diff --git a/cli/test/secrets_test.go b/cli/test/secrets_test.go
index 39bfd1c07d..aca5f806bc 100644
--- a/cli/test/secrets_test.go
+++ b/cli/test/secrets_test.go
@@ -1,99 +1,98 @@
 package tests
 
 import (
-	"bytes"
-	"encoding/json"
 	"fmt"
 	"testing"
 
-	"github.com/Infisical/infisical-merge/packages/cmd"
-	"github.com/Infisical/infisical-merge/packages/models"
-	"github.com/stretchr/testify/assert"
+	"github.com/bradleyjkemp/cupaloy/v2"
 )
 
-func ListSecretsWithImportsAndRecursive(t *testing.T, authToken string, projectId string, envSlug string) {
+func TestServiceToken_SecretsGetWithImportsAndRecursiveCmd(t *testing.T) {
+	SetupCli(t)
 
-	rootCommand := cmd.NewRootCmd()
+	output, err := ExecuteCliCommand(FORMATTED_CLI_NAME, "secrets", "--token", creds.ServiceToken, "--projectId", creds.ProjectID, "--env", creds.EnvSlug, "--recursive", "--silent")
 
-	commandOutput := new(bytes.Buffer)
-	rootCommand.SetOut(commandOutput)
-	rootCommand.SetErr(commandOutput)
+	fmt.Printf("output: %v\n", output)
 
-	args := []string{
-		"secrets",
+	if err != nil {
+		t.Fatalf("error running CLI command: %v", err)
 	}
-	args = append(args, fmt.Sprintf("--token=%s", authToken))
-	args = append(args, fmt.Sprintf("--projectId=%s", projectId))
-	args = append(args, fmt.Sprintf("--env=%s", envSlug))
-	args = append(args, "--include-imports=true")
-	args = append(args, "--recursive=true")
-
-	rootCommand.SetArgs(args)
-	rootCommand.Execute()
-
-	var secrets []models.SingleEnvironmentVariable
 
-	err := json.Unmarshal(commandOutput.Bytes(), &secrets)
+	// Use cupaloy to snapshot test the output
+	err = cupaloy.Snapshot(output)
 	if err != nil {
-		t.Errorf("Error: %v", err)
+		t.Fatalf("snapshot failed: %v", err)
 	}
+}
 
-	if len(secrets) == 0 {
-		t.Errorf("No secrets found")
-	}
+func TestServiceToken_SecretsGetWithoutImportsAndWithoutRecursiveCmd(t *testing.T) {
+	SetupCli(t)
 
-	secretKeys := []string{}
-	secretValues := []string{}
+	output, err := ExecuteCliCommand(FORMATTED_CLI_NAME, "secrets", "--token", creds.ServiceToken, "--projectId", creds.ProjectID, "--env", creds.EnvSlug, "--include-imports=false", "--silent")
 
-	for _, secret := range secrets {
-		secretKeys = append(secretKeys, secret.Key)
-		secretValues = append(secretValues, secret.Value)
-	}
+	fmt.Printf("output: %v\n", output)
 
-	// Secrets can have different order and potentially more secrets. but the secrets should at least contain the above secrets.
-	for _, key := range ALL_SECRET_KEYS {
-		assert.Contains(t, secretKeys, key)
+	if err != nil {
+		t.Fatalf("error running CLI command: %v", err)
 	}
-	for _, value := range ALL_SECRET_VALUES {
-		assert.Contains(t, secretValues, value)
+
+	// Use cupaloy to snapshot test the output
+	err = cupaloy.Snapshot(output)
+	if err != nil {
+		t.Fatalf("snapshot failed: %v", err)
 	}
 }
 
-func GetSecretsByNames(t *testing.T, authToken string, projectId string, envSlug string) {
+func TestUniversalAuth_SecretsGetWithImportsAndRecursiveCmd(t *testing.T) {
+	SetupCli(t)
+	MachineIdentityLoginCmd(t)
 
-	rootCommand := cmd.NewRootCmd()
+	output, err := ExecuteCliCommand(FORMATTED_CLI_NAME, "secrets", "--token", creds.UAAccessToken, "--projectId", creds.ProjectID, "--env", creds.EnvSlug, "--recursive", "--silent")
 
-	commandOutput := new(bytes.Buffer)
-	rootCommand.SetOut(commandOutput)
-	rootCommand.SetErr(commandOutput)
+	fmt.Printf("output: %v\n", output)
 
-	args := []string{
-		"secrets",
-		"get",
+	if err != nil {
+		t.Fatalf("error running CLI command: %v", err)
 	}
 
-	args = append(args, ALL_SECRET_KEYS...)
-	args = append(args, fmt.Sprintf("--token=%s", authToken))
-	args = append(args, fmt.Sprintf("--projectId=%s", projectId))
-	args = append(args, fmt.Sprintf("--env=%s", envSlug))
+	// Use cupaloy to snapshot test the output
+	err = cupaloy.Snapshot(output)
+	if err != nil {
+		t.Fatalf("snapshot failed: %v", err)
+	}
+}
+
+func TestUniversalAuth_SecretsGetWithoutImportsAndWithoutRecursiveCmd(t *testing.T) {
+	SetupCli(t)
+	MachineIdentityLoginCmd(t)
 
-	rootCommand.SetArgs(args)
-	rootCommand.Execute()
+	output, err := ExecuteCliCommand(FORMATTED_CLI_NAME, "secrets", "--token", creds.UAAccessToken, "--projectId", creds.ProjectID, "--env", creds.EnvSlug, "--include-imports=false", "--silent")
 
-	var secrets []models.SingleEnvironmentVariable
+	fmt.Printf("output: %v\n", output)
+
+	if err != nil {
+		t.Fatalf("error running CLI command: %v", err)
+	}
 
-	err := json.Unmarshal(commandOutput.Bytes(), &secrets)
+	// Use cupaloy to snapshot test the output
+	err = cupaloy.Snapshot(output)
 	if err != nil {
-		t.Errorf("Error: %v", err)
+		t.Fatalf("snapshot failed: %v", err)
 	}
+}
+
+func TestUniversalAuth_SecretsGetWrongEnvironment(t *testing.T) {
+	SetupCli(t)
+	MachineIdentityLoginCmd(t)
 
-	assert.Len(t, secrets, len(ALL_SECRETS))
+	output, _ := ExecuteCliCommand(FORMATTED_CLI_NAME, "secrets", "--token", creds.UAAccessToken, "--projectId", creds.ProjectID, "--env", "invalid-env", "--recursive", "--silent")
 
-	for _, secret := range secrets {
-		assert.Contains(t, ALL_SECRET_KEYS, secret.Key)
+	fmt.Printf("output: %v\n", output)
 
-		if secret.Key == "FOLDER-SECRET-1" {
-			assert.Equal(t, secret.Value, "*not found*") // Should not be found because recursive isn't enabled in this test, and the default path is "/"
-		}
+	// Use cupaloy to snapshot test the output
+	err := cupaloy.Snapshot(output)
+	if err != nil {
+		t.Fatalf("snapshot failed: %v", err)
 	}
+
 }