From c68da1201886a6936705c1942597d01e08577d54 Mon Sep 17 00:00:00 2001 From: Your Name Date: Tue, 21 Oct 2025 15:54:46 -0300 Subject: [PATCH 1/7] docs: enhance login documentation with detailed authentication methods and examples --- docs/cli/commands/login.mdx | 203 ++++++++++++++++++++++++++++++++++-- 1 file changed, 196 insertions(+), 7 deletions(-) diff --git a/docs/cli/commands/login.mdx b/docs/cli/commands/login.mdx index f93e3b4b2..50b96baa1 100644 --- a/docs/cli/commands/login.mdx +++ b/docs/cli/commands/login.mdx @@ -9,22 +9,92 @@ infisical login ### Description -The CLI uses authentication to verify your identity. When you enter the correct email and password for your account, a token is generated and saved in your system Keyring to allow you to make future interactions with the CLI. +The CLI uses authentication to verify your identity. You can authenticate using: +- **Browser Login** (default): Opens a browser for authentication +- **Direct Login**: Provide email and password via flags or environment variables for non-interactive workflows +- **Interactive CLI Login**: Use the `--interactive` flag to enter credentials via CLI prompts + +When authenticated, a token is generated and saved in your system Keyring to allow you to make future interactions with the CLI. To change where the login credentials are stored, visit the [vaults command](./vault). If you have added multiple users, you can switch between the users by using the [user command](./user). - When you authenticate with **any other method than `user`**, an access token will be printed to the console upon successful login. This token can be used to authenticate with the Infisical API and the CLI by passing it in the `--token` flag when applicable. - - Use flag `--plain` along with `--silent` to print only the token in plain text when using a machine identity auth method. - + **JWT Token Output:** + - For **user authentication** with the `--plain` flag: outputs only the JWT access token (useful for scripting) + - For **machine identity authentication**: an access token is always printed to the console + + Use the `--plain` flag to print only the token in plain text, which is ideal for capturing in environment variables or CI/CD pipelines. ### Authentication Methods -The Infisical CLI supports multiple authentication methods. Below are the available authentication methods, with their respective flags. +The Infisical CLI supports two main categories of authentication: User Authentication and Machine Identity Authentication. + +#### User Authentication + +User authentication is designed for individual developers and supports multiple login flows. + + + + The User authentication method allows you to log in with your email and password. This method supports three different login flows: + + - **Browser Login** (default): Opens a browser for authentication + - **Direct Login**: Provide credentials via flags or environment variables for CI/CD + - **Interactive CLI Login**: Enter credentials via CLI prompts using `--interactive` + + + + + Your email address. Required for direct login along with `--password`. + + + Your password. Required for direct login along with `--email`. + + + Force interactive CLI login instead of browser-based authentication. + + + Output only the JWT token (useful for scripting and CI/CD). + + + + + + + **Browser Login (Default)** + ```bash + infisical login + ``` + + **Direct Login (CI/CD)** + ```bash + infisical login --email=user@example.com --password=your-password + + # Or using environment variables + export INFISICAL_EMAIL="user@example.com" + export INFISICAL_PASSWORD="your-password" + infisical login + ``` + + **Interactive CLI Login** + ```bash + infisical login --interactive + ``` + + **Plain Token Output (for scripting)** + ```bash + export INFISICAL_TOKEN=$(infisical login --email=user@example.com --password=your-password --plain) + ``` + + + + + +#### Machine Identity Authentication + +Machine identity authentication methods are designed for automated systems, services, and CI/CD pipelines. @@ -330,6 +400,59 @@ The login command supports a number of flags that you can use for different auth + + ```bash + infisical login --email= --password= + ``` + + #### Description + Email address for direct user login. Must be used together with `--password` for non-interactive authentication. + + + The `email` flag can be substituted with the `INFISICAL_EMAIL` environment variable. + + + + + ```bash + infisical login --email= --password= + ``` + + #### Description + Password for direct user login. Must be used together with `--email` for non-interactive authentication. + + + For security in CI/CD environments, prefer using the `INFISICAL_PASSWORD` environment variable instead of passing the password as a command-line flag. + + + + The `password` flag