fix: auto-authenticate with Universal Auth client credentials in GetInfisicalToken by devin-ai-integration[bot] · Pull Request #201 · Infisical/cli

devin-ai-integration · 2026-04-29T22:25:28Z

Description 📣

When INFISICAL_UNIVERSAL_AUTH_CLIENT_ID and INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET environment variables are set, commands like infisical run, infisical export, and infisical secrets fail with "No valid login session found, triggering login flow" instead of automatically authenticating.

Root cause: GetInfisicalToken() only checks for pre-existing access tokens (--token flag, INFISICAL_UNIVERSAL_AUTH_ACCESS_TOKEN, INFISICAL_TOKEN env vars). The client ID and client secret are credentials that need to be exchanged for an access token, but GetInfisicalToken() never performs that exchange — so it returns nil, and downstream code falls back to the interactive login flow.

Fix: In GetInfisicalToken(), right before returning nil when no explicit token is found, check if both INFISICAL_UNIVERSAL_AUTH_CLIENT_ID and INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET are set. If so, call the existing UniversalAuthLogin() function to exchange them for an access token. This fixes every command that uses GetInfisicalToken — run, export, secrets, etc. — in one shot.

This is critical for non-interactive environments like Claude Code, CI runners, and other automated tooling where the interactive login flow is not possible.

Codex Review Feedback (addressed in follow-up commit)

Respect --auth-method over auto UA login — GetInfisicalToken now checks for --auth-method flag or INFISICAL_AUTH_METHOD env var before attempting auto-login. If either is set, it returns nil so the caller's auth-method flow (AWS, GCP, K8s, etc.) takes over. This prevents stale UA env vars from short-circuiting gateway/relay flows using other auth strategies.
Fail-fast retries — Reduced UniversalAuthLogin from 10,000 retries / 20s max-wait (≈55h worst-case) to 3 retries with 2-5s wait, appropriate for one-shot CLI commands in CI/automation.
No network call in PersistentPreRun — Split into DetectInfisicalToken (local-only, for the "session overwritten" warning) and GetInfisicalToken (with network exchange). The root command's PersistentPreRun now uses DetectInfisicalToken, eliminating the double token-minting and network dependency on every CLI invocation.

Type ✨

Tests 🛠️

Verified the project builds successfully with go build ./...
All 14 CI checks pass (unit tests, integration tests on Linux/macOS/Windows, E2E tests for CLI/PAM/Agent)

To verify manually:

export INFISICAL_UNIVERSAL_AUTH_CLIENT_ID="your-client-id"
export INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET="your-client-secret"

# Before this fix: "No valid login session found, triggering login flow"
# After this fix: auto-authenticates and fetches secrets
infisical run --projectId=<project-id> -- echo "it works"

I have read the contributing guide, agreed and acknowledged the code of conduct. 📝

Link to Devin session: https://app.devin.ai/sessions/28035c0473714f72a18187edc405bf38

…nfisicalToken When INFISICAL_UNIVERSAL_AUTH_CLIENT_ID and INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET environment variables are set, GetInfisicalToken() now automatically exchanges them for an access token using the existing UniversalAuthLogin() function. Previously, GetInfisicalToken() only checked for pre-existing access tokens (--token flag, INFISICAL_UNIVERSAL_AUTH_ACCESS_TOKEN, INFISICAL_TOKEN env vars). If none were found, it returned nil, causing commands like 'infisical run' to fall back to the interactive login flow — which fails in non-interactive environments like Claude Code, CI runners, and other automated tooling. This fixes 'run', 'export', 'secrets', and all other commands that use GetInfisicalToken. Co-Authored-By: jake <jake@infisical.com>

devin-ai-integration · 2026-04-29T22:25:30Z

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

Disable automatic comment and CI monitoring

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9592fb9063

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

- Split GetInfisicalToken into local-only DetectInfisicalToken (for PersistentPreRun warning) and network-capable GetInfisicalToken, so the root command no longer performs a network call or double-mints tokens on every CLI invocation. - Skip auto-UA-login when --auth-method flag or INFISICAL_AUTH_METHOD env var is set, so gateway/relay flows using AWS/GCP/K8s auth are not short-circuited by stale UA credentials in the environment. - Reduce UniversalAuthLogin retry count from 10000 (≈55h worst-case) to 3 retries with 2-5s wait, so CLI commands fail fast on transport errors instead of blocking indefinitely. Co-Authored-By: jake <jake@infisical.com>

devin-ai-integration · 2026-04-29T23:45:37Z

Addressed all three Codex review comments in 4a991c2:

