mirror of
https://github.com/Infisical/infisical.git
synced 2025-03-27 09:40:45 +00:00
861 lines
24 KiB
Plaintext
861 lines
24 KiB
Plaintext
---
|
|
title: "E2EE Mode"
|
|
---
|
|
|
|
End-to-End Encrypted (E2EE) mode is the default way to use Infisical's API. With it, you must perform client-side encryption/decryption
|
|
when reading/writing secrets via HTTP call to Infisical.
|
|
|
|
Prerequisites:
|
|
|
|
- Set up and add envars to [Infisical Cloud](https://app.infisical.com).
|
|
- Create an [Infisical Token](/documentation/platform/token) for your project and environment with write access enabled.
|
|
- Grasp a basic understanding of the system and its underlying cryptography [here](/api-reference/overview/introduction).
|
|
- [Ensure that your project is blind-indexed](../blind-indices).
|
|
|
|
Below, we showcase how to execute common CRUD operations to manage secrets in **E2EE** mode:
|
|
|
|
<AccordionGroup>
|
|
<Accordion title="Retrieve secrets">
|
|
<Tabs>
|
|
<Tab title="Javascript">
|
|
```js
|
|
const crypto = require('crypto');
|
|
const axios = require('axios');
|
|
|
|
const BASE_URL = 'https://app.infisical.com';
|
|
const ALGORITHM = 'aes-256-gcm';
|
|
|
|
const decrypt = ({ ciphertext, iv, tag, secret}) => {
|
|
const decipher = crypto.createDecipheriv(
|
|
ALGORITHM,
|
|
secret,
|
|
Buffer.from(iv, 'base64')
|
|
);
|
|
decipher.setAuthTag(Buffer.from(tag, 'base64'));
|
|
|
|
let cleartext = decipher.update(ciphertext, 'base64', 'utf8');
|
|
cleartext += decipher.final('utf8');
|
|
|
|
return cleartext;
|
|
}
|
|
|
|
const getSecrets = async () => {
|
|
const serviceToken = 'your_service_token';
|
|
const serviceTokenSecret = serviceToken.substring(serviceToken.lastIndexOf('.') + 1);
|
|
|
|
// 1. Get your Infisical Token data
|
|
const { data: serviceTokenData } = await axios.get(
|
|
`${BASE_URL}/api/v2/service-token`,
|
|
{
|
|
headers: {
|
|
Authorization: `Bearer ${serviceToken}`
|
|
}
|
|
}
|
|
);
|
|
|
|
// 2. Get secrets for your project and environment
|
|
const { data } = await axios.get(
|
|
`${BASE_URL}/api/v3/secrets?${new URLSearchParams({
|
|
environment: serviceTokenData.environment,
|
|
workspaceId: serviceTokenData.workspace
|
|
})}`,
|
|
{
|
|
headers: {
|
|
Authorization: `Bearer ${serviceToken}`
|
|
}
|
|
}
|
|
);
|
|
|
|
const encryptedSecrets = data.secrets;
|
|
|
|
// 3. Decrypt the (encrypted) project key with the key from your Infisical Token
|
|
const projectKey = decrypt({
|
|
ciphertext: serviceTokenData.encryptedKey,
|
|
iv: serviceTokenData.iv,
|
|
tag: serviceTokenData.tag,
|
|
secret: serviceTokenSecret
|
|
});
|
|
|
|
// 4. Decrypt the (encrypted) secrets
|
|
const secrets = encryptedSecrets.map((secret) => {
|
|
const secretKey = decrypt({
|
|
ciphertext: secret.secretKeyCiphertext,
|
|
iv: secret.secretKeyIV,
|
|
tag: secret.secretKeyTag,
|
|
secret: projectKey
|
|
});
|
|
|
|
const secretValue = decrypt({
|
|
ciphertext: secret.secretValueCiphertext,
|
|
iv: secret.secretValueIV,
