awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Feat: API Docs revamp (Service Token Deprecation)

Browse Source
This commit is contained in:
Daniel Hougaard
2024-04-26 05:08:27 +02:00
parent c61602370e
commit 5c0e5a8ae0
30 changed files with 665 additions and 277 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
docs/cli/commands/export.mdx
View File

@@ -40,12 +40,21 @@ Export environment variables from the platform into a file format.
### Environment variables
<Accordion title="INFISICAL_TOKEN">
Used to fetch secrets via a [service token](/documentation/platform/token) apposed to logged in credentials. Simply, export this variable in the terminal before running this command.
Used to fetch secrets via a [machine identities](/documentation/platform/identities/machine-identities) apposed to logged in credentials. Simply, export this variable in the terminal before running this command.
```bash
# Example
export INFISICAL_TOKEN=st.63e03c4a97cb4a747186c71e.ed5b46a34c078a8f94e8228f4ab0ff97.4f7f38034811995997d72badf44b42ec
export INFISICAL_TOKEN=$(infisical login --method=universal-auth --client-id=<identity-client-id> --client-secret=<identity-client-secret> --silent --plain) # --plain flag will output only the token, so it can be fed to an environment variable. --silent will disable any update messages.
```
<Info>
Alternatively you may also use service tokens. **Service tokens are legacy tokens that are a precursor to machine identities, and will be removed in the future.**
```bash
# Example
export INFISICAL_TOKEN=<service-token>
```
</Info>
</Accordion>
<Accordion title="INFISICAL_DISABLE_UPDATE_CHECK">

