Setup

Infisical CLI Setup & Verification

Install the Infisical CLI, authenticate it, and confirm it can reach a project. This is the first thing to do before any infisical run, secrets, export, or scan work.

1. Install the CLI

Pick the matching platform. Pin a version in production (github.com/Infisical/cli/releases).

# macOS (Homebrew)
brew install infisical/get-cli/infisical

# npm (any OS with Node)
npm install -g @infisical/cli

# Debian / Ubuntu
curl -1sLf 'https://artifacts-cli.infisical.com/setup.deb.sh' | sudo -E bash
sudo apt-get update && sudo apt-get install -y infisical

# RHEL / CentOS / Amazon Linux
curl -1sLf 'https://artifacts-cli.infisical.com/setup.rpm.sh' | sudo -E bash
sudo yum install infisical

# Alpine
apk add --no-cache bash sudo wget
wget -qO- 'https://artifacts-cli.infisical.com/setup.apk.sh' | sudo sh
apk update && sudo apk add infisical

# Windows (Scoop)
scoop bucket add org https://github.com/Infisical/scoop-infisical.git
scoop install infisical

# Arch (AUR)
yay -S infisical-bin

Confirm the binary is on PATH:

infisical --version

2. Point at the right instance (self-hosted / EU)

The CLI defaults to US Cloud (https://app.infisical.com). For self-hosted or EU, set the API URL once in the environment so every command uses it — this avoids passing --domain on each call.

export INFISICAL_API_URL="https://your-instance.example.com"   # self-hosted
export INFISICAL_API_URL="https://eu.infisical.com"            # EU Cloud

If a reverse proxy (e.g. Cloudflare Access) fronts the instance, add its headers:

export INFISICAL_CUSTOM_HEADERS="Access-Client-Id=value Access-Client-Secret=value"

3. Authenticate

For interactive developer use, log in through the browser:

infisical login          # opens a browser
infisical login -i       # terminal prompts (use in WSL2, Codespaces, containers)

For CI/CD and automation, use a machine identity instead of a user login — see the ci-cd-auth skill.

On headless Linux where no system keyring exists, switch the credential store to an encrypted file before logging in (this is the standard fix for keyring errors):

infisical vault set file

4. Link a project

Run this in the project root to write .infisical.json (safe to commit — it holds no secrets, only the workspace ID and environment mapping):

cd /path/to/project
infisical init

5. Verify it works

Run a read against the linked project. A clean list confirms the CLI is installed, authenticated, and scoped correctly:

infisical secrets --env=dev

Then confirm injection works end-to-end:

infisical run --env=dev -- printenv | grep -i <a-known-secret-key>

Check the current session and credential store at any time:

infisical login status     # session validity
infisical vault            # active credential backend

What This Skill Does NOT Cover

• Machine-identity / OIDC / cloud-native auth for pipelines — see the ci-cd-auth skill
• Day-to-day run / secrets / export workflows — see the cli-recipes skill
• Secret scanning and pre-commit hooks — see the secret-scanning skill
• The full command and flag list — see the cli-reference skill
• Diagnosing errors — see the troubleshoot skill