ProjectId = "PROJECT_ID",
Environment = "dev",
};
- var secret = infisical.GetSecret(options);
+ var secret = infisical.GetSecret(getSecretOptions);
Console.WriteLine($"The value of secret '{secret.SecretKey}', is: {secret.SecretValue}");
@@ -52,8 +59,6 @@ This example demonstrates how to use the Infisical C# SDK in a C# application. T
# Installation
-Run `npm` to add `@infisical/sdk` to your project.
-
```console
$ dotnet add package Infisical.Sdk
```
@@ -70,14 +75,20 @@ namespace Example
{
static void Main(string[] args)
{
-
- var settings = new ClientSettings
+ ClientSettings settings = new ClientSettings
+ {
+ Auth = new AuthenticationOptions
{
- ClientId = "CLIENT_ID",
- ClientSecret = "CLIENT_SECRET",
- };
+ UniversalAuth = new UniversalAuthMethod
+ {
+ ClientId = "your-client-id",
+ ClientSecret = "your-client-secret"
+ }
+ }
+ };
- var infisical = new InfisicalClient(settings); // <-- Your SDK instance!
+
+ var infisicalClient = new InfisicalClient(settings); // <-- Your SDK client is now ready to use
}
}
}
@@ -87,14 +98,14 @@ namespace Example
-
+
Your machine identity client ID.
-
+
Your machine identity client secret.
-
+
An access token obtained from the machine identity login endpoint.
@@ -103,13 +114,120 @@ namespace Example
If manually set to 0, caching will be disabled, this is not recommended.
-
+
Your self-hosted absolute site URL including the protocol (e.g. `https://app.infisical.com`)
+
+
+ The authentication object to use for the client. This is required unless you're using environment variables.
+
+### Authentication
+
+The SDK supports a variety of authentication methods. The most common authentication method is Universal Auth, which uses a client ID and client secret to authenticate.
+
+#### Universal Auth
+
+**Using environment variables**
+- `INFISICAL_UNIVERSAL_AUTH_CLIENT_ID` - Your machine identity client ID.
+- `INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET` - Your machine identity client secret.
+
+**Using the SDK directly**
+```csharp
+ ClientSettings settings = new ClientSettings
+ {
+ Auth = new AuthenticationOptions
+ {
+ UniversalAuth = new UniversalAuthMethod
+ {
+ ClientId = "your-client-id",
+ ClientSecret = "your-client-secret"
+ }
+ }
+ };
+
+ var infisicalClient = new InfisicalClient(settings);
+```
+
+#### GCP ID Token Auth
+
+ Please note that this authentication method will only work if you're running your application on Google Cloud Platform.
+ Please [read more](/documentation/platform/identities/gcp-auth) about this authentication method.
+
+
+**Using environment variables**
+- `INFISICAL_GCP_AUTH_IDENTITY_ID` - Your Infisical Machine Identity ID.
+
+**Using the SDK directly**
+```csharp
+ ClientSettings settings = new ClientSettings
+ {
+ Auth = new AuthenticationOptions
+ {
+ GcpIdToken = new GcpIdTokenAuthMethod
+ {
+ IdentityId = "your-machine-identity-id",
+ }
+ }
+ };
+
+
+ var infisicalClient = new InfisicalClient(settings);
+```
+
+#### GCP IAM Auth
+
+**Using environment variables**
+- `INFISICAL_GCP_IAM_AUTH_IDENTITY_ID` - Your Infisical Machine Identity ID.
+- `INFISICAL_GCP_IAM_SERVICE_ACCOUNT_KEY_FILE_PATH` - The path to your GCP service account key file.
+
+**Using the SDK directly**
+```csharp
+ ClientSettings settings = new ClientSettings
+ {
+ Auth = new AuthenticationOptions
+ {
+ GcpIam = new GcpIamAuthMethod
+ {
+ IdentityId = "your-machine-identity-id",
+ ServiceAccountKeyFilePath = "./path/to/your/service-account-key.json"
+ }
+ }
+ };
+
+
+ var infisicalClient = new InfisicalClient(settings);
+```
+
+#### AWS IAM Auth
+
+ Please note that this authentication method will only work if you're running your application on AWS.