|
|
tag: secret.secretValueTag,
|
|
secret: projectKey
|
|
});
|
|
|
|
return ({
|
|
secretKey,
|
|
secretValue
|
|
});
|
|
});
|
|
|
|
console.log('secrets: ', secrets);
|
|
}
|
|
|
|
getSecrets();
|
|
|
|
```
|
|
</Tab>
|
|
|
|
<Tab title="Python">
|
|
```Python
|
|
import requests
|
|
import base64
|
|
from Cryptodome.Cipher import AES
|
|
|
|
|
|
BASE_URL = "http://app.infisical.com"
|
|
|
|
|
|
def decrypt(ciphertext, iv, tag, secret):
|
|
secret = bytes(secret, "utf-8")
|
|
iv = base64.standard_b64decode(iv)
|
|
tag = base64.standard_b64decode(tag)
|
|
ciphertext = base64.standard_b64decode(ciphertext)
|
|
|
|
cipher = AES.new(secret, AES.MODE_GCM, iv)
|
|
cipher.update(tag)
|
|
cleartext = cipher.decrypt(ciphertext).decode("utf-8")
|
|
return cleartext
|
|
|
|
|
|
def get_secrets():
|
|
service_token = "your_service_token"
|
|
service_token_secret = service_token[service_token.rindex(".") + 1 :]
|
|
|
|
# 1. Get your Infisical Token data
|
|
service_token_data = requests.get(
|
|
f"{BASE_URL}/api/v2/service-token",
|
|
headers={"Authorization": f"Bearer {service_token}"},
|
|
).json()
|
|
|
|
# 2. Get secrets for your project and environment
|
|
data = requests.get(
|
|
f"{BASE_URL}/api/v3/secrets",
|
|
params={
|
|
"environment": service_token_data["environment"],
|
|
"workspaceId": service_token_data["workspace"],
|
|
},
|
|
headers={"Authorization": f"Bearer {service_token}"},
|
|
).json()
|
|
|
|
encrypted_secrets = data["secrets"]
|
|
|
|
# 3. Decrypt the (encrypted) project key with the key from your Infisical Token
|
|
project_key = decrypt(
|
|
ciphertext=service_token_data["encryptedKey"],
|
|
iv=service_token_data["iv"],
|
|
tag=service_token_data["tag"],
|
|
secret=service_token_secret,
|
|
)
|
|
|
|
# 4. Decrypt the (encrypted) secrets
|
|
secrets = []
|
|
for secret in encrypted_secrets:
|
|
secret_key = decrypt(
|
|
ciphertext=secret["secretKeyCiphertext"],
|
|
iv=secret["secretKeyIV"],
|
|
tag=secret["secretKeyTag"],
|
|
secret=project_key,
|
|
)
|
|
|
|
secret_value = decrypt(
|
|
ciphertext=secret["secretValueCiphertext"],
|
|
iv=secret["secretValueIV"],
|
|
tag=secret["secretValueTag"],
|
|
secret=project_key,
|
|
)
|
|
|
|
secrets.append(
|
|
{
|
|
"secret_key": secret_key,
|
|
"secret_value": secret_value,
|
|
}
|
|
)
|
|
|
|
print("secrets:", secrets)
|
|
|
|
|
|
get_secrets()
|
|
|
|
```
|
|
</Tab>
|
|
</Tabs>
|
|
</Accordion>
|
|
<Accordion title="Create secret">
|
|
<Tabs>
|
|
<Tab title="Javascript">
|
|
```js
|
|
const crypto = require('crypto');
|
|
const axios = require('axios');
|
|
const nacl = require('tweetnacl');
|
|
|
|
const BASE_URL = 'https://app.infisical.com';
|
|
const ALGORITHM = 'aes-256-gcm';
|
|
const BLOCK_SIZE_BYTES = 16;
|
|
|
|
const encrypt = ({ text, secret }) => {
|
|
const iv = crypto.randomBytes(BLOCK_SIZE_BYTES);
|
|
const cipher = crypto.createCipheriv(ALGORITHM, secret, iv);
|
|
|
|
let ciphertext = cipher.update(text, 'utf8', 'base64');
|
|