Respect --auth-method over auto UA login — GetInfisicalToken now checks for --auth-method flag or INFISICAL_AUTH_METHOD env var before attempting auto-login. If either is set, it returns nil so the caller's auth-method flow (AWS, GCP, K8s, etc.) takes over.
Fail-fast retries — Reduced UniversalAuthLogin from 10,000 retries / 20s max-wait (≈55h worst-case) to 3 retries with 2-5s wait, appropriate for one-shot CLI commands in CI/automation.
No network call in PersistentPreRun — Split into DetectInfisicalToken (local-only, for the "session overwritten" warning) and GetInfisicalToken (with network exchange). The root command's PersistentPreRun now uses DetectInfisicalToken, eliminating the double token-minting and network dependency on every CLI invocation.

varonix0 · 2026-04-30T00:59:52Z

@codex re-review this PR

varonix0 · 2026-04-30T00:59:59Z

@claude re-review this PR

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4a991c203e

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Only check INFISICAL_AUTH_METHOD env var when the command actually has the --auth-method flag registered (e.g. gateway, relay). Commands like run, export, and secrets do not define this flag, so a globally-set INFISICAL_AUTH_METHOD should not prevent auto-login for those commands. Co-Authored-By: jake <jake@infisical.com>

varonix0 · 2026-04-30T01:14:23Z

@claude re-review this and be super cautious

varonix0 · 2026-04-30T01:14:28Z

@codex re-review this and be super cautious

chatgpt-codex-connector · 2026-04-30T01:19:57Z

Codex Review: Didn't find any major issues. Hooray!

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector Bot reviewed Apr 29, 2026

View reviewed changes

Comment thread packages/util/helper.go Outdated

claude Bot reviewed Apr 29, 2026

View reviewed changes

Comment thread packages/util/helper.go Outdated

Comment thread packages/util/helper.go Outdated

jakehulberg requested a review from varonix0 April 30, 2026 00:47

chatgpt-codex-connector Bot reviewed Apr 30, 2026

View reviewed changes

Comment thread packages/util/helper.go

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: auto-authenticate with Universal Auth client credentials in GetInfisicalToken#201

fix: auto-authenticate with Universal Auth client credentials in GetInfisicalToken#201
devin-ai-integration[bot] wants to merge 3 commits intomainfrom
devin/1777427505-universal-auth-auto-login

devin-ai-integration Bot commented Apr 29, 2026 •

edited

Loading

Uh oh!

devin-ai-integration Bot commented Apr 29, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

devin-ai-integration Bot commented Apr 29, 2026

Uh oh!

varonix0 commented Apr 30, 2026

Uh oh!

varonix0 commented Apr 30, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

varonix0 commented Apr 30, 2026

Uh oh!

varonix0 commented Apr 30, 2026

Uh oh!

chatgpt-codex-connector Bot commented Apr 30, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

devin-ai-integration Bot commented Apr 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description 📣

Codex Review Feedback (addressed in follow-up commit)

Type ✨

Tests 🛠️

Uh oh!

devin-ai-integration Bot commented Apr 29, 2026

🤖 Devin AI Engineer

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

devin-ai-integration Bot commented Apr 29, 2026

Uh oh!

varonix0 commented Apr 30, 2026

Uh oh!

varonix0 commented Apr 30, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

varonix0 commented Apr 30, 2026

Uh oh!

varonix0 commented Apr 30, 2026

Uh oh!

chatgpt-codex-connector Bot commented Apr 30, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

devin-ai-integration Bot commented Apr 29, 2026 •

edited

Loading