can be substituted with the `INFISICAL_PASSWORD` environment variable. + + + + + ```bash + infisical login --interactive + ``` + + #### Description + Forces interactive CLI login where you'll be prompted to enter your email and password in the terminal, instead of opening a browser. + + + + ```bash + infisical login --email= --password= --plain + ``` + + #### Description + When used with direct user login or machine identity authentication, outputs only the JWT access token without any additional formatting. This is useful for scripting and CI/CD pipelines where you need to capture the token. + + ```bash + # Example: Capture token in a variable + export INFISICAL_TOKEN=$(infisical login --email= --password= --plain) + ``` + + @@ -346,6 +469,72 @@ The login command supports a number of flags that you can use for different auth +### User Authentication Examples + +The following examples demonstrate different ways to authenticate as a user with the Infisical CLI. + + + + Direct login is ideal for CI/CD pipelines and automation scripts where browser-based authentication is not possible. + + #### Using Command-Line Flags + + ```bash + # Basic direct login + infisical login --email user@example.com --password "your-password" + + # With custom domain (US Cloud) + infisical login --email user@example.com --password "your-password" --domain https://app.infisical.com + + # With custom domain (EU Cloud) + infisical login --email user@example.com --password "your-password" --domain https://eu.infisical.com + + # Output only JWT token for scripting + export INFISICAL_TOKEN=$(infisical login --email user@example.com --password "your-password" --plain) + ``` + + #### Using Environment Variables (Recommended for CI/CD) + + ```bash + # Set credentials as environment variables + export INFISICAL_EMAIL="user@example.com" + export INFISICAL_PASSWORD="your-password" + export INFISICAL_API_URL="https://app.infisical.com/api" + + # Login without additional flags + infisical login + + # Or with plain output for token capture + export INFISICAL_TOKEN=$(infisical login --plain) + ``` + + + + Interactive login prompts you to enter credentials in the terminal instead of opening a browser. + + ```bash + # Force interactive CLI login + infisical login --interactive + ``` + + You'll be prompted to enter: + - Email address + - Password + + + + + By default, running `infisical login` without any flags opens your browser for authentication. + + ```bash + # Opens browser for authentication + infisical login + ``` + + The browser will open to the Infisical login page, and upon successful authentication, the CLI will be automatically authenticated. + + + ### Machine Identity Authentication Quick Start @@ -367,7 +556,7 @@ In this example we'll be using the `universal-auth` method to login to obtain an ``` - + ```bash infisical secrets --projectId= Date: Tue, 21 Oct 2025 16:45:57 -0300 Subject: [PATCH 2/7] docs: fix syntax error in login command example for fetching secrets --- docs/cli/commands/login.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/cli/commands/login.mdx b/docs/cli/commands/login.mdx index 50b96baa1..16fef7985 100644 --- a/docs/cli/commands/login.mdx +++ b/docs/cli/commands/login.mdx @@ -558,7 +558,7 @@ In this example we'll be using the `universal-auth` method to login to obtain an ```bash - infisical secrets --projectId= --env=dev --recursive ``` This command will fetch all secrets from the `dev` environment in your project, including all secrets in subfolders. From faa3ed289b3a3775da84658691f472c2b2da11ce Mon Sep 17 00:00:00 2001 From: Your Name Date: Tue, 21 Oct 2025 22:49:29 -0300 Subject: [PATCH 3/7] docs: restore missing AccordionGroup wrapping for login command flags --- docs/cli/commands/login.mdx | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/docs/cli/commands/login.mdx b/docs/cli/commands/login.mdx index 16fef7985..d55b3b7f9 100644 --- a/docs/cli/commands/login.mdx +++ b/docs/cli/commands/login.mdx @@ -453,8 +453,6 @@ The login command supports a number of flags that you can use for different auth ``` - - ```bash infisical login --oidc-jwt= @@ -468,6 +466,7 @@ The login command supports a number of flags that you can use for different auth + ### User Authentication Examples From 4116dde66feebda93f9480176c36bc66c994e43d Mon Sep 17 00:00:00 2001 From: Your Name Date: Wed, 22 Oct 2025 09:42:29 -0300 Subject: [PATCH 4/7] docs: clarify login command flags and their requirements for non-interactive authentication --- docs/cli/commands/login.mdx | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/docs/cli/commands/login.mdx b/docs/cli/commands/login.mdx index d55b3b7f9..a995cc382 100644 --- a/docs/cli/commands/login.mdx +++ b/docs/cli/commands/login.mdx @@ -406,7 +406,11 @@ The login command supports a number of flags that you can