ciphertext += cipher.final('base64');
|
|
return {
|
|
ciphertext,
|
|
iv: iv.toString('base64'),
|
|
tag: cipher.getAuthTag().toString('base64')
|
|
};
|
|
}
|
|
|
|
const decrypt = ({ ciphertext, iv, tag, secret}) => {
|
|
const decipher = crypto.createDecipheriv(
|
|
ALGORITHM,
|
|
secret,
|
|
Buffer.from(iv, 'base64')
|
|
);
|
|
decipher.setAuthTag(Buffer.from(tag, 'base64'));
|
|
|
|
let cleartext = decipher.update(ciphertext, 'base64', 'utf8');
|
|
cleartext += decipher.final('utf8');
|
|
|
|
return cleartext;
|
|
}
|
|
|
|
const createSecrets = async () => {
|
|
const serviceToken = '';
|
|
const serviceTokenSecret = serviceToken.substring(serviceToken.lastIndexOf('.') + 1);
|
|
|
|
const secretType = 'shared'; // 'shared' or 'personal'
|
|
const secretKey = 'some_key';
|
|
const secretValue = 'some_value';
|
|
const secretComment = 'some_comment';
|
|
|
|
// 1. Get your Infisical Token data
|
|
const { data: serviceTokenData } = await axios.get(
|
|
`${BASE_URL}/api/v2/service-token`,
|
|
{
|
|
headers: {
|
|
Authorization: `Bearer ${serviceToken}`
|
|
}
|
|
}
|
|
);
|
|
|
|
// 2. Decrypt the (encrypted) project key with the key from your Infisical Token
|
|
const projectKey = decrypt({
|
|
ciphertext: serviceTokenData.encryptedKey,
|
|
iv: serviceTokenData.iv,
|
|
tag: serviceTokenData.tag,
|
|
secret: serviceTokenSecret
|
|
});
|
|
|
|
// 3. Encrypt your secret with the project key
|
|
const {
|
|
ciphertext: secretKeyCiphertext,
|
|
iv: secretKeyIV,
|
|
tag: secretKeyTag
|
|
} = encrypt({
|
|
text: secretKey,
|
|
secret: projectKey
|
|
});
|
|
|
|
const {
|
|
ciphertext: secretValueCiphertext,
|
|
iv: secretValueIV,
|
|
tag: secretValueTag
|
|
} = encrypt({
|
|
text: secretValue,
|
|
secret: projectKey
|
|
});
|
|
|
|
const {
|
|
ciphertext: secretCommentCiphertext,
|
|
iv: secretCommentIV,
|
|
tag: secretCommentTag
|
|
} = encrypt({
|
|
text: secretComment,
|
|
secret: projectKey
|
|
});
|
|
|
|
// 4. Send (encrypted) secret to Infisical
|
|
await axios.post(
|
|
`${BASE_URL}/api/v3/secrets/${secretKey}`,
|
|
{
|
|
workspaceId: serviceTokenData.workspace,
|
|
environment: serviceTokenData.environment,
|
|
type: secretType,
|
|
secretKeyCiphertext,
|
|
secretKeyIV,
|
|
secretKeyTag,
|
|
secretValueCiphertext,
|
|
secretValueIV,
|
|
secretValueTag,
|
|
secretCommentCiphertext,
|
|
secretCommentIV,
|
|
secretCommentTag
|
|
},
|
|
{
|
|
headers: {
|
|
Authorization: `Bearer ${serviceToken}`
|
|
}
|
|
}
|
|
);
|
|
}
|
|
|
|
createSecrets();
|
|
```
|
|
</Tab>
|
|
|
|
<Tab title="Python">
|
|
```Python
|
|
import base64
|
|
import requests
|
|
from Cryptodome.Cipher import AES
|
|
from Cryptodome.Random import get_random_bytes
|
|
|
|
|
|
BASE_URL = "https://app.infisical.com"
|
|
BLOCK_SIZE_BYTES = 16
|
|
|
|
|
|
def encrypt(text, secret):
|
|
iv = get_random_bytes(BLOCK_SIZE_BYTES)
|
|
secret = bytes(secret, "utf-8")
|
|
cipher = AES.new(secret, AES.MODE_GCM, iv)
|
|
ciphertext, tag = cipher.encrypt_and_digest(text.encode("utf-8"))
