Infisical is an open-source secrets manager that syncs environment variables across local development, CI/CD, and production. Use it to store OPENDUNES_API_KEY once and inject it wherever your code runs — without hardcoding credentials or managing .env files manually.
Sign in at infisical.com (or self-host), create a project, and navigate to Secrets → Development.
Add a secret with:
- Key:
OPENDUNES_API_KEY
- Value: your key from your dashboard
Repeat for each environment (development, staging, production) with the appropriate key for each.
brew install infisical/get-cli/infisical
npm install -g @infisical/cli
Run any command with your secrets automatically injected:
infisical run -- python main.py
infisical run -- node index.js
infisical run -- npm run dev
Your script receives OPENDUNES_API_KEY as a standard environment variable with no code changes.
Add a project config file to your repo so every team member gets the right environment:
{
"workspaceId": "your-infisical-workspace-id",
"defaultEnvironment": "dev"
}
With this file present, infisical run -- <command> picks up your project automatically.
- name: Inject secrets
uses: Infisical/secrets-action@v1
with:
client-id: ${{ secrets.INFISICAL_CLIENT_ID }}
client-secret: ${{ secrets.INFISICAL_CLIENT_SECRET }}
project-id: your-infisical-project-id
env-slug: production
- name: Run app
run: node dist/index.js
infisical run --env=production -- docker compose up
For server-side apps that need to fetch secrets at runtime, use the Infisical SDK:
from infisical_sdk import InfisicalSDKClient
client = InfisicalSDKClient(host="https://app.infisical.com")
client.auth.universal_auth.login(
client_id="YOUR_CLIENT_ID",
client_secret="YOUR_CLIENT_SECRET",
)
secret = client.secrets.get_secret_by_name(
secret_name="OPENDUNES_API_KEY",
project_id="YOUR_PROJECT_ID",
environment_slug="production",
secret_path="/",
)
api_key = secret.secretValue
import InfisicalClient from "@infisical/sdk";
const client = new InfisicalClient({
clientId: process.env.INFISICAL_CLIENT_ID!,
clientSecret: process.env.INFISICAL_CLIENT_SECRET!,
});
const secret = await client.secrets.getSecret({
secretName: "OPENDUNES_API_KEY",
projectId: "YOUR_PROJECT_ID",
environment: "production",
secretPath: "/",
});
const apiKey = secret.secretValue;
Your OPENDUNES_API_KEY controls spending from your DA balance. A leaked key lets anyone charge against your account. Infisical eliminates .env files committed by accident, shared over chat, or left in Docker images.