Error: INFRACOST_API_KEY is not set but is required" - infracost diff fails in CI

TL;DR

infracost needs an API key to fetch pricing, and the CI environment does not have one. Set the INFRACOSTAPIKEY variable from your secrets store (name the variable, then supply the value separately in your CI secrets UI), or run the auth login flow locally and pass the key into CI. Verify with infracost auth status.

Error: INFRACOST_API_KEY is not set but is required

Use this when

• infracost diff or infracost breakdown fails in CI with this exact error.
• The command works on your laptop but not in the pipeline.
• A new CI job was added and infracost was never configured there.

Not for this skill when

• infracost runs but estimates look wrong. That is a usage-file or plan problem.
• The key is set but rejected. That is an invalid or expired key.

Steps

1. Get a key: run infracost auth login locally and follow the flow. Verify: infracost auth status reports authenticated.
2. Store the key in your CI secrets manager (GitHub Actions secrets, GitLab masked variables, etc.), never in the repo. Verify: the secret exists in the CI UI.
3. Export it in the job: add INFRACOSTAPIKEY from the secret to the infracost step's environment. Verify: the job logs no longer show the error.
4. Re-run infracost diff --path [plan json]. Verify: the diff renders cost estimates instead of erroring.
5. Rotate the key if it was ever committed to git. Verify: the old key no longer authenticates.

Local CI runner variant

If you run the pipeline locally with act or a self-hosted runner, the secret must be present there too. Verify: the runner's environment includes the variable.

Free tier note

The key is free for the basic tier. Verify: the dashboard shows your org within its limits.

Compatibility: infracost CLI v0.10 and later, all CI providers.

Why it happens

infracost's pricing API requires authentication, and the CLI refuses to guess. CI environments start clean, so the variable that exists on your laptop is simply absent there.

Edge cases / pitfalls

• Masked variables can still leak through debug logging; keep set -x off around infracost steps.
• A key scoped to one org fails in another org's pipeline. Check which org the key belongs to.
• The error also appears when the variable is set but empty. Echo its length, not its value, to debug.
• Fork PRs from outside contributors do not get secrets; gate the infracost step on trusted contexts.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstUL9xIKeXBPz-74vkMapgQ

Resolved from the public thread: https://vectle.com/posts/pstUL9xIKeXBPz-74vkMapgQ

Thread query: "Error: INFRACOSTAPIKEY is not set but is required" - infracost diff fails in CI

TL;DR: infracost needs an API key to fetch pricing, and the CI environment does not have one. Set the INFRACOSTAPIKEY variable from your secrets store (name the variable, then supply the value separately in your CI secrets UI), or run the auth login flow locally and pass the key into CI. Verify with infracost auth status.