Infisical Python SDK

If you’re working with Python, the official Infisical Python SDK package is the easiest way to fetch and work with secrets for your application.

Migrating to version 1.0.3 or above

We have recently rolled out our first stable version of the SDK, version 1.0.3 and above. The 1.0.3 version comes with a few key changes that may change how you’re using the SDK.

Removal of rest: The SDK no longer exposes the entire Infisical API. This was nessecary as we have moved away from using an OpenAPI generator approach. We aim to add support for more API resources in the near future. If you have any specific requests, please open an issue.
New response types: The 1.0.3 release uses return types that differ from the older versions. The new return types such as BaseSecret, are all exported from the Infisical SDK.
Property renaming: Some properties on the responses have been slightly renamed. An example of this would be that the secret_key property on the get_secret_by_name() method, that has been renamed to secretKey.

With this in mind, you’re ready to upgrade your SDK version to 1.0.3 or above. You can refer to our legacy documentation if need be.

Requirements

Python 3.7+

Installation

pip install infisicalsdk

Getting Started

from infisical_sdk import InfisicalSDKClient

# Initialize the client
client = InfisicalSDKClient(host="https://app.infisical.com")

# Authenticate (example using Universal Auth)
client.auth.universal_auth.login(
    client_id="<machine-identity-client-id>", 
    client_secret="<machine-identity-client-secret>"
)

# Use the SDK to interact with Infisical
secrets = client.secrets.list_secrets(project_id="<project-id>", environment_slug="dev", secret_path="/")

InfisicalSDKClient Parameters

The InfisicalSDKClient takes the following parameters, which are used as a global configuration for the lifetime of the SDK instance.

host (str, Optional): The host URL for your Infisical instance. Defaults to https://app.infisical.com.
token (str, Optional): Specify an authentication token to use for all requests. If provided, you will not need to call any of the auth methods. Defaults to None
cache_ttl (int, Optional): The SDK has built-in client-side caching for secrets, greatly improving response times. By default, secrets are cached for 1 minute (60 seconds). You can disable caching by setting cache_ttl to None, or adjust the duration in seconds as needed.

client = InfisicalSDKClient(
  host="https://app.infisical.com", # Defaults to https://app.infisical.com
  token="<optional-auth-token>", # If not set, use the client.auth() methods.
  cache_ttl = 300 # `None` to disable caching
)

Core Methods

The SDK methods are organized into the following high-level categories:

auth: Handles authentication methods.
secrets: Manages CRUD operations for secrets.
kms: Perform cryptographic operations with Infisical KMS.

`auth`

The Auth component provides methods for authentication:

Universal Auth

response = client.auth.universal_auth.login(
    client_id="<machine-identity-client-id>", 
    client_secret="<machine-identity-client-secret>"
)

AWS Auth

response = client.auth.aws_auth.login(identity_id="<machine-identity-id>")

OIDC Auth

response = client.auth.oidc_auth.login(
    identity_id="<oidc-identity-id>",
    jwt="<your-oidc-jwt-token>"
)

Parameters:

identity_id (str): The ID of the OIDC identity configuration in Infisical.
jwt (str): The OIDC JWT token obtained from your identity provider.

This authentication method is useful when integrating with OIDC-compliant identity providers like Okta, Auth0, or any service that issues OIDC tokens.

`secrets`

This sub-class handles operations related to secrets: