# CLI Reference

> This skill should be used when the user asks for "Infisical CLI reference", "all Infisical commands", "Infisical CLI flags", "Infisical environment variables", "infisical command list", or needs the full command/flag/env-var reference for the Infisical CLI.

- Skill: `agents-store/cli-reference-4` (Agent Skill)
- Install (CLI): `npx skillmds@latest add agents-store/cli-reference-4`
- Raw SKILL.md: https://api.skillmd.com/api/skills/agents-store/cli-reference-4/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: agents-store (https://skillmd.com/u/agents-store)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/agents-store/cli-reference-4

---


# Infisical CLI Reference

Complete command, flag, and environment-variable reference. For task-oriented usage see the `cli-recipes`, `secret-scanning`, and `ci-cd-auth` skills. Full docs: https://infisical.com/docs/cli/overview

## Command index

| Command | Purpose |
|---------|---------|
| `infisical login` | Authenticate (user or machine identity) |
| `infisical login status` | Report session/credential validity |
| `infisical init` | Link the current dir to a project (`.infisical.json`) |
| `infisical run` | Inject secrets into a process as env vars |
| `infisical secrets` | List / get / set / delete secrets + folders |
| `infisical export` | Export secrets to dotenv/json/yaml/csv/template |
| `infisical dynamic-secrets` | List dynamic secrets; manage leases |
| `infisical scan` | Scan code/git history for hardcoded secrets |
| `infisical vault` | View/switch the local credential backend |
| `infisical user` | Switch profiles, change domain, print token |
| `infisical token` | Renew a machine-identity access token |
| `infisical service-token` | Create service tokens (DEPRECATED) |
| `infisical bootstrap` | Initialize a fresh self-hosted instance |
| `infisical ssh` | Issue/connect short-lived SSH access |
| `infisical reset` | Clear all local Infisical config/credentials |

## login

```
infisical login [--method=<m>] [flags]
```

| Flag | Env var | Notes |
|------|---------|-------|
| `--method` | — | `user` (default), `universal-auth`, `kubernetes`, `azure`, `gcp-id-token`, `gcp-iam`, `aws-iam`, `oidc-auth`, `jwt-auth` |
| `--client-id` / `--client-secret` | `INFISICAL_UNIVERSAL_AUTH_CLIENT_ID` / `..._CLIENT_SECRET` | Universal Auth |
| `--machine-identity-id` | `INFISICAL_MACHINE_IDENTITY_ID` | Native cloud methods |
| `--service-account-token-path` | `INFISICAL_KUBERNETES_SERVICE_ACCOUNT_TOKEN_PATH` | Kubernetes |
| `--service-account-key-file-path` | `INFISICAL_GCP_IAM_SERVICE_ACCOUNT_KEY_FILE_PATH` | GCP IAM |
| `--jwt` | `INFISICAL_JWT` | OIDC / JWT auth |
| `--email` / `--password` / `--organization-id` | `INFISICAL_EMAIL` / `INFISICAL_PASSWORD` / `INFISICAL_ORGANIZATION_ID` | Direct user login |
| `--interactive`, `-i` | — | Terminal prompts (no browser) |
| `--plain` | — | Output the raw JWT only |
| `--silent` | — | Suppress update notices |
| `--domain` | `INFISICAL_API_URL` | Self-hosted / EU API URL |

`infisical login status [--json] [--token=<t>]` — exit `0` if ≥1 valid session, `1` otherwise.

## init

```
infisical init    # interactive; writes .infisical.json (workspaceId, defaultEnvironment, gitBranchToEnvironmentMapping)
```

## run

```
infisical run [flags] -- <command>
infisical run [flags] --command="<chained shell>"
```

Flags: `--env`/`-e` (def `dev`), `--path` (def `/`, repeatable), `--projectId`, `--token`, `--tags`, `--expand` (def `true`), `--include-imports` (def `true`), `--secret-overriding` (def `true`), `--watch`, `--command`, `--project-config-dir`, `--domain`.