|
|
return {
|
|
"ciphertext": base64.standard_b64encode(ciphertext).decode("utf-8"),
|
|
"tag": base64.standard_b64encode(tag).decode("utf-8"),
|
|
"iv": base64.standard_b64encode(iv).decode("utf-8"),
|
|
}
|
|
|
|
|
|
def decrypt(ciphertext, iv, tag, secret):
|
|
secret = bytes(secret, "utf-8")
|
|
iv = base64.standard_b64decode(iv)
|
|
tag = base64.standard_b64decode(tag)
|
|
ciphertext = base64.standard_b64decode(ciphertext)
|
|
|
|
cipher = AES.new(secret, AES.MODE_GCM, iv)
|
|
cipher.update(tag)
|
|
cleartext = cipher.decrypt(ciphertext).decode("utf-8")
|
|
return cleartext
|
|
|
|
|
|
def create_secrets():
|
|
service_token = "your_service_token"
|
|
service_token_secret = service_token[service_token.rindex(".") + 1 :]
|
|
|
|
secret_type = "shared" # "shared or "personal"
|
|
secret_key = "some_key"
|
|
secret_value = "some_value"
|
|
secret_comment = "some_comment"
|
|
|
|
# 1. Get your Infisical Token data
|
|
service_token_data = requests.get(
|
|
f"{BASE_URL}/api/v2/service-token",
|
|
headers={"Authorization": f"Bearer {service_token}"},
|
|
).json()
|
|
|
|
# 2. Decrypt the (encrypted) project key with the key from your Infisical Token
|
|
project_key = decrypt(
|
|
ciphertext=service_token_data["encryptedKey"],
|
|
iv=service_token_data["iv"],
|
|
tag=service_token_data["tag"],
|
|
secret=service_token_secret,
|
|
)
|
|
|
|
# 3. Encrypt your secret with the project key
|
|
encrypted_key_data = encrypt(text=secret_key, secret=project_key)
|
|
encrypted_value_data = encrypt(text=secret_value, secret=project_key)
|
|
encrypted_comment_data = encrypt(text=secret_comment, secret=project_key)
|
|
|
|
# 4. Send (encrypted) secret to Infisical
|
|
requests.post(
|
|
f"{BASE_URL}/api/v3/secrets/{secret_key}",
|
|
json={
|
|
"workspaceId": service_token_data["workspace"],
|
|
"environment": service_token_data["environment"],
|
|
"type": secret_type,
|
|
"secretKeyCiphertext": encrypted_key_data["ciphertext"],
|
|
"secretKeyIV": encrypted_key_data["iv"],
|
|
"secretKeyTag": encrypted_key_data["tag"],
|
|
"secretValueCiphertext": encrypted_value_data["ciphertext"],
|
|
"secretValueIV": encrypted_value_data["iv"],
|
|
"secretValueTag": encrypted_value_data["tag"],
|
|
"secretCommentCiphertext": encrypted_comment_data["ciphertext"],
|
|
"secretCommentIV": encrypted_comment_data["iv"],
|
|
"secretCommentTag": encrypted_comment_data["tag"]
|
|
},
|
|
headers={"Authorization": f"Bearer {service_token}"},
|
|
)
|
|
|
|
|
|
create_secrets()
|
|
|
|
```
|
|
</Tab>
|
|
</Tabs>
|
|
</Accordion>
|
|
<Accordion title="Retrieve secret">
|
|
<Tabs>
|
|
<Tab title="Javascript">
|
|
```js
|
|
const crypto = require('crypto');
|
|
const axios = require('axios');
|
|
|
|
const BASE_URL = 'https://app.infisical.com';
|
|
const ALGORITHM = 'aes-256-gcm';
|
|
|
|
const decrypt = ({ ciphertext, iv, tag, secret}) => {
|
|
const decipher = crypto.createDecipheriv(
|
|
ALGORITHM,
|
|
secret,
|
|
Buffer.from(iv, 'base64')
|
|
);
|
|
