[Feat] Multi-Path Auto-Loading in .infisical.json

[Itz-Agasta]

Feature description

Add support for automatically loading secrets from multiple folder paths in a single infisical run command without requiring the --path flag each time.

Proposed .infisical.json configuration:

{
  "workspaceId": "63ee5410a45f7a1ed39ba118",
  "defaultEnvironment": "",
  "gitBranchToEnvironmentMapping": null
  "paths": ["/db", "/workers", "/services/auth", "/apps/api-gateway"]
}

With this configuration, running:

infisical run --env=dev -- bun run dev

Would automatically inject secrets from all specified paths (merged together), instead of requiring:

infisical run --env=dev --path=/db -- bun run dev
infisical run --env=dev --path=/workers -- bun run dev
# etc...

Why would it be useful?

1. Monorepo Support: In modern monorepo architectures, applications often need secrets from multiple folders (shared configs, service-specific secrets, environment-specific overrides).

2. DRY Principle: Eliminates repetitive --path flags in commands, scripts, and CI/CD pipelines.

3. Developer Experience: Simplifies local development - developers can run infisical run -- <cmd> without remembering which paths their app needs.

4. Consistency with Other Tools: Similar to how tools like dotenv support multiple .env files, or how Kubernetes allows multiple ConfigMaps/Secrets to be mounted.

5. Script Simplification: Reduces complexity in package.json scripts, Makefiles, and Docker Compose files:

   Current:

   infisical run --env=dev --path=/apps/workers -- uv run python -m src.main

   Proposed:

   infisical run --env=dev -- uv run python -m src.main

6. Reduced Error Surface: No risk of forgetting to add --path when running commands, which currently results in missing environment variables.

Additional context

Use Case: Multi-Service Application

Many applications have a shared configuration structure:

/
├── /common              # Shared secrets (DATABASE_URL, REDIS_URL)
├── /db                  # Database-specific configs
├── /workers             # Worker-specific secrets (QUEUE_URL, S3_BUCKET)
└── /services/auth       # Auth service secrets (JWT_SECRET)

A worker process might need secrets from /common, /db, and /workers. Currently, this requires either:

1. Duplicating secrets across paths (violates DRY)
2. Using complex shell scripts to merge secrets
3. Manually specifying multiple --path flags (not scalable)

Conflict Resolution

When the same secret key exists in multiple paths, the CLI could:

• Use last-defined wins (predictable merge order)
• Throw an error (strict mode)
• Add a --merge-strategy flag for runtime override

Backward Compatibility

This feature would be fully backward compatible:

• Existing .infisical.json files continue working
• --path flag overrides paths array when specified
• No breaking changes to current CLI behavior

Related Features

This pairs well with the existing --project-config-dir flag for monorepo support and would make Infisical an even better fit for complex project structures.

[akhilmhdh]

Moving this to a feature request to get more user votes as required, when we prioritise feature request later.

[gee-forr]

We have this exact problem! We currently have to manually eval an infisical call for each folder in order to load all the secrets we need for a monorepo.