> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# CLI quickstart

> Get started with the Infisical CLI.

Every Infisical product that has a CLI workflow starts the same way: install the CLI, log in, and check that the CLI can reach your Infisical instance. This page covers those steps, then links to the command reference.

> [!TIP]
>
> If you prefer to learn by watching, follow along with our [video walkthrough of the Infisical CLI](https://www.youtube.com/watch?v=WQz6BCygORA).

## Prerequisites

* An Infisical account on [Infisical Cloud](https://app.infisical.com) or on a [self-hosted instance](https://infisical.com/docs/self-hosting/overview.md)

## Step 1: Install the CLI

Install the CLI with the package manager for your operating system.

```bash macOS theme={"dark"}
brew install infisical/get-cli/infisical
```

```bash Windows (winget) theme={"dark"}
winget install infisical
```

```bash Windows (Scoop) theme={"dark"}
scoop bucket add org https://github.com/Infisical/scoop-infisical.git
scoop install infisical
```

```bash npm theme={"dark"}
npm install -g @infisical/cli
```

```bash Debian/Ubuntu theme={"dark"}
curl -1sLf 'https://artifacts-cli.infisical.com/setup.deb.sh' | sudo -E bash
sudo apt-get update && sudo apt-get install -y infisical
```

```bash RedHat/CentOS/Amazon Linux theme={"dark"}
curl -1sLf 'https://artifacts-cli.infisical.com/setup.rpm.sh' | sudo -E bash
sudo yum install infisical
```

```bash Alpine theme={"dark"}
apk add --no-cache bash sudo wget
wget -qO- 'https://artifacts-cli.infisical.com/setup.apk.sh' | sudo sh
apk update && sudo apk add infisical
```

```bash Arch Linux theme={"dark"}
yay -S infisical-bin
```

Check that the installation worked:

```bash theme={"dark"}
infisical --version
```

## Step 2: Log in

Log in with your own account when you run the CLI yourself, such as on your laptop during local development. Log in as a [machine identity](https://infisical.com/docs/documentation/platform/identities/machine-identities.md) when the CLI runs without you, such as in a CI/CD pipeline, a container, a scheduled job, or a script on a shared server.

> [!NOTE]
>
> If your Infisical instance is behind a service that requires its own headers, such as Cloudflare Access, [ set those up first](https://infisical.com/docs/cli/faq.md#how-do-i-use-custom-headers-with-the-infisical-cli).

> [tab] Your own account
>
> Authenticate the CLI with your Infisical account.
>
> ```bash theme={"dark"}
> infisical login
> ```
>
> The prompt asks which instance you want to use. Select **Infisical Cloud (US Region)**, **Infisical Cloud (EU Region)**, or **Self-Hosting or Dedicated Instance**, then finish signing in through your browser.
>
> > [!NOTE]
> >
> > On a machine with no browser, such as a remote SSH session, WSL 2, or Codespaces, run `infisical login -i` to log in from the terminal instead.
>
> The CLI saves the instance you select with your login, so later commands use it without asking again.

> [tab] Machine identity
>
> **Step 1**
>
> Follow the [Universal Auth guide](https://infisical.com/docs/documentation/platform/identities/universal-auth.md) to create a machine identity and get a **Client ID** and **Client Secret** for it.
>
> **Step 2**
>
> If you use EU Cloud, a dedicated instance, or a self-hosted instance, set `INFISICAL_DOMAIN` to the address of your instance. A machine identity login doesn't save the instance, so without `INFISICAL_DOMAIN` every command goes to US Cloud (`https://app.infisical.com`).
>
> ```bash macOS/Linux theme={"dark"}
> export INFISICAL_DOMAIN="https://your-domain.infisical.com"
> ```
>
> ```powershell Windows (PowerShell) theme={"dark"}
> setx INFISICAL_DOMAIN "https://your-domain.infisical.com"
> ```
>
> On Windows, `setx` saves the variable for new sessions only, so restart PowerShell before you run the next command.
>
> To set the instance another way, such as with the `--domain` flag or in `.infisical.yaml`, see [Set the Infisical instance](https://infisical.com/docs/cli/project-config.md#set-the-infisical-instance).
>
> **Step 3**
>
> Log in with the client ID and client secret, and store the access token in the `INFISICAL_TOKEN` environment variable:
>
> ```bash theme={"dark"}
> export INFISICAL_TOKEN=$(infisical login --method=universal-auth --client-id=<identity-client-id> --client-secret=<identity-client-secret> --silent --plain)
> ```
>
> `--plain` prints only the token, and `--silent` hides update and tip messages, so the command's output is just the token. The CLI reads `INFISICAL_TOKEN` automatically, so every later command in the same shell is authenticated.

## Step 3: Check that you're logged in

```bash theme={"dark"}
infisical login status
```

The CLI asks your Infisical instance whether your login is valid. If it is, the output starts with the account or machine identity you're logged in as, followed by the instance the CLI connected to:

```text theme={"dark"}
✓ Authenticated as <your-email-or-identity-name>
  - Domain: https://app.infisical.com
```

The lines after `Domain` include when your login expires and which organization it belongs to. If the output says `You are not authenticated`, log in again. If it says `Failed to authenticate`, check that the `Domain` line shows your instance, then log in again.

> [!TIP]
>
> You successfully installed and logged into the Infisical CLI.

## Next steps

Now that you've installed the CLI and logged in, you can start using its commands.

> [card] [Command reference](https://infisical.com/docs/cli/reference.md)
>
> See every CLI command, with its arguments, flags, and examples


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.