27
docs/cli/commands/run.mdx
View File

@@ -42,12 +42,20 @@ Inject secrets from Infisical into your application process.
### Environment variables
<Accordion title="INFISICAL_TOKEN">
Used to fetch secrets via a [service token](/documentation/platform/token) apposed to logged in credentials. Simply, export this variable in the terminal before running this command.
Used to fetch secrets via a [machine identity](/documentation/platform/identities/machine-identities) apposed to logged in credentials. Simply, export this variable in the terminal before running this command.
```bash
# Example
export INFISICAL_TOKEN=st.63e03c4a97cb4a747186c71e.ed5b46a34c078a8f94e8228f4ab0ff97.4f7f38034811995997d72badf44b42ec
export INFISICAL_TOKEN=$(infisical login --method=universal-auth --client-id=<identity-client-id> --client-secret=<identity-client-secret> --silent --plain) # --plain flag will output only the token, so it can be fed to an environment variable. --silent will disable any update messages.
```
<Info>
Alternatively you may also use service tokens. **Service tokens are legacy tokens that are a precursor to machine identities, and will be removed in the future.**
```bash
# Example
export INFISICAL_TOKEN=<service-token>
```
</Info>
</Accordion>
<Accordion title="INFISICAL_DISABLE_UPDATE_CHECK">
@@ -81,12 +89,21 @@ Inject secrets from Infisical into your application process.
```
</Accordion>
<Accordion title="--token">
If you are using a [service token](/documentation/platform/token) to authenticate, you can pass the token as a flag
<Accordion title="--projectId">
The project ID to fetch secrets from. This is required when using a machine identity to authenticate.
```bash
# Example
infisical run --token="st.63e03c4a97cb4a747186c71e.ed5b46a34c078a8f94e8228f4ab0ff97.4f7f38034811995997d72badf44b42ec" -- npm run start
infisical run --projectId=<project-id> -- npm run dev
```
</Accordion>
<Accordion title="--token">
If you are using a [machine identity](/documentation/platform/identities/machine-identities) to authenticate, you can pass the token as a flag
```bash
# Example
infisical run --token="<universal-auth-access-token>" --projectId=<project-id> -- npm run start
```
You may also expose the token to the CLI by setting the environment variable `INFISICAL_TOKEN` before executing the run command. This will have the same effect as setting the token with `--token` flag

22
docs/cli/commands/secrets.mdx
View File

@@ -23,13 +23,20 @@ $ infisical secrets
### Environment variables
<Accordion title="INFISICAL_TOKEN">
Used to fetch secrets via a [service token](/documentation/platform/token) apposed to logged in credentials. Simply, export this variable in the terminal before running this command.
Used to fetch secrets via a [machine identity](/documentation/platform/identities/machine-identities) apposed to logged in credentials. Simply, export this variable in the terminal before running this command.
```bash
# Example
export INFISICAL_TOKEN=st.63e03c4a97cb4a747186c71e.ed5b46a34c078a8f94e8228f4ab0ff97.4f7f38034811995997d72badf44b42ec
export INFISICAL_TOKEN=$(infisical login --method=universal-auth --client-id=<identity-client-id> --client-secret=<identity-client-secret> --silent --plain) # --plain flag will output only the token, so it can be fed to an environment variable. --silent will disable any update messages.
```
<Info>
Alternatively you may also use service tokens. **Service tokens are legacy tokens that are a precursor to machine identities, and will be removed in the future.**
```bash
# Example
export INFISICAL_TOKEN=<service-token>
```
</Info>
</Accordion>
<Accordion title="INFISICAL_DISABLE_UPDATE_CHECK">
@@ -53,6 +60,15 @@ $ infisical secrets
</Accordion>
<Accordion title="--projectId">
The project ID to fetch secrets from. This is required when using a machine identity to authenticate.
```bash
# Example
infisical secrets --projectId=<project-id>
```
</Accordion>
<Accordion title="--env">
Used to select the environment name on which actions should be taken on
@@ -186,7 +202,7 @@ $ infisical secrets folders
</Accordion>
<Accordion title="--token">
Fetch folders using the Infisical service token
Fetch folders using an Infisical universal auth access token
Default value: ``
</Accordion>

4
docs/cli/commands/service-token.mdx
View File

@@ -3,6 +3,10 @@ title: "infisical service-token"
description: "Manage Infisical service tokens"
---
<Warning>
This command is deprecated and will be removed in the near future. Please switch to [Machine Identities](/documentation/platform/identities/machine-identities) for authenticating with Infisical.
</Warning>
```bash
infisical service-token create --scope=dev:/global --scope=dev:/backend --access-level=read --access-level=write
```

22
docs/cli/token.mdx
View File

@@ -1,22 +0,0 @@
---
title: "Infisical Token"
description: "How to use Infisical service token within the CLI."
---
Prerequisite: [Infisical Token and How to Generate One](/documentation/platform/token).
It's possible to use the CLI to sync environment variables without manually entering login credentials by using a service token in the prerequisite link above.
## Feeding Infisical Token to the CLI
The CLI looks out for an environment variable called the `INFISICAL_TOKEN` which you can set depending on where you run the CLI. If `INFISICAL_TOKEN` is detected by the CLI, it will authenticate and retrieve the environment variables which the token is authorized for.
A common use-case is to use the Infisical Token to fetch environment variables with Docker. More specifically, a token can be passed to a container as an environment variable for the CLI to authenticate and pull its corresponding secrets. Check out the integration guides for that:
- [Docker](../../integrations/platforms/docker)
- [Docker Compose](../../integrations/platforms/docker-compose)
<Info>
Once the token is expired, the CLI using it will no longer be able to make
requests with it.
</Info>

73
docs/cli/usage.mdx
View File

@@ -33,26 +33,67 @@ The distinguishing factor, however, is the authentication method used.
</Tab>
<Tab title="Staging, production & all other use case">
To use Infisical for non local development scenarios, please create a [service token](../documentation/platform/token). The service token will allow you to authenticate and interact with Infisical.
Once you have created a service token with the required permissions, you'll need to feed the token to the CLI.
<Tabs>
<Tab title="Machine Identities (Recommended)">
#### Pass as flag
You may use the --token flag to set the token
## Machine Identities
```
infisical export --token=<>
infisical secrets --token=<>
infisical run --token=<> -- npm run dev
```
To use Infisical for non local development scenarios, please create a [machine identity](../documentation/platform/identities/machine-identities). The machine identity will allow you to authenticate and interact with Infisical.
Once you have created a machine identity with the required permissions, you'll need to feed the token to the CLI.
#### Pass via shell environment variable
The CLI is configured to look for an environment variable named `INFISICAL_TOKEN`. If set, it'll attempt to use it for authentication.
#### Use `infisical login` to obtain a universal auth access token
```
export INFISICAL_TOKEN=<>
```
```bash
export INFISICAL_TOKEN=$(infisical login --method=universal-auth --client-id=<identity-client-id> --client-secret=<identity-client-secret> --silent --plain) # --plain flag will output only the token, so it can be fed to an environment variable. --silent will disable any update messages.
```
The CLI is configured to look for the `INFISICAL_TOKEN` environment variable. You can also pass the universal auth token as a `--token` flag to commands.
<Info>
Keep in mind that the universal auth token has a limited lifetime. It is recommended to use it only for the duration of the task at hand.
You can [refresh the token](./commands/token) if needed.
</Info>
#### Run commands with the universal auth token
When using universal auth it's required to pass the `--projectId` flag.
```bash
# Use the token for your commands.
infisical export --projectId=<project-id>
infisical secrets --projectId=<project-id>
infisical run --projectId=<project-id> -- npm run dev
```
</Tab>
<Tab title="Service Tokens (Deprecated)">
## Service Tokens
<Warning>
Service tokens are deprecated and will be removed in the near future. Please switch to [Machine Identities](../documentation/platform/identities/machine-identities) for authenticating with Infisical.
</Warning>
To use Infisical for non local development scenarios, please create a service token. The service token will allow you to authenticate and interact with Infisical. Once you have created a service token with the required permissions, you’ll need to feed the token to the CLI.
```bash
infisical export --token=<service-token>
infisical secrets --token=<service-token>
infisical run --token=<service-token> -- npm run dev
```
#### Pass via shell environment variable
The CLI is configured to look for an environment variable named `INFISICAL_TOKEN`. If set, it’ll attempt to use it for authentication.
```bash
export INFISICAL_TOKEN=<service-token>
```
</Tab>
</Tabs>
</Tab>
</Tabs>
@@ -61,7 +102,7 @@ The distinguishing factor, however, is the authentication method used.
<Tabs>
<Tab title="Feed secrets to your application">
```bash
infisical run --env=dev --path=/apps/firefly -- [your application start command]
infisical run --env=dev --path=/apps/firefly -- [your application start command] # e.g. npm run dev
# example with node (nodemon)
infisical run --env=staging --path=/apps/spotify -- nodemon index.js