feat: add login status command by Thiago-AS · Pull Request #240 · Infisical/cli

Thiago-AS · 2026-05-20T03:03:50Z

Description 📣

DOC update: chore(doc): add CLI login status doc infisical#6570

Reports whether the CLI is authenticated to Infisical and, when available, the organization the active session is scoped to.

Usage:
  infisical login status

Examples:
infisical login status

Flags:
  -h, --help           help for status
      --json           Output the login status as JSON
      --token string   Inspect this machine identity access token instead of the active session or environment variables

Global Flags:
      --domain string      Point the CLI to your Infisical instance (e.g., https://eu.infisical.com for EU Cloud, or https://your-instance.com for self-hosted). Can also set via INFISICAL_API_URL environment variable. Required for non-US Cloud users. (default "https://app.infisical.com/api")
  -l, --log-level string   log level (trace, debug, info, warn, error, fatal)
      --silent             Disable output of tip/info messages. Useful when running in scripts or CI/CD pipelines.
      --telemetry          Infisical collects non-sensitive telemetry data to enhance features and improve user experience. Participation is voluntary (default true)

Type ✨

Tests 🛠️

# Here's some code block to paste some code snippets

I have read the contributing guide, agreed and acknowledged the code of conduct. 📝

linear · 2026-05-20T03:03:53Z

PLATFOR-316

infisical-review-police · 2026-05-20T03:03:54Z

💬 Discussion in Slack: #pr-review-cli-240-feat-add-login-status-command

Posted by Review Police — reviews, comments, new commits, and CI failures will stream into this channel.

claude

LGTM, self-contained additive command that follows existing CLI patterns.

Extended reasoning...

Overview

This PR adds a single new file, packages/cmd/login_status.go, registering an infisical login status subcommand under the existing loginCmd. It reads the persisted credentials via the existing util.GetCurrentLoggedInUserDetails, optionally decodes the JWT payload to display org/expiry info, and supports a --json flag.

Security risks

The JWT payload is decoded without signature verification, which is fine here because it is only being used to display claims about the user's own locally-stored session (no auth decisions are made from it). The token is sent via SetAuthToken only to the configured Infisical domain to resolve org names, matching the patterns already used elsewhere in the CLI. No new credential storage, no new network endpoints, no permission-affecting logic.

Level of scrutiny

Low. This is an additive, read-only diagnostic command — analogous to gh auth status. It does not touch existing code paths, does not modify auth/crypto, and failures degrade to debug logs without exposing data.

Other factors

The bug-hunting system found nothing, the API calls (CallGetAllOrganizationsWithSubOrgs, CallGetAllOrganizations) and util helpers (PrintfStdout, GetRestyClientWithCustomHeaders, HandleError) are all pre-existing and used consistently. Exit codes correctly distinguish authenticated, expired, and not-authenticated states.

victorvhs017

The user login works great!

But if I try after logging in with a machine identity, I get:

We should support machine identities, too

victorvhs017 · 2026-05-21T17:54:46Z

+func buildMachineIdentityContext(token, source, domain string) loginStatusContext {
+	// Service tokens (`st.<id>.<key>` format) are opaque — no JWT to decode.
+	if strings.HasPrefix(token, "st.") {
+		return loginStatusContext{
+			kind:        principalKindServiceToken,
+			domain:      domain,
+			rawToken:    token,
+			tokenSource: source,
+		}
+	}


The function name here is a bit misleading; machine identities are not the same as service tokens.

victorvhs017 · 2026-05-21T17:55:53Z

+// detectMachineIdentityEnvToken returns the machine-identity / service-token
+// credential exported in the environment, mirroring the precedence used by
+// util.GetInfisicalToken. The legacy `TOKEN` gateway variable is intentionally
+// omitted here because its name collides with too many unrelated tools.
+func detectMachineIdentityEnvToken() (token, source string, ok bool) {


victorvhs017 · 2026-05-21T18:57:57Z

+		case principalKindMachineIdentity:
+			util.PrintlnStdout("  - Run `infisical login` to re-authenticate and re-export your token.")


This may be only a domain issue, like this example, where I expected this to work with the same domain as my logged-in user, but I needed to add the --domain flag for it:

We could update the message to also tell the user to check the domain and update with --domain if needed

Like the public doc state, if all operations using machine/service token will either use the INFISICAL_API_URL or the --domain flag. I kept the same behavior from other commands. This for me is confusing in the entire CLI not only here.

The behavior is fine. I think we just need to update the message on the last bullet point to make it clear that they may not need to export the token, just pass the domain. (if that's the issue)

victorvhs017 · 2026-05-21T19:06:07Z

If I'm using a JWT token from a user saved in the INFISICAL_TOKEN, it's saying that I'm logged in as a machine identity:

So the doc explicitly consents that the env var and --token are for machine identity usage

That's why I made that assumption, will look a way to deterministically tell the types apart.

This is from the user authentication section in the docs:

The CLI is too broad haha, already found a way to tell them apart, working in the fix

gitguardian · 2026-05-21T20:06:36Z

⚠️ GitGuardian has uncovered 1 secret following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secret in your pull request

GitGuardian id	GitGuardian status	Secret	Commit	Filename
33062794	Triggered	Generic CLI Secret	`4917f68`	packages/cmd/login_status_test.go	View secret

🛠 Guidelines to remediate hardcoded secrets

Understand the implications of revoking this secret by investigating where it is used in your code.
Replace and store your secret safely. Learn here the best practices.
Revoke and rotate this secret.
If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider

following these best practices for managing and storing secrets including API keys and other credentials
install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.

^{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}

add login status command

eae0b2a

claude Bot reviewed May 20, 2026

View reviewed changes

refactor to make file more concise and add test

14b19ba

Thiago-AS requested a review from victorvhs017 May 20, 2026 03:15

victorvhs017 requested changes May 20, 2026

View reviewed changes

Thiago-AS added 3 commits May 20, 2026 22:54

add machine identity support

8412467

validate identities on backend

10da9d1

refactor to improve readability and fix tests

ad47774

Thiago-AS requested a review from victorvhs017 May 21, 2026 16:40

victorvhs017 requested changes May 21, 2026

View reviewed changes

get token type from claim

4917f68

Thiago-AS requested a review from victorvhs017 May 21, 2026 20:13

remove env var not publicly on doc

808f5bf

victorvhs017 approved these changes May 21, 2026

View reviewed changes

Thiago-AS merged commit 8c1f508 into main May 21, 2026
14 of 15 checks passed

Thiago-AS deleted the thiago-as/PLATFOR-316 branch May 21, 2026 22:53

BrewTestBot mentioned this pull request May 22, 2026

infisical 0.43.86 Homebrew/homebrew-core#284268

Merged

		case principalKindMachineIdentity:
		util.PrintlnStdout(" - Run `infisical login` to re-authenticate and re-export your token.")

Conversation

Thiago-AS commented May 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description 📣

Type ✨

Tests 🛠️

Uh oh!

linear Bot commented May 20, 2026

Uh oh!

infisical-review-police Bot commented May 20, 2026

Uh oh!

claude Bot left a comment

Choose a reason for hiding this comment

Overview

Security risks

Level of scrutiny

Other factors

Uh oh!

victorvhs017 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

victorvhs017 May 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

gitguardian Bot commented May 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ GitGuardian has uncovered 1 secret following the scan of your pull request.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Thiago-AS commented May 20, 2026 •

edited

Loading

victorvhs017 May 21, 2026 •

edited

Loading

gitguardian Bot commented May 21, 2026 •

edited

Loading