use for different auth ``` #### Description - Email address for direct user login. Must be used together with `--password` for non-interactive authentication. + User email address. Required if you want to do a non-interactive login when the **--method** flag is set to **user**. Must be used together with the `--password` flag. + + + You can omit the **--method=user** if you want as it's the default method. + The `email` flag can be substituted with the `INFISICAL_EMAIL` environment variable. @@ -419,12 +423,16 @@ The login command supports a number of flags that you can use for different auth ``` #### Description - Password for direct user login. Must be used together with `--email` for non-interactive authentication. + User password. Required if you want to do a non-interactive login when the **--method** flag is set to **user**. Must be used together with the `--email` flag. For security in CI/CD environments, prefer using the `INFISICAL_PASSWORD` environment variable instead of passing the password as a command-line flag. + + You can omit the **--method=user** if you want as it's the default method. + + The `password` flag can be substituted with the `INFISICAL_PASSWORD` environment variable. From 9bf8e2a4f447ca12c7f23dab908965c13d9e0bbd Mon Sep 17 00:00:00 2001 From: Victor Santos Date: Wed, 22 Oct 2025 23:40:27 -0300 Subject: [PATCH 5/7] docs: update login command documentation to include silent flag usage and improve accordion structure --- docs/cli/commands/login.mdx | 98 ++++++++++++++++++++----------------- 1 file changed, 54 insertions(+), 44 deletions(-) diff --git a/docs/cli/commands/login.mdx b/docs/cli/commands/login.mdx index a995cc382..9cfdc9645 100644 --- a/docs/cli/commands/login.mdx +++ b/docs/cli/commands/login.mdx @@ -22,10 +22,12 @@ If you have added multiple users, you can switch between the users by using the **JWT Token Output:** - - For **user authentication** with the `--plain` flag: outputs only the JWT access token (useful for scripting) + - For **user authentication** with the `--plain --silent` flags: outputs only the JWT access token (useful for scripting) - For **machine identity authentication**: an access token is always printed to the console - Use the `--plain` flag to print only the token in plain text, which is ideal for capturing in environment variables or CI/CD pipelines. + Use the `--plain` flag to print only the token in plain text and the `--silent` flag to disable update alerts. + + Both flags are ideal for capturing the token in environment variables or CI/CD pipelines. ### Authentication Methods @@ -61,34 +63,33 @@ User authentication is designed for individual developers and supports multiple - - - **Browser Login (Default)** - ```bash - infisical login - ``` - - **Direct Login (CI/CD)** - ```bash - infisical login --email=user@example.com --password=your-password - - # Or using environment variables - export INFISICAL_EMAIL="user@example.com" - export INFISICAL_PASSWORD="your-password" - infisical login - ``` - - **Interactive CLI Login** - ```bash - infisical login --interactive - ``` - - **Plain Token Output (for scripting)** - ```bash - export INFISICAL_TOKEN=$(infisical login --email=user@example.com --password=your-password --plain) - ``` - - + + + ```bash + infisical login + ``` + + + ```bash + infisical login --email=user@example.com --password=your-password + + # Or using environment variables + export INFISICAL_EMAIL="user@example.com" + export INFISICAL_PASSWORD="your-password" + infisical login + ``` + + + ```bash + infisical login --interactive + ``` + + + ```bash + export INFISICAL_TOKEN=$(infisical login --email=user@example.com --password=your-password --plain --silent) + ``` + + @@ -457,9 +458,13 @@ The login command supports a number of flags that you can use for different auth ```bash # Example: Capture token in a variable - export INFISICAL_TOKEN=$(infisical login --email= --password= --plain) + export INFISICAL_TOKEN=$(infisical login --email= --password= --plain --silent) ``` + + Use it alongside the `silent` flag to disable all messages in the console except from the access token. + + ```bash @@ -481,6 +486,18 @@ The login command supports a number of flags that you can use for different auth The following examples demonstrate different ways to authenticate as a user with the Infisical CLI. + + By default, running `infisical login` without any flags opens your browser for authentication. + + ```bash + # Opens browser for authentication + infisical login + ``` + + The browser will open to the Infisical login page, and upon successful authentication, the CLI will be automatically authenticated. + + + Direct login is ideal for CI/CD pipelines and automation scripts where browser-based authentication is not possible. @@ -497,7 +514,7 @@ The following examples demonstrate