infisical export

infisical export [options]

$ infisical export

# Export variables to a .env file
infisical export > .env
infisical export --output-file=./.env

# Export variables to a .env file (with export keyword)
infisical export --format=dotenv-export > .env
infisical export --format=dotenv-export --output-file=./.env

# Export variables for shell eval/source (POSIX shell-quoted, safe for eval)
eval "$(infisical export --format=dotenv-eval)"
infisical export --format=dotenv-eval --output-file=./.env

# Export variables to a JSON file
infisical export --format=json > secrets.json
infisical export --format=json --output-file=./secrets.json

# Export variables to a YAML file
infisical export --format=yaml > secrets.yaml
infisical export --format=yaml --output-file=./secrets.yaml

# Render secrets using a custom template file
infisical export --template=<path to template>

```bash
# Example
export INFISICAL_TOKEN=$(infisical login --method=universal-auth --client-id=<identity-client-id> --client-secret=<identity-client-secret> --silent --plain) # --plain flag will output only the token, so it can be fed to an environment variable. --silent will disable any update messages.
```

```bash
# Example
export INFISICAL_TOKEN=<service-token>
```

To use, simply export this variable in the terminal before running this command.

```bash
# Example
export INFISICAL_DISABLE_UPDATE_CHECK=true
```

```bash
# Export to specific file
infisical export --format=json --output-file=./secrets.json

# Export to directory (uses default filename based on format)
infisical export --format=yaml --output-file=./
```

**When `--output-file` is specified:**
- Secrets are saved directly to the specified file
- A success message is displayed showing the file path
- For directories: adds default filename `secrets.{format}` (e.g., `secrets.json`, `secrets.yaml`)
- For dotenv formats in directories: uses `.env` as the filename

**When `--output-file` is NOT specified (default behavior):**
- Output is sent to stdout (standard output)
- You can use shell redirection like `infisical export > secrets.json`
- Maintains backwards compatibility with existing scripts

<Warning>
  If you're using shell redirection and your token expires, re-authentication will fail because the prompt can't display properly due to the redirection.
</Warning>

	```text my-template-file
{{$secrets := secret "<infisical-project-id>" "<environment-slug>" "<folder-path>"}}
{{$length := len $secrets}}
{{- "{"}}
{{- with $secrets }}
  {{- range $index, $secret := . }}
    "{{ $secret.Key }}": "{{ $secret.Value }}"{{if lt $index (minus $length 1)}},{{end}}
  {{- end }}
{{- end }}
{{ "}" -}}
	```

```bash
# Example
infisical export --template="/path/to/template/file"
```

<Tip>
  The Infisical CLI templating engine also supports Sprig library templating functions to help you transform your secrets further.
  You can read more about the available functions [here](/integrations/platforms/kubernetes/overview#available-helper-functions).
</Tip>

```bash
# Example
infisical export --env=prod
```

Note: this flag only accepts environment slug names not the fully qualified name. To view the slug name of an environment, visit the project settings page.

default value: `dev`

```bash
# Example

infisical export --projectId=XXXXXXXXXXXXXX
```

Default value: `true`

Default value: `true`

Default value: `dotenv`

The `dotenv-eval` format emits each secret as an `export KEY='value'` statement with values POSIX shell-quoted (wrapped in single quotes, with embedded single quotes escaped). This makes the output safe to load directly into your current shell via `eval`/`source`, regardless of the value's contents (newlines, single quotes, `$`, `"`, `\`, and other shell metacharacters are preserved verbatim).

```bash
# Load secrets into the current shell session
eval "$(infisical export --format=dotenv-eval)"
```

```bash
# Example output
export DATABASE_URL='postgres://user:pass@localhost:5432/db'
export API_KEY='it'\''s a secret'
```

<Warning>
  The POSIX single-quoting only escapes secret **values**. Secret **names** (keys) are emitted as-is and are not escaped, so `eval`/`source` is only safe when every secret name is a valid shell identifier (letters, digits, and underscores, not starting with a digit). Avoid running `eval`/`source` on this format if your secret names may contain shell metacharacters.
</Warning>

Default value: `true`

```bash
# Example
infisical export --path="/path/to/folder" --env=dev
```

```bash
# Example
infisical export --tags=tag1,tag2,tag3 --env=dev
```

Note: you must reference the tag by its slug name not its fully qualified name. Go to project settings to view all tag slugs.

By default, all secrets are fetched