mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-09-22 13:39:35 +00:00
65 lines
1.6 KiB
Plaintext
65 lines
1.6 KiB
Plaintext
---
|
|
title: "Create secrets"
|
|
---
|
|
|
|
In this example, we demonstrate how to add secrets to a project and environment.
|
|
|
|
Prerequisites:
|
|
|
|
- Set up and add envars to [Infisical Cloud](https://app.infisical.com)
|
|
- Grasp a basic understanding of the system and its underlying cryptography [here](/api-reference/overview/introduction).
|
|
|
|
## Flow
|
|
|
|
1. Get your (encrypted) private key.
|
|
2. Decrypt your (encrypted) private key with your password.
|
|
3. Get the project key for the project.
|
|
4. Decrypt the project key with your private key.
|
|
5. Encrypt your secrets with the project key.
|
|
6. Send (encrypted) secrets to the Infical API
|
|
|
|
## Example
|
|
|
|
```js
|
|
const axios = require("axios");
|
|
const aes = require("aes-256-gcm");
|
|
const nacl = require("tweetnacl");
|
|
nacl.util = require("tweetnacl-util");
|
|
|
|
const WORKSPACE_KEY = "3a7a243eb62078c13f09203e75e8cb32";
|
|
|
|
const secretKey = "SOME_KEY";
|
|
const secretValue = "SOME_VALUE";
|
|
|
|
// encrypt key of secret
|
|
const {
|
|
ciphertext: secretKeyCiphertext,
|
|
iv: secretKeyIV,
|
|
tag: secretKeyTag,
|
|
} = aes.encrypt(secretKey, WORKSPACE_KEY);
|
|
|
|
// encrypt value of secret
|
|
const {
|
|
ciphertext: secretValueCiphertext,
|
|
iv: secretValueIV,
|
|
tag: secretValueTag,
|
|
} = aes.encrypt(secretKey, WORKSPACE_KEY);
|
|
|
|
// construct request body
|
|
const secret = {
|
|
secretKeyCiphertext,
|
|
secretKeyIV,
|
|
secretKeyTag,
|
|
secretValueCiphertext,
|
|
secretValueIV,
|
|
secretValueTag,
|
|
};
|
|
```
|
|
|
|
<Info>
|
|
This example uses [TweetNaCl.js](https://tweetnacl.js.org/#/), a port of
|
|
TweetNacl/Nacl, to perform asymmeric decryption of the project key but there
|
|
are ports of NaCl in every major language.
|
|
|
|
</Info>
|