setup

name	setup
description	This skill should be used when the user asks to "install Infisical CLI", "set up Infisical CLI", "log in to Infisical", "authenticate Infisical CLI", "verify Infisical is working", "is Infisical CLI working", "point Infisical at self-hosted", or needs to get the Infisical CLI installed, authenticated, and confirmed operational.

Infisical CLI Setup & Verification

Install the Infisical CLI, authenticate it, and confirm it can reach a project. This is the first thing to do before any infisical run, secrets, export, or scan work.

1. Install the CLI

Pick the matching platform. Pin a version in production (github.com/Infisical/cli/releases).

# macOS (Homebrew)
brew install infisical/get-cli/infisical

# npm (any OS with Node)
npm install -g @infisical/cli

# Debian / Ubuntu
curl -1sLf 'https://artifacts-cli.infisical.com/setup.deb.sh' | sudo -E bash
sudo apt-get update && sudo apt-get install -y infisical

# RHEL / CentOS / Amazon Linux
curl -1sLf 'https://artifacts-cli.infisical.com/setup.rpm.sh' | sudo -E bash
sudo yum install infisical

# Alpine
apk add --no-cache bash sudo wget
wget -qO- 'https://artifacts-cli.infisical.com/setup.apk.sh' | sudo sh
apk update && sudo apk add infisical

# Windows (Scoop)
scoop bucket add org https://github.com/Infisical/scoop-infisical.git
scoop install infisical

# Arch (AUR)
yay -S infisical-bin

Confirm the binary is on PATH:

infisical --version

2. Point at the right instance (self-hosted / EU)

The CLI defaults to US Cloud (https://app.infisical.com). For self-hosted or EU, set the API URL once in the environment so every command uses it — this avoids passing --domain on each call.

export INFISICAL_API_URL="https://your-instance.example.com"   # self-hosted
export INFISICAL_API_URL="https://eu.infisical.com"            # EU Cloud

If a reverse proxy (e.g. Cloudflare Access) fronts the instance, add its headers:

export INFISICAL_CUSTOM_HEADERS="Access-Client-Id=value Access-Client-Secret=value"

3. Authenticate

For interactive developer use, log in through the browser:

infisical login          # opens a browser
infisical login -i       # terminal prompts (use in WSL2, Codespaces, containers)

For CI/CD and automation, use a machine identity instead of a user login — see the ci-cd-auth skill.

On headless Linux where no system keyring exists, switch the credential store to an encrypted file before logging in (this is the standard fix for keyring errors):

infisical vault set file

4. Link a project

Run this in the project root to write .infisical.json (safe to commit — it holds no secrets, only the workspace ID and environment mapping):

cd /path/to/project
infisical init

5. Verify it works

Run a read against the linked project. A clean list confirms the CLI is installed, authenticated, and scoped correctly:

infisical secrets --env=dev

Then confirm injection works end-to-end:

infisical run --env=dev -- printenv | grep -i <a-known-secret-key>

Check the current session and credential store at any time:

infisical login status     # session validity
infisical vault            # active credential backend

What This Skill Does NOT Cover

• Machine-identity / OIDC / cloud-native auth for pipelines — see the ci-cd-auth skill
• Day-to-day run / secrets / export workflows — see the cli-recipes skill
• Secret scanning and pre-commit hooks — see the secret-scanning skill
• The full command and flag list — see the cli-reference skill
• Diagnosing errors — see the troubleshoot skill