diff --git a/docs/cli/commands/login.mdx b/docs/cli/commands/login.mdx
index 2758ced00..636e5672c 100644
--- a/docs/cli/commands/login.mdx
+++ b/docs/cli/commands/login.mdx
@@ -14,6 +14,13 @@ To change where the login credentials are stored, visit the [vaults command](./v
If you have added multiple users, you can switch between the users by using the [user command](./user).
+
+ When you authenticate with **any other method than `user`**, an access token will be printed to the console upon successful login. This token can be used to authenticate with the Infisical API and the CLI by passing it in the `--token` flag when applicable.
+
+ Use flag `--plain` along with `--silent` to print only the token in plain text when using a machine identity auth method.
+
+
+
### Flags
@@ -22,17 +29,13 @@ If you have added multiple users, you can switch between the users by using the
```
#### Valid values for the `method` flag are:
- - `user`: Login using email and password.
+ - `user`: Login using email and password. (default)
- `universal-auth`: Login using a universal auth client ID and client secret.
-
-
- When `method` is set to `universal-auth`, the `client-id` and `client-secret` flags are required. Optionally you can set the `INFISICAL_UNIVERSAL_AUTH_CLIENT_ID` and `INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET` environment variables instead of using the flags.
-
- When you authenticate with universal auth, an access token will be printed to the console upon successful login. This token can be used to authenticate with the Infisical API and the CLI by passing it in the `--token` flag when applicable.
-
- Use flag `--plain` along with `--silent` to print only the token in plain text when using the `universal-auth` method.
-
-
+ - `kubernetes`: Login using a Kubernetes native auth.
+ - `azure`: Login using an Azure native auth.
+ - `gcp-id-token`: Login using a GCP ID token native auth.
+ - `gcp-iam`: Login using a GCP IAM.
+ - `aws-iam`: Login using an AWS IAM native auth.
@@ -41,7 +44,7 @@ If you have added multiple users, you can switch between the users by using the
```
#### Description
- The client ID of the universal auth client. This is required if the `--method` flag is set to `universal-auth`.
+ The client ID of the universal auth machine identity. This is required if the `--method` flag is set to `universal-auth`.
The `client-id` flag can be substituted with the `INFISICAL_UNIVERSAL_AUTH_CLIENT_ID` environment variable.
@@ -52,13 +55,81 @@ If you have added multiple users, you can switch between the users by using the
infisical login --client-secret= # Optional, required if --method=universal-auth.
```
#### Description
- The client secret of the universal auth client. This is required if the `--method` flag is set to `universal-auth`.
+ The client secret of the universal auth machine identity. This is required if the `--method` flag is set to `universal-auth`.
The `client-secret` flag can be substituted with the `INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET` environment variable.
-
+
+
+ ```bash
+ infisical login --machine-identity-id= # Optional, required if --method=kubernetes, azure, gcp-id-token, gcp-iam, or aws-iam.
+ ```
+
+ #### Description
+ The ID of the machine identity. This is required if the `--method` flag is set to `kubernetes`, `azure`, `gcp-id-token`, `gcp-iam`, or `aws-iam`.
+
+
+ The `machine-identity-id` flag can be substituted with the `INFISICAL_MACHINE_IDENTITY_ID` environment variable.
+
+
+
+ ```bash
+ infisical login --service-account-token-path= # Optional Will default to '/var/run/secrets/kubernetes.io/serviceaccount/token'.
+ ```
+
+ #### Description
+ The path to the Kubernetes service account token to use for authentication.
+ This is optional and will default to `/var/run/secrets/kubernetes.io/serviceaccount/token`.
+
+
+ The `service-account-token-path` flag can be substituted with the `INFISICAL_KUBERNETES_SERVICE_ACCOUNT_TOKEN_PATH` environment variable.
+
+
+
+ ```bash
+ infisical login --service-account-key-file-path= # Optional, but required if --method=gcp-iam.
+ ```
+
+ #### Description
+ The path to your GCP service account key file. This is required if the `--method` flag is set to `gcp-iam`.
+
+
+ The `service-account-key-path` flag can be substituted with the `INFISICAL_GCP_IAM_SERVICE_ACCOUNT_KEY_FILE_PATH` environment variable.
+
-
\ No newline at end of file
+### Machine Identity Authentication Quick Start
+In this example we'll be using the `universal-auth` method to login to obtain an Infisical access token, which we will then use to fetch secrets with.
+
+
+
+ ```bash
+ export INFISICAL_TOKEN=$(infisical login --method=universal-auth --client-id= --client-secret= --silent --plain) # silent and plain is important to ensure only the token itself is printed, so we can easily set it as an environment variable.
+ ```
+
+ Now that we've set the `INFISICAL_TOKEN` environment variable, we can use the CLI to interact with Infisical. The CLI will automatically check for the presence of the `INFISICAL_TOKEN` environment variable and use it for authentication.
+
+
+ Alternatively, if you would rather use the `--token` flag to pass the token directly, you can do so by running the following command:
+
+ ```bash
+ infisical [command] --token= # The token output from the login command.
+ ```
+
+
+
+ ```bash
+ infisical secrets --projectId=
+ The `--recursive`, and `--env` flag is optional and will fetch all secrets in subfolders. The default environment is `dev` if no `--env` flag is provided.
+
+
+
+
+And that's it! Now you're ready to start using the Infisical CLI to interact with your secrets, with the use of Machine Identities.