decipher.setAuthTag(Buffer.from(tag, 'base64'));
|
|
|
|
let cleartext = decipher.update(ciphertext, 'base64', 'utf8');
|
|
cleartext += decipher.final('utf8');
|
|
|
|
return cleartext;
|
|
}
|
|
|
|
const getSecret = async () => {
|
|
const serviceToken = 'your_service_token';
|
|
const serviceTokenSecret = serviceToken.substring(serviceToken.lastIndexOf('.') + 1);
|
|
|
|
const secretType = 'shared' // 'shared' or 'personal'
|
|
const secretKey = 'some_key';
|
|
|
|
// 1. Get your Infisical Token data
|
|
const { data: serviceTokenData } = await axios.get(
|
|
`${BASE_URL}/api/v2/service-token`,
|
|
{
|
|
headers: {
|
|
Authorization: `Bearer ${serviceToken}`
|
|
}
|
|
}
|
|
);
|
|
|
|
// 2. Get the secret from your project and environment
|
|
const { data } = await axios.get(
|
|
`${BASE_URL}/api/v3/secrets/${secretKey}?${new URLSearchParams({
|
|
environment: serviceTokenData.environment,
|
|
workspaceId: serviceTokenData.workspace,
|
|
type: secretType // optional, defaults to 'shared'
|
|
})}`,
|
|
{
|
|
headers: {
|
|
Authorization: `Bearer ${serviceToken}`
|
|
}
|
|
}
|
|
);
|
|
|
|
const encryptedSecret = data.secret;
|
|
|
|
// 3. Decrypt the (encrypted) project key with the key from your Infisical Token
|
|
const projectKey = decrypt({
|
|
ciphertext: serviceTokenData.encryptedKey,
|
|
iv: serviceTokenData.iv,
|
|
tag: serviceTokenData.tag,
|
|
secret: serviceTokenSecret
|
|
});
|
|
|
|
// 4. Decrypt the (encrypted) secret value
|
|
|
|
const secretValue = decrypt({
|
|
ciphertext: encryptedSecret.secretValueCiphertext,
|
|
iv: encryptedSecret.secretValueIV,
|
|
tag: encryptedSecret.secretValueTag,
|
|
secret: projectKey
|
|
});
|
|
|
|
console.log('secret: ', ({
|
|
secretKey,
|
|
secretValue
|
|
}));
|
|
}
|
|
|
|
getSecret();
|
|
|
|
```
|
|
</Tab>
|
|
|
|
<Tab title="Python">
|
|
```Python
|
|
import requests
|
|
import base64
|
|
from Cryptodome.Cipher import AES
|
|
|
|
|
|
BASE_URL = "http://app.infisical.com"
|
|
|
|
|
|
def decrypt(ciphertext, iv, tag, secret):
|
|
secret = bytes(secret, "utf-8")
|
|
iv = base64.standard_b64decode(iv)
|
|
tag = base64.standard_b64decode(tag)
|
|
ciphertext = base64.standard_b64decode(ciphertext)
|
|
|
|
cipher = AES.new(secret, AES.MODE_GCM, iv)
|
|
cipher.update(tag)
|
|
cleartext = cipher.decrypt(ciphertext).decode("utf-8")
|
|
return cleartext
|
|
|
|
|
|
def get_secret():
|
|
service_token = "your_service_token"
|
|
service_token_secret = service_token[service_token.rindex(".") + 1 :]
|
|
|
|
secret_type = "shared" # "shared" or "personal"
|
|
secret_key = "some_key"
|
|
|
|
# 1. Get your Infisical Token data
|
|
service_token_data = requests.get(
|
|
f"{BASE_URL}/api/v2/service-token",
|
|
headers={"Authorization": f"Bearer {service_token}"},
|
|
).json()
|
|
|
|
# 2. Get secret from your project and environment
|
|
data = requests.get(
|
|
f"{BASE_URL}/api/v3/secrets/{secret_key}",
|
|
params={
|
|
"environment": service_token_data["environment"],
|
|
"workspaceId": service_token_data["workspace"],
