Secrets

How EZKeel manages secrets with Infisical — from declaration to injection.

How It Works

EZKeel uses Infisical as its secrets backend. Instead of scattering .env files across developer machines (where they get stale, leaked, or lost), secrets live in a centralized, access-controlled vault with per-environment scoping.

The flow is:

Declare required secrets in workspace.yaml
Add secret values in the Infisical dashboard (per environment: dev, staging, prod)
Inject them at runtime with ezkeel secrets inject

Declaring Secrets

In your workspace.yaml, list the environment variables your project requires:

workspace.yaml
            
secrets:
  required:
    - ANTHROPIC_API_KEY
    - DATABASE_URL
    - STRIPE_SECRET_KEY

This serves as documentation and enables validation. EZKeel knows which secrets the project needs and can warn you if any are missing.

Adding Secrets

Add the actual secret values through the Infisical dashboard or CLI:

Via the Infisical Dashboard

Open https://secrets.example.com in your browser
Navigate to your project
Select the environment (e.g. "Development")
Click "Add Secret" and enter the key/value pair

Via the Infisical CLI

terminal

$ infisical secrets set ANTHROPIC_API_KEY=sk-ant-... --env=dev Secret created successfully

Injecting Secrets

The ezkeel secrets inject command exports secrets as shell export statements. Use eval to load them into your current shell:

terminal

# Print the export statements $ ezkeel secrets inject dev export ANTHROPIC_API_KEY="sk-ant-..." export DATABASE_URL="postgres://..." export STRIPE_SECRET_KEY="sk_test_..." # Load them into your shell $ eval $(ezkeel secrets inject dev) # Verify $ echo $ANTHROPIC_API_KEY sk-ant-...

Tip: Add eval $(ezkeel secrets inject dev) to your shell profile or Dev Container postStartCommand to inject secrets automatically when you start working.

Automatic Injection with ezkeel ai

When you run ezkeel ai, secrets are injected automatically. The CLI determines which API key the tool needs and fetches it from Infisical before launching:

Tool	Required Secret
`claude`	`ANTHROPIC_API_KEY`
`codex`	`OPENAI_API_KEY`
`local` / `ollama/*`	none (runs locally)

terminal

# No need to manually inject — ezkeel handles it $ ezkeel ai claude "explain the auth module"

Secrets in Dev Containers

To have secrets available inside your Dev Container, add the injection command to your container's lifecycle hooks. In .devcontainer/devcontainer.json:

devcontainer.json
            
{
  "name": "my-project",
  "image": "mcr.microsoft.com/devcontainers/base:ubuntu",
  "postStartCommand": "eval $(ezkeel secrets inject dev)"
}

This ensures that every time the container starts, the latest secrets from Infisical are loaded into the environment — no stale .env files required.