Infisical

https://infisical.com/docs/documentation
Admin
Infisical is an open-source platform for securely managing secrets, certificates, and secure...
Tokens:594,235
Snippets:4,823
Trust Score:9.9
Update:2 weeks ago
Show doc for...
Tokens:
Raw
### Install and start gateway with token auth (systemd)

Source: https://infisical.com/docs/documentation/platform/gateways/gateway-deployment

Installs and starts the gateway as a systemd service for token enrollment on Linux production. The enrollment token is one-time with 1h expiry.

```bash
sudo infisical gateway systemd install <gateway-name> \
  --enroll-method=token \
  --token=<enrollment-token> \
  --domain=<your-infisical-domain>
sudo systemctl start <gateway-name>
```

--------------------------------

### Agent startup output

Source: https://infisical.com/docs/documentation/platform/pam/ai-agents/overview

Example output printed before the agent starts, showing the proxies ready for the agent, accounts awaiting approval, and accounts not started with reasons.

```text
  Infisical PAM proxies ready for claude

    127.0.0.1:52431  prod/orders-db (PostgreSQL)
    127.0.0.1:52432  prod/bastion (SSH)
    127.0.0.1:52433  prod/payments-db (PostgreSQL)  [awaiting approval]

  Not started:
    prod/legacy-db: you don't have permission to launch sessions for this account

  Proxy logs: /Users/you/.infisical/pam-agentic/access.log
```

--------------------------------

### Token Auth: Install and start KMIP server

Source: https://infisical.com/docs/documentation/platform/kms/kmip

Enroll and start the KMIP server using token authentication. The first command installs a systemd service and starts it; the second runs it in the foreground. Replace placeholders with your server name, enrollment token, listen address, and Infisical domain.

```bash
sudo infisical kmip systemd install <server-name> \
  --enroll-method=token \
  --token=<enrollment-token> \
  --listen-address="0.0.0.0:5696" \
  --domain=<your-infisical-domain>
sudo systemctl start infisical-kmip
```

```bash
infisical kmip start <server-name> \
  --enroll-method=token \
  --token=<enrollment-token> \
  --listen-address="0.0.0.0:5696" \
  --domain=<your-infisical-domain>
```

--------------------------------

### Install Gateway with systemd and PKCS#11 module

Source: https://infisical.com/docs/documentation/platform/pki/settings/hsm-connectors-fortanix-dsm

Append --pkcs11-module=/opt/fortanix/pkcs11/fortanix_pkcs11.so to the systemd install command, then start the Gateway service. The Gateway logs a line confirming the PKCS#11 module loaded.

```bash
sudo infisical gateway systemd install <gateway-name> \
  --enroll-method=token \
  --token=<enrollment-token> \
  --domain=<your-infisical-domain> \
  --pkcs11-module=/opt/fortanix/pkcs11/fortanix_pkcs11.so
sudo systemctl start <gateway-name>

```

--------------------------------

### Install and start gateway with AWS auth (systemd)

Source: https://infisical.com/docs/documentation/platform/gateways/gateway-deployment

Installs and starts the gateway as a systemd service using AWS IAM authentication. The host must have AWS credentials whose principal matches the allowlist.

```bash
sudo infisical gateway systemd install <gateway-name> \
  --enroll-method=aws \
  --gateway-id=<gateway-id> \
  --domain=<your-infisical-domain>
sudo systemctl start <gateway-name>
```

--------------------------------

### Install gateway as systemd service with GCP auth (Compute Engine)

Source: https://infisical.com/docs/documentation/platform/gateways/gateway-deployment

Installs the gateway as a systemd service using GCP enrollment, then starts it. The gateway re-authenticates on every start.

```bash
sudo infisical gateway systemd install <gateway-name> \
  --enroll-method=gcp \
  --gateway-id=<gateway-id> \
  --domain=<your-infisical-domain>
sudo systemctl start <gateway-name>

```

--------------------------------

### Start Gateway in foreground with PKCS#11 module

Source: https://infisical.com/docs/documentation/platform/pki/settings/hsm-connectors-fortanix-dsm

Start the Gateway in the foreground with the PKCS#11 module attached. Use this instead of the systemd install command when running the Gateway directly.

```bash
infisical gateway start <gateway-name> \
  --enroll-method=token \
  --token=<enrollment-token> \
  --domain=<your-infisical-domain> \
  --pkcs11-module=/opt/fortanix/pkcs11/fortanix_pkcs11.so

```

--------------------------------

### Verify Certbot Installation

Source: https://infisical.com/docs/documentation/platform/pki/guides/applications/apache-certbot

Verifies that Certbot is installed correctly after following the official installation guide.

```bash
certbot --version

```

--------------------------------

### Start the Agent

Source: https://infisical.com/docs/documentation/platform/pki/guides/applications/infisical-agent

Start the Infisical Agent with the created configuration file.

```bash
infisical cert-manager agent --config /etc/infisical/agent-config.yaml
```

--------------------------------

### AWS Auth: Install and start KMIP server

Source: https://infisical.com/docs/documentation/platform/kms/kmip

Enroll and start the KMIP server using AWS authentication. The host must have AWS credentials whose principal matches your allowlist; the server re-authenticates via STS on every start. The first command installs a systemd service and starts it; the second runs it in the foreground.

```bash
sudo infisical kmip systemd install <server-name> \
  --enroll-method=aws \
  --kmip-server-id=<kmip-server-id> \
  --listen-address="0.0.0.0:5696" \
  --domain=<your-infisical-domain>
sudo systemctl start infisical-kmip
```

```bash
infisical kmip start <server-name> \
  --enroll-method=aws \
  --kmip-server-id=<kmip-server-id> \
  --listen-address="0.0.0.0:5696" \
  --domain=<your-infisical-domain>
```

--------------------------------

### Install sigstore-kms-infisical plugin

Source: https://infisical.com/docs/documentation/platform/kms/sigstore-cosign

Clone, build, and install the plugin binary to /usr/local/bin so the Sigstore library can invoke it via PATH.

```bash
git clone https://github.com/Infisical/sigstore-kms-infisical.git
cd sigstore-kms-infisical
go build -o sigstore-kms-infisical
cp sigstore-kms-infisical /usr/local/bin

```

--------------------------------

### Install gateway with token auth (Helm, inline token)

Source: https://infisical.com/docs/documentation/platform/gateways/gateway-deployment

Installs the gateway with token enrollment passing the token inline; the chart creates the Secret for you. The token is single-use.

```bash
helm install infisical-gateway infisical/infisical-gateway \
  --set gateway.name=<gateway-name> \
  --set gateway.enrollment.method=token \
  --set gateway.enrollment.token.value=<enrollment-token> \
  --set gateway.domain=<your-infisical-domain>
```

--------------------------------

### Install Infisical CLI on Alpine Linux

Source: https://infisical.com/docs/documentation/guides/local-development

Installs the Infisical CLI on Alpine Linux using the official setup script and apk.

```bash
apk add --no-cache bash sudo wget
wget -qO- 'https://artifacts-cli.infisical.com/setup.apk.sh' | sudo sh
apk update && sudo apk add infisical

```

--------------------------------

### Start gateway with token auth (foreground)

Source: https://infisical.com/docs/documentation/platform/gateways/gateway-deployment

Runs the gateway in the foreground with token enrollment. The token is one-time, and the gateway needs persistent storage to survive restarts.

```bash
infisical gateway start <gateway-name> \
  --enroll-method=token \
  --token=<enrollment-token> \
  --domain=<your-infisical-domain>
```

--------------------------------

### Build PKCS#11 module from source

Source: https://infisical.com/docs/documentation/platform/pki/code-signing/pkcs11-module