|
|
"type": secret_type # optional, defaults to "shared"
|
|
},
|
|
headers={"Authorization": f"Bearer {service_token}"},
|
|
).json()
|
|
|
|
encrypted_secret = data["secret"]
|
|
|
|
# 3. Decrypt the (encrypted) project key with the key from your Infisical Token
|
|
project_key = decrypt(
|
|
ciphertext=service_token_data["encryptedKey"],
|
|
iv=service_token_data["iv"],
|
|
tag=service_token_data["tag"],
|
|
secret=service_token_secret,
|
|
)
|
|
|
|
# 4. Decrypt the (encrypted) secret value
|
|
secret_value = decrypt(
|
|
ciphertext=encrypted_secret["secretValueCiphertext"],
|
|
iv=encrypted_secret["secretValueIV"],
|
|
tag=encrypted_secret["secretValueTag"],
|
|
secret=project_key,
|
|
)
|
|
|
|
print("secret: ", {
|
|
"secret_key": secret_key,
|
|
"secret_value": secret_value
|
|
})
|
|
|
|
|
|
get_secret()
|
|
|
|
```
|
|
</Tab>
|
|
</Tabs>
|
|
</Accordion>
|
|
<Accordion title="Update secret">
|
|
<Tabs>
|
|
<Tab title="Javascript">
|
|
```js
|
|
const crypto = require('crypto');
|
|
const axios = require('axios');
|
|
|
|
const BASE_URL = 'https://app.infisical.com';
|
|
const ALGORITHM = 'aes-256-gcm';
|
|
const BLOCK_SIZE_BYTES = 16;
|
|
|
|
const encrypt = ({ text, secret }) => {
|
|
const iv = crypto.randomBytes(BLOCK_SIZE_BYTES);
|
|
const cipher = crypto.createCipheriv(ALGORITHM, secret, iv);
|
|
|
|
let ciphertext = cipher.update(text, 'utf8', 'base64');
|
|
ciphertext += cipher.final('base64');
|
|
return {
|
|
ciphertext,
|
|
iv: iv.toString('base64'),
|
|
tag: cipher.getAuthTag().toString('base64')
|
|
};
|
|
}
|
|
|
|
const decrypt = ({ ciphertext, iv, tag, secret}) => {
|
|
const decipher = crypto.createDecipheriv(
|
|
ALGORITHM,
|
|
secret,
|
|
Buffer.from(iv, 'base64')
|
|
);
|
|
decipher.setAuthTag(Buffer.from(tag, 'base64'));
|
|
|
|
let cleartext = decipher.update(ciphertext, 'base64', 'utf8');
|
|
cleartext += decipher.final('utf8');
|
|
|
|
return cleartext;
|
|
}
|
|
|
|
const updateSecrets = async () => {
|
|
const serviceToken = 'your_service_token';
|
|
const serviceTokenSecret = serviceToken.substring(serviceToken.lastIndexOf('.') + 1);
|
|
|
|
const secretType = 'shared' // 'shared' or 'personal'
|
|
const secretKey = 'some_key';
|
|
const secretValue = 'updated_value';
|
|
const secretComment = 'updated_comment';
|
|
|
|
// 1. Get your Infisical Token data
|
|
const { data: serviceTokenData } = await axios.get(
|
|
`${BASE_URL}/api/v2/service-token`,
|
|
{
|
|
headers: {
|
|
Authorization: `Bearer ${serviceToken}`
|
|
}
|
|
}
|
|
);
|
|
|
|
// 2. Decrypt the (encrypted) project key with the key from your Infisical Token
|
|
const projectKey = decrypt({
|
|
ciphertext: serviceTokenData.encryptedKey,
|
|
iv: serviceTokenData.iv,
|
|
tag: serviceTokenData.tag,
|
|
secret: serviceTokenSecret
|
|
});
|
|
|
|
// 3. Encrypt your updated secret with the project key
|
|
const {
|
|
ciphertext: secretKeyCiphertext,
|
|
iv: secretKeyIV,
|
|
tag: secretKeyTag
|
|
} = encrypt({
|
|