+ Please [read more](/documentation/platform/identities/aws-auth) about this authentication method.
+
+
+**Using environment variables**
+- `INFISICAL_AWS_IAM_AUTH_IDENTITY_ID` - Your Infisical Machine Identity ID.
+
+**Using the SDK directly**
+```csharp
+ ClientSettings settings = new ClientSettings
+ {
+ Auth = new AuthenticationOptions
+ {
+ AwsIam = new AwsIamAuthMethod
+ {
+ IdentityId = "your-machine-identity-id",
+ }
+ }
+ };
+
+
+ var infisicalClient = new InfisicalClient(settings);
+```
+
### Caching
To reduce the number of API requests, the SDK temporarily stores secrets it retrieves. By default, a secret remains cached for 5 minutes after it's first fetched. Each time it's fetched again, this 5-minute timer resets. You can adjust this caching duration by setting the "cacheTTL" option when creating the client.
@@ -155,6 +273,14 @@ Retrieve all secrets within the Infisical project and environment that client is
Whether or not to include imported secrets from the current path. Read about [secret import](/documentation/platform/secret-reference)
+
+
+ Whether or not to fetch secrets recursively from the specified path. Please note that there's a 20-depth limit for recursive fetching.
+
+
+
+ Whether or not to expand secret references in the fetched secrets. Read about [secret reference](/documentation/platform/secret-reference)
+
diff --git a/docs/sdks/languages/java.mdx b/docs/sdks/languages/java.mdx
index 5b8797b5d..102b28355 100644
--- a/docs/sdks/languages/java.mdx
+++ b/docs/sdks/languages/java.mdx
@@ -19,12 +19,19 @@ import com.infisical.sdk.schema.*;
public class Example {
public static void main(String[] args) {
- // Create a new Infisical Client
+
+ // Create the authentication settings for the client
ClientSettings settings = new ClientSettings();
- settings.setClientID("MACHINE_IDENTITY_CLIENT_ID");
- settings.setClientSecret("MACHINE_IDENTITY_CLIENT_SECRET");
- settings.setCacheTTL(Long.valueOf(300)); // 300 seconds, 5 minutes
+ AuthenticationOptions authOptions = new AuthenticationOptions();
+ UniversalAuthMethod authMethod = new UniversalAuthMethod();
+ authMethod.setClientID("YOUR_IDENTITY_ID");
+ authMethod.setClientSecret("YOUR_CLIENT_SECRET");
+
+ authOptions.setUniversalAuth(authMethod);
+ settings.setAuth(authOptions);
+
+ // Create a new Infisical Client
InfisicalClient client = new InfisicalClient(settings);
// Create the options for fetching the secret
@@ -68,11 +75,18 @@ import com.infisical.sdk.schema.*;
public class App {
public static void main(String[] args) {
-
+ // Create the authentication settings for the client
ClientSettings settings = new ClientSettings();
- settings.setClientID("MACHINE_IDENTITY_CLIENT_ID");
- settings.setClientSecret("MACHINE_IDENTITY_CLIENT_SECRET");
+ AuthenticationOptions authOptions = new AuthenticationOptions();
+ UniversalAuthMethod authMethod = new UniversalAuthMethod();
+ authMethod.setClientID("YOUR_IDENTITY_ID");
+ authMethod.setClientSecret("YOUR_CLIENT_SECRET");
+
+ authOptions.setUniversalAuth(authMethod);
+ settings.setAuth(authOptions);
+
+ // Create a new Infisical Client
InfisicalClient client = new InfisicalClient(settings); // Your client!
}
}
@@ -82,15 +96,21 @@ public class App {
-
+
Your machine identity client ID.
+
+ **This field is deprecated and will be removed in future versions.** Please use the `setAuth()` method on the client settings instead.
-
+
Your machine identity client secret.
+
+ **This field is deprecated and will be removed in future versions.** Please use the `setAuth()` method on the client settings instead.
-
+
An access token obtained from the machine identity login endpoint.
+
+ **This field is deprecated and will be removed in future versions.** Please use the `setAuth()` method on the client settings instead.