different ways to authenticate as a user with infisical login --email user@example.com --password "your-password" --domain https://eu.infisical.com # Output only JWT token for scripting - export INFISICAL_TOKEN=$(infisical login --email user@example.com --password "your-password" --plain) + export INFISICAL_TOKEN=$(infisical login --email user@example.com --password "your-password" --plain --silent) ``` #### Using Environment Variables (Recommended for CI/CD) @@ -512,7 +529,7 @@ The following examples demonstrate different ways to authenticate as a user with infisical login # Or with plain output for token capture - export INFISICAL_TOKEN=$(infisical login --plain) + export INFISICAL_TOKEN=$(infisical login --plain --silent) ``` @@ -530,19 +547,12 @@ The following examples demonstrate different ways to authenticate as a user with - - By default, running `infisical login` without any flags opens your browser for authentication. - - ```bash - # Opens browser for authentication - infisical login - ``` - - The browser will open to the Infisical login page, and upon successful authentication, the CLI will be automatically authenticated. - - + +If you have SSO enabled, we recommend using the default browser login. + + ### Machine Identity Authentication Quick Start In this example we'll be using the `universal-auth` method to login to obtain an Infisical access token, which we will then use to fetch secrets with. From 91a183fa2549d81e1d996f3382b3970faede74ca Mon Sep 17 00:00:00 2001 From: Daniel Hougaard Date: Thu, 23 Oct 2025 12:22:29 +0400 Subject: [PATCH 6/7] Update login.mdx --- docs/cli/commands/login.mdx | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-) diff --git a/docs/cli/commands/login.mdx b/docs/cli/commands/login.mdx index 9cfdc9645..4eeae76e0 100644 --- a/docs/cli/commands/login.mdx +++ b/docs/cli/commands/login.mdx @@ -84,7 +84,7 @@ User authentication is designed for individual developers and supports multiple infisical login --interactive ``` - + ```bash export INFISICAL_TOKEN=$(infisical login --email=user@example.com --password=your-password --plain --silent) ``` @@ -504,13 +504,10 @@ The following examples demonstrate different ways to authenticate as a user with #### Using Command-Line Flags ```bash - # Basic direct login + # Basic direct login (defaults to US Cloud) infisical login --email user@example.com --password "your-password" - # With custom domain (US Cloud) - infisical login --email user@example.com --password "your-password" --domain https://app.infisical.com - - # With custom domain (EU Cloud) + # EU Cloud (Custom domain) infisical login --email user@example.com --password "your-password" --domain https://eu.infisical.com # Output only JWT token for scripting @@ -523,7 +520,6 @@ The following examples demonstrate different ways to authenticate as a user with # Set credentials as environment variables export INFISICAL_EMAIL="user@example.com" export INFISICAL_PASSWORD="your-password" - export INFISICAL_API_URL="https://app.infisical.com/api" # Login without additional flags infisical login From 5699b7dfd02892f00de4167a3b97171bbf46af3b Mon Sep 17 00:00:00 2001 From: Daniel Hougaard Date: Thu, 23 Oct 2025 12:27:03 +0400 Subject: [PATCH 7/7] fix: remove mentions of oidc-jwt --- docs/cli/commands/login.mdx | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/docs/cli/commands/login.mdx b/docs/cli/commands/login.mdx index 4eeae76e0..1f7a08350 100644 --- a/docs/cli/commands/login.mdx +++ b/docs/cli/commands/login.mdx @@ -308,7 +308,7 @@ Machine identity authentication methods are designed for automated systems, serv Run the `login` command with the following flags to obtain an access token: ```bash - infisical login --method=jwt-auth --jwt= --machine-identity-id= + infisical login --method=jwt-auth --jwt= --machine-identity-id= ``` @@ -333,7 +333,8 @@ The login command supports a number of flags that you can use for different auth - `gcp-id-token`: Login using a GCP ID token native auth. - `gcp-iam`: Login using a GCP IAM. - `aws-iam`: Login using an AWS IAM native auth. - - `oidc-auth`: Login using oidc auth. + - `oidc-auth`: Login using OIDC auth. + - `jwt-auth`: Login using a plain JWT token. @@ -466,16 +467,16 @@ The login command supports a number of flags that you can use for different auth - + ```bash - infisical login --oidc-jwt= + infisical login --jwt= --machine-identity-id= ``` #### Description - The JWT provided by an identity provider for OIDC authentication. + The JWT provided by an identity provider for OIDC or plain JWT authentication. This is required if the `--method` flag is set to `oidc-auth` or `jwt-auth`. - The `oidc-jwt` flag can be substituted with the `INFISICAL_OIDC_AUTH_JWT` environment variable. + The `jwt` flag can be substituted with the `INFISICAL_JWT` environment variable.