text: secretKey,
|
|
secret: projectKey
|
|
});
|
|
|
|
const {
|
|
ciphertext: secretValueCiphertext,
|
|
iv: secretValueIV,
|
|
tag: secretValueTag
|
|
} = encrypt({
|
|
text: secretValue,
|
|
secret: projectKey
|
|
});
|
|
|
|
const {
|
|
ciphertext: secretCommentCiphertext,
|
|
iv: secretCommentIV,
|
|
tag: secretCommentTag
|
|
} = encrypt({
|
|
text: secretComment,
|
|
secret: projectKey
|
|
});
|
|
|
|
// 4. Send (encrypted) updated secret to Infisical
|
|
await axios.patch(
|
|
`${BASE_URL}/api/v3/secrets/${secretKey}`,
|
|
{
|
|
workspaceId: serviceTokenData.workspace,
|
|
environment: serviceTokenData.environment,
|
|
type: secretType,
|
|
secretValueCiphertext,
|
|
secretValueIV,
|
|
secretValueTag,
|
|
secretCommentCiphertext,
|
|
secretCommentIV,
|
|
secretCommentTag
|
|
},
|
|
{
|
|
headers: {
|
|
Authorization: `Bearer ${serviceToken}`
|
|
}
|
|
}
|
|
);
|
|
}
|
|
|
|
updateSecrets();
|
|
```
|
|
</Tab>
|
|
|
|
<Tab title="Python">
|
|
```Python
|
|
import base64
|
|
import requests
|
|
from Cryptodome.Cipher import AES
|
|
from Cryptodome.Random import get_random_bytes
|
|
|
|
|
|
BASE_URL = "https://app.infisical.com"
|
|
BLOCK_SIZE_BYTES = 16
|
|
|
|
|
|
def encrypt(text, secret):
|
|
iv = get_random_bytes(BLOCK_SIZE_BYTES)
|
|
secret = bytes(secret, "utf-8")
|
|
cipher = AES.new(secret, AES.MODE_GCM, iv)
|
|
ciphertext, tag = cipher.encrypt_and_digest(text.encode("utf-8"))
|
|
return {
|
|
"ciphertext": base64.standard_b64encode(ciphertext).decode("utf-8"),
|
|
"tag": base64.standard_b64encode(tag).decode("utf-8"),
|
|
"iv": base64.standard_b64encode(iv).decode("utf-8"),
|
|
}
|
|
|
|
|
|
def decrypt(ciphertext, iv, tag, secret):
|
|
secret = bytes(secret, "utf-8")
|
|
iv = base64.standard_b64decode(iv)
|
|
tag = base64.standard_b64decode(tag)
|
|
ciphertext = base64.standard_b64decode(ciphertext)
|
|
|
|
cipher = AES.new(secret, AES.MODE_GCM, iv)
|
|
cipher.update(tag)
|
|
cleartext = cipher.decrypt(ciphertext).decode("utf-8")
|
|
return cleartext
|
|
|
|
|
|
def update_secret():
|
|
service_token = "your_service_token"
|
|
service_token_secret = service_token[service_token.rindex(".") + 1 :]
|
|
|
|
secret_type = "shared" # "shared" or "personal"
|
|
secret_key = "some_key"
|
|
secret_value = "updated_value"
|
|
secret_comment = "updated_comment"
|
|
|
|
# 1. Get your Infisical Token data
|
|
service_token_data = requests.get(
|
|
f"{BASE_URL}/api/v2/service-token",
|
|
headers={"Authorization": f"Bearer {service_token}"},
|
|
).json()
|
|
|
|
# 2. Decrypt the (encrypted) project key with the key from your Infisical Token
|
|
project_key = decrypt(
|
|
ciphertext=service_token_data["encryptedKey"],
|
|
iv=service_token_data["iv"],
|
|
tag=service_token_data["tag"],
|
|
secret=service_token_secret,
|
|
)
|
|
|
|
# 3. Encrypt your updated secret with the project key
|
|
encrypted_key_data = encrypt(text=secret_key, secret=project_key)
|
|
encrypted_value_data = encrypt(text=secret_value, secret=project_key)