@@ -101,10 +121,106 @@ public class App {
Your self-hosted absolute site URL including the protocol (e.g. `https://app.infisical.com`)
+
+
+ The authentication object to use for the client. This is required unless you're using environment variables.
+
+### Authentication
+
+The SDK supports a variety of authentication methods. The most common authentication method is Universal Auth, which uses a client ID and client secret to authenticate.
+
+#### Universal Auth
+
+**Using environment variables**
+- `INFISICAL_UNIVERSAL_AUTH_CLIENT_ID` - Your machine identity client ID.
+- `INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET` - Your machine identity client secret.
+
+**Using the SDK directly**
+```java
+ ClientSettings settings = new ClientSettings();
+ AuthenticationOptions authOptions = new AuthenticationOptions();
+ UniversalAuthMethod authMethod = new UniversalAuthMethod();
+
+ authMethod.setClientID("YOUR_IDENTITY_ID");
+ authMethod.setClientSecret("YOUR_CLIENT_SECRET");
+
+ authOptions.setUniversalAuth(authMethod);
+ settings.setAuth(authOptions);
+
+ InfisicalClient client = new InfisicalClient(settings);
+```
+
+#### GCP ID Token Auth
+
+ Please note that this authentication method will only work if you're running your application on Google Cloud Platform.
+ Please [read more](/documentation/platform/identities/gcp-auth) about this authentication method.
+
+
+**Using environment variables**
+- `INFISICAL_GCP_AUTH_IDENTITY_ID` - Your Infisical Machine Identity ID.
+
+**Using the SDK directly**
+```java
+ ClientSettings settings = new ClientSettings();
+ AuthenticationOptions authOptions = new AuthenticationOptions();
+ GCPIDTokenAuthMethod authMethod = new GCPIDTokenAuthMethod();
+
+ authMethod.setIdentityID("YOUR_MACHINE_IDENTITY_ID");
+
+ authOptions.setGcpIDToken(authMethod);
+ settings.setAuth(authOptions);
+
+ InfisicalClient client = new InfisicalClient(settings);
+```
+
+#### GCP IAM Auth
+
+**Using environment variables**
+- `INFISICAL_GCP_IAM_AUTH_IDENTITY_ID` - Your Infisical Machine Identity ID.
+- `INFISICAL_GCP_IAM_SERVICE_ACCOUNT_KEY_FILE_PATH` - The path to your GCP service account key file.
+
+**Using the SDK directly**
+```java
+ ClientSettings settings = new ClientSettings();
+ AuthenticationOptions authOptions = new AuthenticationOptions();
+ GCPIamAuthMethod authMethod = new GCPIamAuthMethod();
+
+ authMethod.setIdentityID("YOUR_MACHINE_IDENTITY_ID");
+ authMethod.setServiceAccountKeyFilePath("./path/to/your/service-account-key.json");
+
+ authOptions.setGcpIam(authMethod);
+ settings.setAuth(authOptions);
+
+ InfisicalClient client = new InfisicalClient(settings);
+```
+
+#### AWS IAM Auth
+
+ Please note that this authentication method will only work if you're running your application on AWS.
+ Please [read more](/documentation/platform/identities/aws-auth) about this authentication method.
+
+
+**Using environment variables**
+- `INFISICAL_AWS_IAM_AUTH_IDENTITY_ID` - Your Infisical Machine Identity ID.
+
+**Using the SDK directly**
+```java
+ ClientSettings settings = new ClientSettings();
+ AuthenticationOptions authOptions = new AuthenticationOptions();
+ AWSIamAuthMethod authMethod = new AWSIamAuthMethod();
+
+ authMethod.setIdentityID("YOUR_MACHINE_IDENTITY_ID");
+
+ authOptions.setAwsIam(authMethod);
+ settings.setAuth(authOptions);
+
+ InfisicalClient client = new InfisicalClient(settings);
+```
+
### Caching
To reduce the number of API requests, the SDK temporarily stores secrets it retrieves. By default, a secret remains cached for 5 minutes after it's first fetched. Each time it's fetched again, this 5-minute timer resets. You can adjust this caching duration by setting the "cacheTTL" option when creating the client.