## secrets

```
infisical secrets [--env --path --projectId --token --plain --expand --include-imports]
infisical secrets get <KEY...> [--plain --silent]
infisical secrets set <KEY=VALUE...> [--type=shared|personal] [--file=<path>]   # KEY=@file loads from file
infisical secrets delete <KEY...>
infisical secrets folders [get|create|delete] --path=<p> [--name=<n>]
infisical secrets generate-example-env > .example-env
```

## export

```
infisical export [--format=dotenv|dotenv-export|json|yaml|csv] [--output-file=<f>] [--template=<f>] \
                 [--env --path --projectId --tags --expand --include-imports --secret-overriding --token]
```

## dynamic-secrets

```
infisical dynamic-secrets [--env --path --projectId --project-slug --token]
infisical dynamic-secrets lease create <name> [--ttl --plain --kubernetes-namespace --principals]
infisical dynamic-secrets lease list   <name>
infisical dynamic-secrets lease renew  <lease-id> [--ttl]
infisical dynamic-secrets lease delete <lease-id>
```

## scan

```
infisical scan [-s --source] [-c --config] [-b --baseline-path] [-r --report-path]
               [-f --report-format=json|csv|sarif] [--exit-code=1] [--redact] [-v --verbose]
               [--no-git] [--log-opts] [--max-target-megabytes] [--pipe] [--follow-symlinks]
infisical scan git-changes [--staged] [-v]
infisical scan install --pre-commit-hook
```

## vault / user / token / reset

```
infisical vault                 # show backend
infisical vault set <auto|file|keychain>
infisical user switch           # switch logged-in profiles
infisical user update domain    # change a profile's API URL
infisical user get token [--plain]
infisical token renew <ua-access-token>
infisical reset                 # clear all local config/credentials
```

## bootstrap

```
infisical bootstrap --domain --email --password --organization
                    [--ignore-if-bootstrapped] [--output=k8-secret]
                    [--k8-secret-template --k8-secret-name --k8-secret-namespace]
```
Env vars: `INFISICAL_ADMIN_EMAIL`, `INFISICAL_ADMIN_PASSWORD`, `INFISICAL_ADMIN_ORGANIZATION`.

## ssh

```
infisical ssh connect  [--hostname --login-user --write-host-ca-to-file --out-file-path --token]
infisical ssh add-host --projectId --hostname [--alias --configure-sshd
                       --write-user-ca-to-file --user-ca-out-file-path --write-host-cert-to-file --force --token]
```

## Environment variables

| Variable | Purpose |
|----------|---------|
| `INFISICAL_TOKEN` | Machine-identity / service-token auth (auto-detected) |
| `INFISICAL_API_URL` | Backend URL for self-hosted / EU (= `--domain`) |
| `INFISICAL_DISABLE_UPDATE_CHECK` | `true` to skip version checks (use in CI/prod) |
| `INFISICAL_CUSTOM_HEADERS` | Space-separated `name=value` extra HTTP headers (reverse-proxy auth) |
| `INFISICAL_SCAN_CONFIG` | Path to a scan TOML config |
| `INFISICAL_UNIVERSAL_AUTH_CLIENT_ID` / `..._CLIENT_SECRET` | Universal Auth credentials |
| `INFISICAL_MACHINE_IDENTITY_ID` | Native cloud auth methods |
| `INFISICAL_JWT` | OIDC / JWT auth |
| `INFISICAL_EMAIL` / `INFISICAL_PASSWORD` / `INFISICAL_ORGANIZATION_ID` | Direct user login |
| `INFISICAL_ADMIN_EMAIL` / `INFISICAL_ADMIN_PASSWORD` / `INFISICAL_ADMIN_ORGANIZATION` | Bootstrap |

## Deprecations

- **Service tokens** (`infisical service-token create`) — use machine identities instead.
- **`--raw-value`** — replaced by `--plain`.
- `infisical kms` and `infisical agent` are **not** current CLI commands (KMS is API/UI only). Verify with `infisical <cmd> --help` against your binary before relying on them.