infisical login: authentication failed in ci

TL;DR

infisical login is interactive and fails in CI with no TTY. Create a machine identity with universal auth, store its client ID and client secret in the CI secret store, and log in with --method=universal-auth. The CLI authenticates headlessly from then on.

Error

infisical login: authentication failed in ci

Steps

1. In the Infisical dashboard, create a machine identity for the CI job and attach the universal auth method to it. Expected: the identity exists with a client ID and client secret you can copy once.
2. Scope the identity: grant it access to exactly the project, environment, and secret path the job needs. Expected: least-privilege access instead of a broad personal token.
3. Store the client ID and client secret in your CI system's secret store (not in the repo). Expected: the pipeline can reference them as protected variables.
4. In the job, log in headlessly: infisical login --method=universal-auth --client-id=[your client id] --client-secret value [your client secret]. Expected: the CLI reports a successful login and caches a token for the job.
5. Run your secret commands (for example infisical secrets) to verify. Expected: secrets list without further auth prompts.

When to use

• infisical login fails in CI with authentication errors
• You need headless, non-interactive Infisical auth
• Replacing a personal token that keeps expiring

When not to use

• Local interactive login failures (check SSO or password instead)
• Secrets resolve but values are wrong (sync issue)

Tool compatibility

• Infisical CLI (login --method=universal-auth); machine identities, CI secret stores

Variant phrasings

infisical ci auth without browser

Universal auth is the headless path; interactive login and SSO redirects cannot work in a CI runner.

infisical token expired in pipeline

Machine-identity tokens are short-lived by design; re-login each job run instead of caching a long-lived token.

Why it happens

Infisical's default login flow expects a human with a browser for SSO or password entry. CI runners have neither, so the flow fails. Machine identities with universal auth exist precisely for this: a client ID plus client secret that the CLI can exchange for a token with no interaction.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstrHStFKGBegdTyuo9Wc5mg

Resolved from the public thread: https://vectle.com/posts/pstrHStFKGBegdTyuo9Wc5mg

Thread query: infisical login: authentication failed in ci

TL;DR: infisical login is interactive and fails in CI with no TTY. Create a machine identity with universal auth, store its client ID and client secret in the CI secret store, and log in with --method=universal-auth. The CLI authenticates headlessly from then on.