@@ -119,6 +235,8 @@ options.setEnvironment("dev");
options.setProjectID("PROJECT_ID");
options.setPath("/foo/bar");
options.setIncludeImports(false);
+options.setRecursive(false);
+options.setExpandSecretReferences(true);
SecretElement[] secrets = client.listSecrets(options);
```
@@ -148,6 +266,14 @@ Retrieve all secrets within the Infisical project and environment that client is
Whether or not to include imported secrets from the current path. Read about [secret import](/documentation/platform/secret-reference)
+
+
+ Whether or not to fetch secrets recursively from the specified path. Please note that there's a 20-depth limit for recursive fetching.
+
+
+
+ Whether or not to expand secret references in the fetched secrets. Read about [secret reference](/documentation/platform/secret-reference)
+
diff --git a/docs/sdks/languages/node.mdx b/docs/sdks/languages/node.mdx
index 4816392ed..c626d2dcd 100644
--- a/docs/sdks/languages/node.mdx
+++ b/docs/sdks/languages/node.mdx
@@ -4,7 +4,7 @@ sidebarTitle: "Node.js"
icon: "node"
---
-If you're working with Node.js, the official [infisical-node](https://github.com/Infisical/sdk/tree/main/languages/node) package is the easiest way to fetch and work with secrets for your application.
+If you're working with Node.js, the official [Infisical Node SDK](https://github.com/Infisical/sdk/tree/main/languages/node) package is the easiest way to fetch and work with secrets for your application.
- [NPM Package](https://www.npmjs.com/package/@infisical/sdk)
- [Github Repository](https://github.com/Infisical/sdk/tree/main/languages/node)
@@ -21,14 +21,19 @@ const app = express();
const PORT = 3000;
const client = new InfisicalClient({
- clientId: "YOUR_CLIENT_ID",
- clientSecret: "YOUR_CLIENT_SECRET",
+ siteUrl: "https://app.infisical.com", // Optional, defaults to https://app.infisical.com
+ auth: {
+ universalAuth: {
+ clientId: "YOUR_CLIENT_ID",
+ clientSecret: "YOUR_CLIENT_SECRET"
+ }
+ },
logLevel: LogLevel.Error
});
app.get("/", async (req, res) => {
- // access value
-
+ // Access the secret
+
const name = await client.getSecret({
environment: "dev",
projectId: "PROJECT_ID",
@@ -72,8 +77,12 @@ Import the SDK and create a client instance with your [Machine Identity](/docume
import { InfisicalClient, LogLevel } from "@infisical/sdk";
const client = new InfisicalClient({
- clientId: "YOUR_CLIENT_ID",
- clientSecret: "YOUR_CLIENT_SECRET",
+ auth: {
+ universalAuth: {
+ clientId: "YOUR_CLIENT_ID",
+ clientSecret: "YOUR_CLIENT_SECRET"
+ }
+ },
logLevel: LogLevel.Error
});
```
@@ -81,31 +90,40 @@ Import the SDK and create a client instance with your [Machine Identity](/docume
```js
- const { InfisicalClient, LogLevel } = require("@infisical/sdk");
+ const { InfisicalClient } = require("@infisical/sdk");
const client = new InfisicalClient({
- clientId: "YOUR_CLIENT_ID",
- clientSecret: "YOUR_CLIENT_SECRET",
- logLevel: LogLevel.Error
+ auth: {
+ universalAuth: {
+ clientId: "YOUR_CLIENT_ID",
+ clientSecret: "YOUR_CLIENT_SECRET"
+ }
+ },
});
```
-#### Parameters
+### Parameters
-
+
Your machine identity client ID.
+
+ **This field is deprecated and will be removed in future versions.** Please use the `auth.universalAuth.clientId` field instead.
-
+
Your machine identity client secret.
+
+ **This field is deprecated and will be removed in future versions.** Please use the `auth.universalAuth.clientSecret` field instead.
-
+
An access token obtained from the machine identity login endpoint.
+
+ **This field is deprecated and will be removed in future versions.** Please use the `auth.accessToken` field instead.
@@ -119,10 +137,97 @@ Import the SDK and create a client instance with your [Machine Identity](/docume
The level of logs you wish to log The logs are derived from Rust, as we have written our base SDK in Rust.
+
+
+ The authentication object to use for the client. This is required unless you're using environment variables.
+
+
+### Authentication
+
+The SDK supports a variety of authentication methods. The most common authentication method is Universal Auth, which uses a client ID and client secret to authenticate.
+
+#### Universal Auth
+
+**Using environment variables**
+- `INFISICAL_UNIVERSAL_AUTH_CLIENT_ID` - Your machine identity client ID.
+- `INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET` - Your machine identity client secret.
+
+**Using the SDK directly**
+```js
+const client = new InfisicalClient({
+ auth: {
+ universalAuth: {
+ clientId: "YOUR_CLIENT_ID",
+ clientSecret: "YOUR_CLIENT_SECRET"
+ }
+ }
+});
+```
+
+#### GCP ID Token Auth
+
+ Please note that this authentication method will only work if you're running your application on Google Cloud Platform.
+ Please [read more](/documentation/platform/identities/gcp-auth) about this authentication method.
+
+
+**Using environment variables**
+- `INFISICAL_GCP_AUTH_IDENTITY_ID` - Your Infisical Machine Identity ID.
+
+**Using the SDK directly**
+```js
+const client = new InfisicalClient({
+ auth: {
+ gcpIdToken: {
+ identityId: "YOUR_IDENTITY_ID"
+ }
+ }
+});
+```
+
+#### GCP IAM Auth
+
+**Using environment variables**
+- `INFISICAL_GCP_IAM_AUTH_IDENTITY_ID` - Your Infisical Machine Identity ID.
+- `INFISICAL_GCP_IAM_SERVICE_ACCOUNT_KEY_FILE_PATH` - The path to your GCP service account key file.
+
+**Using the SDK directly**
+```js
+const client = new InfisicalClient({
+ auth: {
+ gcpIam: {
+ identityId: "YOUR_IDENTITY_ID",
+ serviceAccountKeyFilePath: "./path/to/your/service-account-key.json"
+ }
+ }
+});
+```
+
+#### AWS IAM Auth
+
+ Please note that this authentication method will only work if you're running your application on AWS.
+ Please [read more](/documentation/platform/identities/aws-auth) about this authentication method.
+
+
+**Using environment variables**
+- `INFISICAL_AWS_IAM_AUTH_IDENTITY_ID` - Your Infisical Machine Identity ID.
+
+**Using the SDK directly**
+```js
+const client = new InfisicalClient({
+ auth: {
+ awsIam: {
+ identityId: "YOUR_IDENTITY_ID"
+ }
+ }
+});
+```
+
+
+
### Caching
To reduce the number of API requests, the SDK temporarily stores secrets it retrieves. By default, a secret remains cached for 5 minutes after it's first fetched. Each time it's fetched again, this 5-minute timer resets. You can adjust this caching duration by setting the "cacheTtl" option when creating the client.
@@ -161,6 +266,14 @@ Retrieve all secrets within the Infisical project and environment that client is
Whether or not to set the fetched secrets to the process environment. If true, you can access the secrets like so `process.env["SECRET_NAME"]`.
+
+ Whether or not to fetch secrets recursively from the specified path. Please note that there's a 20-depth limit for recursive fetching.
+
+
+
+ Whether or not to expand secret references in the fetched secrets. Read about [secret reference](/documentation/platform/secret-reference)
+
+
Whether or not to include imported secrets from the current path. Read about [secret import](/documentation/platform/secret-reference)
diff --git a/docs/sdks/languages/python.mdx b/docs/sdks/languages/python.mdx
index 0ce221757..d0a504b1f 100644
--- a/docs/sdks/languages/python.mdx
+++ b/docs/sdks/languages/python.mdx
@@ -6,20 +6,24 @@ icon: "python"
If you're working with Python, the official [infisical-python](https://github.com/Infisical/sdk/edit/main/crates/infisical-py) package is the easiest way to fetch and work with secrets for your application.
-- [PyPi Package](https://pypi.org/project/infisical-python/)
-- [Github Repository](https://github.com/Infisical/sdk/edit/main/crates/infisical-py)
+- [PyPi Package](https://pypi.org/project/infisical-python/)
+- [Github Repository](https://github.com/Infisical/sdk/edit/main/crates/infisical-py)
## Basic Usage
```py
from flask import Flask
-from infisical_client import ClientSettings, InfisicalClient, GetSecretOptions
+from infisical_client import ClientSettings, InfisicalClient, GetSecretOptions, AuthenticationOptions, UniversalAuthMethod
app = Flask(__name__)
client = InfisicalClient(ClientSettings(
- client_id="MACHINE_IDENTITY_CLIENT_ID",
- client_secret="MACHINE_IDENTITY_CLIENT_SECRET",
+ auth=AuthenticationOptions(
+ universal_auth=UniversalAuthMethod(
+ client_id="CLIENT_ID",
+ client_secret="CLIENT_SECRET",
+ )
+ )
))
@app.route("/")
@@ -38,7 +42,7 @@ def hello_world():
This example demonstrates how to use the Infisical Python SDK with a Flask application. The application retrieves a secret named "NAME" and responds to requests with a greeting that includes the secret value.
- We do not recommend hardcoding your [Machine Identity Tokens](/platform/identities/overview). Setting it as an environment variable would be best.
+ We do not recommend hardcoding your [Machine Identity Tokens](/platform/identities/overview). Setting it as an environment variable would be best.
## Installation
@@ -56,11 +60,15 @@ Note: You need Python 3.7+.
Import the SDK and create a client instance with your [Machine Identity](/api-reference/overview/authentication).
```py
-from infisical_client import ClientSettings, InfisicalClient
+from infisical_client import ClientSettings, InfisicalClient, AuthenticationOptions, UniversalAuthMethod
client = InfisicalClient(ClientSettings(
- client_id="MACHINE_IDENTITY_CLIENT_ID",
- client_secret="MACHINE_IDENTITY_CLIENT_SECRET",
+ auth=AuthenticationOptions(
+ universal_auth=UniversalAuthMethod(
+ client_id="CLIENT_ID",
+ client_secret="CLIENT_SECRET",
+ )
+ )
))
```
@@ -68,14 +76,20 @@ client = InfisicalClient(ClientSettings(
-
+
Your Infisical Client ID.
+
+ **This field is deprecated and will be removed in future versions.** Please use the `auth` field instead.
-
+
Your Infisical Client Secret.
+
+ **This field is deprecated and will be removed in future versions.** Please use the `auth` field instead.
-
+
If you want to directly pass an access token obtained from the authentication endpoints, you can do so.
+
+ **This field is deprecated and will be removed in future versions.** Please use the `auth` field instead.
@@ -85,18 +99,108 @@ client = InfisicalClient(ClientSettings(
- Your self-hosted absolute site URL including the protocol (e.g.
- `https://app.infisical.com`)
+ Your self-hosted absolute site URL including the protocol (e.g. `https://app.infisical.com`)
+
+
+ The authentication object to use for the client. This is required unless you're using environment variables.
+
+### Authentication
+
+The SDK supports a variety of authentication methods. The most common authentication method is Universal Auth, which uses a client ID and client secret to authenticate.
+
+#### Universal Auth
+
+**Using environment variables**
+- `INFISICAL_UNIVERSAL_AUTH_CLIENT_ID` - Your machine identity client ID.
+- `INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET` - Your machine identity client secret.
+
+**Using the SDK directly**
+```python3
+from infisical_client import ClientSettings, InfisicalClient, AuthenticationOptions, UniversalAuthMethod
+
+client = InfisicalClient(ClientSettings(
+ auth=AuthenticationOptions(
+ universal_auth=UniversalAuthMethod(
+ client_id="CLIENT_ID",
+ client_secret="CLIENT_SECRET",
+ )
+ )
+))
+```
+
+#### GCP ID Token Auth
+
+ Please note that this authentication method will only work if you're running your application on Google Cloud Platform.
+ Please [read more](/documentation/platform/identities/gcp-auth) about this authentication method.
+
+
+**Using environment variables**
+- `INFISICAL_GCP_AUTH_IDENTITY_ID` - Your Infisical Machine Identity ID.
