Package: infisical
Open-source, end-to-end encrypted tool to manage secrets and configs across your team and infrastructure.Deprecated!This is now considered a legacy SDK, as we have released a new SDK that will be receiving all future updates.You can find it here.Table of ContentsLinksBasic UsageSecretsGet SecretsGet SecretCreate SecretUpdate SecretDelete SecretCryptographyCreate Symmetric KeyEncrypt SymmetricDecrypt SymmetricLinksInfisicalBasic UsagefromflaskimportFlaskfrominfisicalimportInfisicalClientapp=Flask(__name__)client=InfisicalClient(token="your_infisical_token")@app.route("/")defhello_world():# access valuename=client.get_secret("NAME",environment="dev",path="/")returnf"Hello! My name is:{name.secret_value}"This example demonstrates how to use the Infisical Python SDK with a Flask application. The application retrieves a secret named "NAME" and responds to requests with a greeting that includes the secret value.It is also possible to use the SDK to encrypt/decrypt text; the implementation usesaes-256-gcmwith components of the encryption/decryption encoded inbase64.frominfisicalimportInfisicalClientclient=InfisicalClient()# some plaintext you want to encryptplaintext='The quick brown fox jumps over the lazy dog'# create a base64-encoded, 256-bit symmetric keykey=client.create_symmetric_key()# encryptciphertext,iv,tag=client.encrypt_symmetric(plaintext,key)# decryptcleartext=client.decrypt_symmetric(ciphertext,key,iv,tag)InstallationYou need Python 3.7+.$pipinstallinfisicalConfigurationImport the SDK and create a client instance with yourInfisical Token.frominfisicalimportInfisicalClientclient=InfisicalClient(token="your_infisical_token")Using Infisical Token V3 (Beta):Inv1.5.0, we released a superior token authentication method; this credential is a JSON containing apublicKey,privateKey, andserviceTokenand can be used to initialize the Node SDK client instead of the regular service token.You can use this beta feature like so:frominfisicalimportInfisicalClientclient=InfisicalClient(token_json="your_infisical_token_v3_json")OptionsParameterTypeDescriptiontokenstringAn Infisical Token scoped to a project and environment(s).tokenJsonstringAn Infisical Token V3 JSON scoped to a project and environment(s) - in betasite_urlstringYour self-hosted Infisical site URL. Default:https://app.infisical.com.cache_ttlnumberTime-to-live (in seconds) for refreshing cached secrets. Default:300.debugbooleanTurns debug mode on or off. Default:false.CachingThe SDK caches every secret and updates it periodically based on the providedcache_ttl. For example, ifcache_ttlof300is provided, then a secret will be refetched 5 minutes after the first fetch; if the fetch fails, the cached secret is returned.SecretsGet Secretssecrets=client.get_all_secrets(environment="dev",path="/foo/bar/")Retrieve all secrets within a given environment and folder path. The service token used must have access to the given path and environment.Parametersenvironment(string): The slug name (dev, prod, etc) of the environment from where secrets should be fetched from.path(string): The path from where secrets should be fetched from.include_imports(boolean): Whether or not to include imported secrets from the current path. Read aboutsecret import. If not specified, the default value isTrue.attach_to_os_environ(boolean): Whether or not to attach fetched secrets toos.environ. If not specified, the default value isFalse.Get Secretsecret=client.get_secret("API_KEY",environment="dev",path="/")value=secret.secret_value# get its valueBy default,get_secret()fetches and returns a personal secret. If not found, it returns a shared secret, or tries to retrieve the value fromos.environ. If a secret is fetched,get_secret()caches it to reduce excessive calls and re-fetches periodically based on thecacheTTLoption (default is 300 seconds) when initializing the client — for more information, see the caching section.To explicitly retrieve a shared secret:secret=client.get_secret(secret_name="API_KEY",type="shared",environment="dev",path="/")value=secret.secret_value# get its valueParameterssecret_name(string): The key of the secret to retrieve.environment(string): The slug name (dev, prod, etc) of the environment from where secrets should be fetched