Gabriel Brown
89761a7da3
Agent instructions, skills, SSH host aliases and expansion triggers are worth having identical on every machine one person owns, and belong in none of the shared configuration. They live in user/ now, with a manifest saying where each piece goes and a link-user stage that puts it there. That stage does nothing unless the machine said yes. Somebody who clones Panama to try the desktop keeps their own ~/.claude/CLAUDE.md exactly where it was; the question names the destinations and defaults to no. Anything displaced goes to config/old rather than being deleted. ~/.claude/CLAUDE.md and ~/.codex/AGENTS.md were byte-identical copies of one file, which is the drift this exists to prevent. Also adds the vitals toggles for the battery and Claude usage readouts, which had preferences and no way to reach them.
181 lines
4.0 KiB
Markdown
181 lines
4.0 KiB
Markdown
# Authentication
|
|
|
|
Infisical supports multiple authentication methods. Machine identity Universal Auth is the recommended approach for production use.
|
|
|
|
## Universal Auth (Recommended)
|
|
|
|
Universal Auth is the preferred machine identity authentication method for all use cases.
|
|
|
|
### Login Endpoint
|
|
|
|
```
|
|
POST /api/v1/auth/universal-auth/login
|
|
```
|
|
|
|
### Request Body
|
|
|
|
```json
|
|
{
|
|
"clientId": "string",
|
|
"clientSecret": "string"
|
|
}
|
|
```
|
|
|
|
### Response
|
|
|
|
```json
|
|
{
|
|
"accessToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
|
|
"expiresIn": 3600,
|
|
"accessTokenMaxTTL": 86400,
|
|
"tokenType": "Bearer"
|
|
}
|
|
```
|
|
|
|
### Example cURL
|
|
|
|
```bash
|
|
curl -X POST https://us.infisical.com/api/v1/auth/universal-auth/login \
|
|
-H "Content-Type: application/json" \
|
|
-d '{
|
|
"clientId": "YOUR_CLIENT_ID",
|
|
"clientSecret": "YOUR_CLIENT_SECRET"
|
|
}'
|
|
```
|
|
|
|
### Using the Token
|
|
|
|
Include the token in all subsequent requests as a Bearer token:
|
|
|
|
```bash
|
|
curl -X GET https://us.infisical.com/api/v4/secrets?projectId=PROJECT_ID&environment=dev \
|
|
-H "Authorization: Bearer YOUR_ACCESS_TOKEN"
|
|
```
|
|
|
|
## Alternative Auth Methods
|
|
|
|
Infisical supports additional authentication methods for machine identities:
|
|
|
|
### AWS Auth
|
|
|
|
```
|
|
POST /api/v1/auth/aws-auth/login
|
|
```
|
|
|
|
Login with AWS IAM credentials. Useful for AWS-hosted applications.
|
|
|
|
### Azure Auth
|
|
|
|
```
|
|
POST /api/v1/auth/azure-auth/login
|
|
```
|
|
|
|
Login with Azure managed identity. Ideal for Azure-hosted applications.
|
|
|
|
### GCP Auth
|
|
|
|
```
|
|
POST /api/v1/auth/gcp-auth/login
|
|
```
|
|
|
|
Login with GCP service account. Recommended for Google Cloud deployments.
|
|
|
|
### Kubernetes Auth
|
|
|
|
```
|
|
POST /api/v1/auth/kubernetes-auth/login
|
|
```
|
|
|
|
Login with Kubernetes service account token. Perfect for containerized workloads.
|
|
|
|
### OIDC Auth
|
|
|
|
```
|
|
POST /api/v1/auth/oidc-auth/login
|
|
```
|
|
|
|
Login via OpenID Connect provider. Supports any OIDC-compliant provider.
|
|
|
|
### JWT Auth
|
|
|
|
```
|
|
POST /api/v1/auth/jwt-auth/login
|
|
```
|
|
|
|
Login with custom JWT. Useful for custom authentication systems.
|
|
|
|
### LDAP Auth
|
|
|
|
```
|
|
POST /api/v1/auth/ldap-auth/login
|
|
```
|
|
|
|
Login with LDAP credentials. Enterprise directory integration.
|
|
|
|
## Token Refresh
|
|
|
|
Access tokens expire after the `expiresIn` seconds returned in the login response. For long-lived integrations, implement token refresh logic:
|
|
|
|
```javascript
|
|
// Pseudocode for token refresh
|
|
let tokenExpiresAt = Date.now() + (expiresIn * 1000);
|
|
|
|
async function getValidToken() {
|
|
if (Date.now() >= tokenExpiresAt - 60000) {
|
|
// Refresh within 1 minute of expiry
|
|
const response = await login(clientId, clientSecret);
|
|
token = response.accessToken;
|
|
tokenExpiresAt = Date.now() + (response.expiresIn * 1000);
|
|
}
|
|
return token;
|
|
}
|
|
```
|
|
|
|
The `accessTokenMaxTTL` value indicates the maximum lifetime of the token from issuance (typically 24 hours), which may be shorter than the server's token validity window.
|
|
|
|
## Deprecated: Service Tokens
|
|
|
|
Service tokens (prefixed with `st.`) are deprecated and should not be used in new code. They lack:
|
|
- Fine-grained permission controls
|
|
- Machine identity features
|
|
- Audit logging capabilities
|
|
- Rotation enforcement
|
|
|
|
Migrate all service token usage to machine identities with Universal Auth.
|
|
|
|
## Region Selection
|
|
|
|
Choose the appropriate Infisical region endpoint:
|
|
|
|
- **US Region**: `https://us.infisical.com`
|
|
- **EU Region**: `https://eu.infisical.com`
|
|
- **Self-Hosted**: Use your custom domain (e.g., `https://secrets.mycompany.com`)
|
|
|
|
## Headers
|
|
|
|
All authentication requests must include:
|
|
|
|
```
|
|
Content-Type: application/json
|
|
```
|
|
|
|
## Common Issues
|
|
|
|
### 401 Unauthorized
|
|
|
|
- Verify clientId and clientSecret are correct
|
|
- Confirm the token hasn't expired
|
|
- Check that the Bearer token is included in the Authorization header
|
|
|
|
### 403 Forbidden
|
|
|
|
- Machine identity may not have permission for the requested resource
|
|
- Verify identity auth method is configured for the project
|
|
- Check role-based access controls (RBAC) in the project
|
|
|
|
### 404 Not Found
|
|
|
|
- Confirm you're using the correct endpoint URL
|
|
- Verify the projectId exists and is accessible
|
|
- Check that the region (us.infisical.com vs eu.infisical.com) matches your deployment
|