|
|
encrypted_comment_data = encrypt(text=secret_comment, secret=project_key)
|
|
|
|
# 4. Send (encrypted) updated secret to Infisical
|
|
requests.patch(
|
|
f"{BASE_URL}/api/v3/secrets/{secret_key}",
|
|
json={
|
|
"workspaceId": service_token_data["workspace"],
|
|
"environment": service_token_data["environment"],
|
|
"type": secret_type,
|
|
"secretKeyCiphertext": encrypted_key_data["ciphertext"],
|
|
"secretKeyIV": encrypted_key_data["iv"],
|
|
"secretKeyTag": encrypted_key_data["tag"],
|
|
"secretValueCiphertext": encrypted_value_data["ciphertext"],
|
|
"secretValueIV": encrypted_value_data["iv"],
|
|
"secretValueTag": encrypted_value_data["tag"],
|
|
"secretCommentCiphertext": encrypted_comment_data["ciphertext"],
|
|
"secretCommentIV": encrypted_comment_data["iv"],
|
|
"secretCommentTag": encrypted_comment_data["tag"]
|
|
},
|
|
headers={"Authorization": f"Bearer {service_token}"},
|
|
)
|
|
|
|
|
|
update_secret()
|
|
|
|
```
|
|
</Tab>
|
|
</Tabs>
|
|
</Accordion>
|
|
<Accordion title="Delete secret">
|
|
<Tabs>
|
|
<Tab title="Javascript">
|
|
```js
|
|
const axios = require('axios');
|
|
const BASE_URL = 'https://app.infisical.com';
|
|
|
|
const deleteSecrets = async () => {
|
|
const serviceToken = 'your_service_token';
|
|
const secretType = 'shared' // 'shared' or 'personal'
|
|
const secretKey = 'some_key'
|
|
|
|
// 1. Get your Infisical Token data
|
|
const { data: serviceTokenData } = await axios.get(
|
|
`${BASE_URL}/api/v2/service-token`,
|
|
{
|
|
headers: {
|
|
Authorization: `Bearer ${serviceToken}`
|
|
}
|
|
}
|
|
);
|
|
|
|
// 2. Delete secret from Infisical
|
|
await axios.delete(
|
|
`${BASE_URL}/api/v3/secrets/${secretKey}`,
|
|
{
|
|
workspaceId: serviceTokenData.workspace,
|
|
environment: serviceTokenData.environment,
|
|
type: secretType
|
|
},
|
|
{
|
|
headers: {
|
|
Authorization: `Bearer ${serviceToken}`
|
|
},
|
|
}
|
|
);
|
|
};
|
|
|
|
deleteSecrets();
|
|
```
|
|
</Tab>
|
|
|
|
<Tab title="Python">
|
|
```Python
|
|
import requests
|
|
|
|
BASE_URL = "https://app.infisical.com"
|
|
|
|
|
|
def delete_secrets():
|
|
service_token = "<your_service_token>"
|
|
secret_type = "shared" # "shared" or "personal"
|
|
secret_key = "some_key"
|
|
|
|
# 1. Get your Infisical Token data
|
|
service_token_data = requests.get(
|
|
f"{BASE_URL}/api/v2/service-token",
|
|
headers={"Authorization": f"Bearer {service_token}"},
|
|
).json()
|
|
|
|
# 2. Delete secret from Infisical
|
|
requests.delete(
|
|
f"{BASE_URL}/api/v2/secrets/{secret_key}",
|
|
json={
|
|
"workspaceId": service_token_data["workspace"],
|
|
"environment": service_token_data["environment"],
|
|
"type": secret_type
|
|
},
|
|
headers={"Authorization": f"Bearer {service_token}"},
|
|
)
|
|
|
|
|
|
delete_secrets()
|
|
|
|
```
|
|
</Tab>
|
|
</Tabs>
|
|
<Info>
|
|
If using an `API_KEY` to authenticate with the Infisical API, then you should include it in the `X_API_KEY` header.
|
|
</Info>
|
|
|
|
</Accordion>
|
|
</AccordionGroup> |