from.path(string): The path from where secrets should be fetched from.type(string, optional): The type of the secret. Valid options are "shared" or "personal". If not specified, the default value is "personal".Create SecretCreate a new secret in Infisicalnew_api_key=client.create_secret("API_KEY","FOO",environment="dev",path="/",type="shared")Parameterssecret_name(string): The key of the secret to create.secret_value(string): The value of the secret.environment(string): The slug name (dev, prod, etc) of the environment from where secrets should be fetched from.path(string): The path from where secrets should be created.type(string, optional): The type of the secret. Valid options are "shared" or "personal". If not specified, the default value is "shared". A personal secret can only be created if a shared secret with the same name exists.Update SecretUpdate an existing secret in Infisicalupdated_api_key=client.update_secret("API_KEY","BAR",environment="dev",path="/",type="shared")Parameterssecret_name(string): The key of the secret to update.secret_value(string): The new value of the secret.environment(string): The slug name (dev, prod, etc) of the environment from where secrets should be fetched from.path(string): The path from where secrets should be updated.type(string, optional): The type of the secret. Valid options are "shared" or "personal". If not specified, the default value is "shared".Delete SecretDelete a secret in Infisicaldeleted_secret=client.delete_secret("API_KEY",environment="dev",path="/",type="shared")Parameterssecret_name(string): The key of the secret to delete.environment(string): The slug name (dev, prod, etc) of the environment from where secrets should be fetched from.path(string): The path from where secrets should be deleted.type(string, optional): The type of the secret. Valid options are "shared" or "personal". If not specified, the default value is "shared".CryptographyCreate Symmetric KeyCreate a base64-encoded, 256-bit symmetric key to be used for encryption/decryption.key=client.create_symmetric_key()Returnskey(string): A base64-encoded, 256-bit symmetric key.Encrypt SymmetricEncrypt plaintext -> ciphertext.ciphertext,iv,tag=client.encrypt_symmetric(plaintext,key)Parametersplaintext(string): The plaintext to encrypt.key(string): The base64-encoded, 256-bit symmetric key to use to encrypt theplaintext.Returnsciphertext(string): The base64-encoded, encryptedplaintext.iv(string): The base64-encoded, 96-bit initialization vector generated for the encryption.tag(string): The base64-encoded authentication tag generated during the encryption.Decrypt SymmetricDecrypt ciphertext -> plaintext/cleartext.cleartext=client.decrypt_symmetric(ciphertext,key,iv,tag)Parametersciphertext(string): The ciphertext to decrypt.key(string): The base64-encoded, 256-bit symmetric key to use to decrypt theciphertext.iv(string): The base64-encoded, 96-bit initiatlization vector generated for the encryption.tag(string): The base64-encoded authentication tag generated during encryption.Returnscleartext(string): The decrypted encryption that is the cleartext/plaintext.ContributingBug fixes, docs, and library improvements are always welcome. Please refer to ourContributing Guidefor detailed information on how you can contribute.Getting StartedIf you want to familiarize yourself with the SDK, you can start byforking the repositoryandcloning it in your local development environment.After cloning the repository, we recommend that you create a virtual environment:$python-mvenvenvThen activate the environment with:#Forlinux$source./env/bin/activate#ForWindowsPowerShell$.\env\Scripts\Activate.ps1Make sure that you have the latest version ofpipto avoid errors on the next step:$python-mpipinstall--upgradepipThen install the project in editable mode and the dependencies with:$pipinstall-e'.[dev,test]'To run existing tests, you need to make a.envat the root of this project containing aINFISICAL_TOKENandSITE_URL. This will execute the tests against a project and environment scoped to theINFISICAL_TOKENon a running instance of Infisical at theSITE_URL(this could beInfisical Cloud).To run all the tests you can use the following command:$pytesttestsLicenseinfisical-pythonis distributed under the terms of theMITlicense.