The what yesterday did not worked, it worked today:

$ infisical ssh connect \
    --hostname <redacted-host> \
    --login-user root \
    --log-level trace

[TRACE] Authentication check returned:
  statusCode=403
  message="Your token has expired. Please re-authenticate."
  error="TokenError"

[INFO] No valid login session found – starting browser login flow
[INFO] Using custom domain (<self-hosted Infisical instance>)

Browser login succeeded.
User successfully authenticated via web login.

[INFO] SSH credentials issued successfully
[INFO] Credentials added to SSH agent

Connecting to <redacted-host> as root...

Host key accepted and added to known_hosts.
SSH session opened successfully.

So we got the warnings, yet I got a session opened in the end.

Messed up part is that it works fine to login to all machines in one terminal tab, running macos 26. Yet when I open a new tab, I get these errors:

--log-level trace
2025-11-22T13:21:06+01:00 DBG CallIsAuthenticated: Unsuccessful response: [response={"reqId":"req-tNzqk5sq9uxFAQ","statusCode":403,"message":"invalid signature","error":"TokenError"}]
error: failed to add key to agent: agent: failure
Failed to add credentials to SSH agent

Right guess I find the issue, I was using Secretive before, and their SOCK was forcing all keys pass though them, and since not all my keys are created with Secretive, this occured. Would be great to add some support for secretive, or secretive for infisical, both are open source. And both work towards SSH security. A mix of both can give users access to Biometric logins.