+
+**Using the SDK directly**
+```py
+from infisical_client import ClientSettings, InfisicalClient, AuthenticationOptions, GCPIDTokenAuthMethod
+
+client = InfisicalClient(ClientSettings(
+ auth=AuthenticationOptions(
+ gcp_id_token=GCPIDTokenAuthMethod(
+ identity_id="MACHINE_IDENTITY_ID",
+ )
+ )
+))
+```
+
+#### GCP IAM Auth
+
+**Using environment variables**
+- `INFISICAL_GCP_IAM_AUTH_IDENTITY_ID` - Your Infisical Machine Identity ID.
+- `INFISICAL_GCP_IAM_SERVICE_ACCOUNT_KEY_FILE_PATH` - The path to your GCP service account key file.
+
+**Using the SDK directly**
+```py
+from infisical_client import ClientSettings, InfisicalClient, AuthenticationOptions, GCPIamAuthMethod
+
+
+client = InfisicalClient(ClientSettings(
+ auth=AuthenticationOptions(
+ gcp_iam=GCPIamAuthMethod(
+ identity_id="MACHINE_IDENTITY_ID",
+ service_account_key_file_path="./path/to/service_account_key.json"
+ )
+ )
+))
+```
+
+#### AWS IAM Auth
+
+ Please note that this authentication method will only work if you're running your application on AWS.
+ Please [read more](/documentation/platform/identities/aws-auth) about this authentication method.
+
+
+**Using environment variables**
+- `INFISICAL_AWS_IAM_AUTH_IDENTITY_ID` - Your Infisical Machine Identity ID.
+
+**Using the SDK directly**
+```py
+from infisical_client import ClientSettings, InfisicalClient, AuthenticationOptions, AWSIamAuthMethod
+
+client = InfisicalClient(ClientSettings(
+ auth=AuthenticationOptions(
+ aws_iam=AWSIamAuthMethod(identity_id="MACHINE_IDENTITY_ID")
+ )
+))
+```
+
### Caching
To reduce the number of API requests, the SDK temporarily stores secrets it retrieves. By default, a secret remains cached for 5 minutes after it's first fetched. Each time it's fetched again, this 5-minute timer resets. You can adjust this caching duration by setting the "cache_ttl" option when creating the client.
@@ -133,6 +237,14 @@ Retrieve all secrets within the Infisical project and environment that client is
Whether or not to set the fetched secrets to the process environment. If true, you can access the secrets like so `process.env["SECRET_NAME"]`.
+
+ Whether or not to fetch secrets recursively from the specified path. Please note that there's a 20-depth limit for recursive fetching.
+
+
+
+ Whether or not to expand secret references in the fetched secrets. Read about [secret reference](/documentation/platform/secret-reference)
+
+
Whether or not to include imported secrets from the current path. Read about [secret import](/documentation/platform/secret-reference)
@@ -156,26 +268,26 @@ By default, `getSecret()` fetches and returns a shared secret. If not found, it
#### Parameters
-
-
- The key of the secret to retrieve
-
-
- The slug name (dev, prod, etc) of the environment from where secrets should be fetched from.
-
-
- The project ID where the secret lives in.
-
-
- The path from where secret should be fetched from.
-
-
- The type of the secret. Valid options are "shared" or "personal". If not specified, the default value is "personal".
-
-
- Whether or not to include imported secrets from the current path. Read about [secret import](/documentation/platform/secret-reference)
-
-
+
+
+ The key of the secret to retrieve
+
+
+ The slug name (dev, prod, etc) of the environment from where secrets should be fetched from.
+
+
+ The project ID where the secret lives in.
+
+
+ The path from where secret should be fetched from.
+
+
+ The type of the secret. Valid options are "shared" or "personal". If not specified, the default value is "personal".
+
+
+ Whether or not to include imported secrets from the current path. Read about [secret import](/documentation/platform/secret-reference)
+
+
### client.createSecret(options)
@@ -194,26 +306,26 @@ Create a new secret in Infisical.
#### Parameters
-
-
- The key of the secret to create.
-
-
- The value of the secret.
-
-
- The project ID where the secret lives in.
