infisical gateway

infisical gateway start <gateway-name> --enroll-method=token --token=<enrollment-token> --domain=<domain>

<Tabs>
  <Tab title="token">
    A one-time enrollment token from the Infisical UI bootstraps the gateway.

    <ParamField query="Flags">
    <Expandable title="properties">
        <ParamField query="token" type="string" required>
          The one-time enrollment token from the Infisical UI.
        </ParamField>
        <ParamField query="domain" type="string" required>
          The URL of your Infisical instance.
        </ParamField>
    </Expandable>
    </ParamField>

    ```bash
    infisical gateway start my-gateway --enroll-method=token --token=<enrollment-token> --domain=https://app.infisical.com
    ```

    After enrollment, the gateway saves its credentials locally. You can safely re-run the same command to restart the gateway. It will detect the token has already been used and skip enrollment automatically.
  </Tab>
  <Tab title="aws">
    The gateway signs an `sts:GetCallerIdentity` request with whatever AWS credentials it can resolve on the host (instance role, environment variables, shared profile), and re-authenticates on every start. No token is stored on disk.

    <ParamField query="Flags">
    <Expandable title="properties">
        <ParamField query="gateway-id" type="string" required>
          The gateway ID from the Infisical UI.
        </ParamField>
        <ParamField query="domain" type="string" required>
          The URL of your Infisical instance.
        </ParamField>
    </Expandable>
    </ParamField>

    ```bash
    infisical gateway start my-gateway --enroll-method=aws --gateway-id=<gateway-id> --domain=https://app.infisical.com
    ```
  </Tab>
  <Tab title="kubernetes">
    The gateway authenticates with the projected service account token of the pod it runs in, so no credential has to be distributed to the cluster. Infisical verifies the token against your cluster's TokenReview API and re-authenticates on every start. No token is stored on disk.

    This method requires the gateway to run inside a Kubernetes pod. Deploying with the [Helm chart](/self-hosting/helm-charts/gateway) is the recommended path.

    <ParamField query="Flags">
    <Expandable title="properties">
        <ParamField query="gateway-id" type="string" required>
          The gateway ID from the Infisical UI.
        </ParamField>
        <ParamField query="domain" type="string" required>
          The URL of your Infisical instance.
        </ParamField>
        <ParamField query="service-account-token-path" type="string">
          Path to the projected service account token. Defaults to `/var/run/secrets/kubernetes.io/serviceaccount/token`.
        </ParamField>
    </Expandable>
    </ParamField>

    ```bash
    infisical gateway start my-gateway --enroll-method=kubernetes --gateway-id=<gateway-id> --domain=https://app.infisical.com
    ```

    See [Gateway Deployment](/documentation/platform/gateways/gateway-deployment) for the cluster host and allowlist configuration this method needs.
  </Tab>
</Tabs>

If this flag is omitted, the gateway will automatically connect to a healthy relay with the lowest latency.

```bash
# Example
infisical gateway start my-gateway --target-relay-name=my-relay --enroll-method=token --token=<token> --domain=<domain>
```

**Note:** For Infisical Cloud users using instance relays, the relay infrastructure is already running and managed by Infisical. If using organization relays or self-hosted instance relays, you must first start a relay server. For more information on deploying relays, refer to the [Relay Deployment Guide](/documentation/platform/gateways/relay-deployment).

```bash
# Example
infisical gateway start <gateway-name> --domain=https://app.your-domain.com --enroll-method=token --token=<token>
```

```bash
# Example
infisical gateway start <gateway-name> --enroll-method=token --token=<token> --domain=<domain> --pkcs11-module=/opt/fortanix/pkcs11/fortanix_pkcs11.so
```

See [HSM Connectors](/documentation/platform/pki/settings/hsm-connectors) for the full setup.

sudo infisical gateway systemd install my-gateway --enroll-method=token --token=<enrollment-token> --domain=<domain>

```bash
# Enrollment token
sudo infisical gateway systemd install my-gateway --enroll-method=token --token=<enrollment-token> --domain=<domain>

# AWS auth, re-authenticated on every service start
sudo infisical gateway systemd install my-gateway --enroll-method=aws --gateway-id=<gateway-id> --domain=<domain>
```

`kubernetes` is not available here. In-cluster gateways are not managed by systemd, so run `infisical gateway start --enroll-method=kubernetes` as the container command instead.

```bash
# Example
sudo infisical gateway systemd install my-gateway --enroll-method=token --token=<token> --domain=<domain>
```

```bash
# Example
sudo infisical gateway systemd install my-gateway --enroll-method=token --token=<token> --domain=https://app.your-domain.com
```

If this flag is omitted, the gateway will automatically connect to a healthy relay with the lowest latency.

```bash
# Example
sudo infisical gateway systemd install my-gateway --target-relay-name=my-relay --enroll-method=token --token=<token> --domain=<domain>
```

**Note:** For Infisical Cloud users using instance relays, the relay infrastructure is already running and managed by Infisical. If using organization relays or self-hosted instance relays, you must first start a relay server. For more information on deploying relays, refer to the [Relay Deployment Guide](/documentation/platform/gateways/relay-deployment).

```bash
# Example
sudo infisical gateway systemd install my-gateway --enroll-method=token --token=<token> --domain=<domain> --pkcs11-module=/opt/fortanix/pkcs11/fortanix_pkcs11.so
```

See [HSM Connectors](/documentation/platform/pki/settings/hsm-connectors) for the full setup.

sudo systemctl start my-gateway    # Start the service
sudo systemctl stop my-gateway     # Stop the service
sudo systemctl status my-gateway   # Check service status
sudo systemctl disable my-gateway  # Disable auto-start on boot

sudo infisical gateway systemd uninstall my-gateway

  If the selected relay becomes unreachable while the gateway is running, the gateway will automatically switch to a different healthy one. Gateways started with an explicit `--target-relay-name` do not switch and will keep retrying the specified relay.