Clone the repository and run make build. Requires Go 1.24+ and a C compiler. The output binary is placed in the current directory.

```bash
git clone https://github.com/Infisical/infisical-pkcs-11.git
cd infisical-pkcs-11
make build

```

--------------------------------

### Start Azure CLI session with infisical pam access

Source: https://infisical.com/docs/documentation/platform/pam/accounts/azure-cli

Starts an isolated, authenticated shell for the session. Requires the Azure CLI (az) to be installed locally. The command does not touch your own az login.

```bash
infisical pam access my-folder/prod-reader
```

--------------------------------

### Enroll proxy via CLI

Source: https://infisical.com/docs/documentation/platform/agent-vault/proxies

Run this command on the machine where the proxy will run. Replace <enrollment-token> and <your-instance-url> with the values from the Enrollment Token dialog.

```bash
infisical agent-vault proxy \
  --enrollment-token <enrollment-token> \
  --domain <your-instance-url>

```

--------------------------------

### Start a GCP PAM session with infisical pam access

Source: https://infisical.com/docs/documentation/platform/pam/accounts/gcp-service-account

Starts a PAM session for the specified GCP service account path. Requires the gcloud CLI to be installed locally. Automatically configures gcloud for the session.

```bash
infisical pam access my-folder/prod-deployer
```

--------------------------------

### Install Gateway with systemd and --pkcs11-module

Source: https://infisical.com/docs/documentation/platform/pki/settings/hsm-connectors

Use this command to install the Gateway as a systemd service with PKCS#11 enabled. The systemd unit captures the --pkcs11-module flag, so restarts pick up the same driver. Replace placeholders with your actual gateway name, enrollment token, domain, and driver path.

```bash
sudo infisical gateway systemd install <gateway-name> \
  --enroll-method=token \
  --token=<enrollment-token> \
  --domain=<your-infisical-domain> \
  --pkcs11-module=/opt/fortanix/pkcs11/fortanix_pkcs11.so
sudo systemctl start <gateway-name>
```

--------------------------------

### Install cosign with PKCS#11 support via go install

Source: https://infisical.com/docs/documentation/platform/pki/guides/code-signing/cosign

Installs cosign from source with the pkcs11key build tag enabled, as pre-built binaries lack PKCS#11 support.

```bash
CGO_ENABLED=1 go install -tags pkcs11key github.com/sigstore/cosign/v2/cmd/cosign@latest

```

--------------------------------

### Start Agent Proxy with CLI

Source: https://infisical.com/docs/documentation/platform/agent-proxy/standalone-agent-proxy

Starts the Agent Proxy under a process supervisor. Requires the CLI installed and the identity's credentials exported as environment variables. Optionally set INFISICAL_DOMAIN for EU Cloud or self-hosted instances.

```bash
export INFISICAL_UNIVERSAL_AUTH_CLIENT_ID=<agent-proxy-client-id>
export INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET=<agent-proxy-client-secret>
# export INFISICAL_DOMAIN=https://eu.infisical.com   # EU Cloud or self-hosted

infisical secrets agent-proxy start

```

--------------------------------

### Install Intermediate CA Certificate Manually

Source: https://infisical.com/docs/documentation/platform/pki/ca/private-ca

Workflow to install a certificate for an intermediate CA using the Manual method. Get the CSR, use it with an external root CA to generate a signed certificate, then import the certificate and chain back.

```bash
curl --location --request GET ‘https://app.infisical.com/api/v1/cert-manager/ca/internal/<intermediate-ca-id>/csr’ \
  --header ‘Authorization: Bearer <access-token>’
```

```bash
curl --location --request POST ‘https://app.infisical.com/api/v1/cert-manager/ca/internal/<intermediate-ca-id>/import-certificate’ \
  --header ‘Authorization: Bearer <access-token>’ \
  --header ‘Content-Type: application/json’ \
  --data-raw ‘{
      "certificate": "<certificate-from-external-ca>",
      "certificateChain": "<external-root-ca-certificate>"
  }’
```
Tokens:
Raw