-
-
- The slug name (dev, prod, etc) of the environment from where secrets should be fetched from.
-
-
- The path from where secret should be created.
-
-
- The type of the secret. Valid options are "shared" or "personal". If not specified, the default value is "shared".
-
-
+
+
+ The key of the secret to create.
+
+
+ The value of the secret.
+
+
+ The project ID where the secret lives in.
+
+
+ The slug name (dev, prod, etc) of the environment from where secrets should be fetched from.
+
+
+ The path from where secret should be created.
+
+
+ The type of the secret. Valid options are "shared" or "personal". If not specified, the default value is "shared".
+
+
### client.updateSecret(options)
@@ -232,26 +344,26 @@ Update an existing secret in Infisical.
#### Parameters
-
-
- The key of the secret to update.
-
-
- The new value of the secret.
-
-
- The project ID where the secret lives in.
-
-
- The slug name (dev, prod, etc) of the environment from where secrets should be fetched from.
-
-
- The path from where secret should be updated.
-
-
- The type of the secret. Valid options are "shared" or "personal". If not specified, the default value is "shared".
-
-
+
+
+ The key of the secret to update.
+
+
+ The new value of the secret.
+
+
+ The project ID where the secret lives in.
+
+
+ The slug name (dev, prod, etc) of the environment from where secrets should be fetched from.
+
+
+ The path from where secret should be updated.
+
+
+ The type of the secret. Valid options are "shared" or "personal". If not specified, the default value is "shared".
+
+
### client.deleteSecret(options)
@@ -269,23 +381,23 @@ Delete a secret in Infisical.
#### Parameters
-
-
- The key of the secret to update.
-
-
- The project ID where the secret lives in.
-
-
- The slug name (dev, prod, etc) of the environment from where secrets should be fetched from.
-
-
- The path from where secret should be deleted.
-
-
- The type of the secret. Valid options are "shared" or "personal". If not specified, the default value is "shared".
-
-
+
+
+ The key of the secret to update.
+
+
+ The project ID where the secret lives in.
+
+
+ The slug name (dev, prod, etc) of the environment from where secrets should be fetched from.
+
+
+ The path from where secret should be deleted.
+
+
+ The type of the secret. Valid options are "shared" or "personal". If not specified, the default value is "shared".
+
+
## Cryptography
@@ -299,9 +411,11 @@ key = client.createSymmetricKey()
```
#### Returns (string)
+
`key` (string): A base64-encoded, 256-bit symmetric key, that can be used for encryption/decryption purposes.
### Encrypt symmetric
+
```py
encryptOptions = EncryptSymmetricOptions(
key=key,
@@ -314,22 +428,22 @@ encryptedData = client.encryptSymmetric(encryptOptions)
#### Parameters
-
-
- The plaintext you want to encrypt.
-
-
- The symmetric key to use for encryption.
-
-
+
+
+ The plaintext you want to encrypt.
+
+
+ The symmetric key to use for encryption.
+
+
#### Returns (object)
-`tag` (string): A base64-encoded, 128-bit authentication tag.
-`iv` (string): A base64-encoded, 96-bit initialization vector.
-`ciphertext` (string): A base64-encoded, encrypted ciphertext.
+
+`tag` (string): A base64-encoded, 128-bit authentication tag. `iv` (string): A base64-encoded, 96-bit initialization vector. `ciphertext` (string): A base64-encoded, encrypted ciphertext.
### Decrypt symmetric
+
```py
decryptOptions = DecryptSymmetricOptions(
ciphertext=encryptedData.ciphertext,
@@ -344,22 +458,24 @@ decryptedString = client.decryptSymmetric(decryptOptions)
```
#### Parameters
+
-
-
- The ciphertext you want to decrypt.
-
-
- The symmetric key to use for encryption.
-
-
- The initialization vector to use for decryption.
-
-
- The authentication tag to use for decryption.
-
-
+
+
+ The ciphertext you want to decrypt.
+
+
+ The symmetric key to use for encryption.
+
+
+ The initialization vector to use for decryption.
+
+
+ The authentication tag to use for decryption.
+
+
#### Returns (string)
+
`plaintext` (string): The decrypted plaintext.