sf-auth

name	sf-auth
description	Authentication commands for connecting to Salesforce orgs. Includes Web Login, JWT, SFDX-URL, and Access Token flows.

sf Authentication

Authentication commands for connecting to Salesforce orgs.

sf org login web

Login using web browser (OAuth flow).

# Login to production
sf org login web --alias myProdOrg --instance-url https://login.salesforce.com

# Login to sandbox
sf org login web --alias mySandbox --instance-url https://test.salesforce.com

# Login and set as default
sf org login web --alias myOrg --set-default

# Login with specific client ID (for custom connected apps)
sf org login web --alias myOrg --client-id <consumer-key>

# Login with browser disabled (headless environments)
sf org login web --alias myOrg --no-prompt

Flags

Flag	Description
-a, --alias	Alias for the authenticated org
-d, --set-default	Set as default org
-r, --instance-url	Salesforce instance URL
-i, --client-id	OAuth client ID (connected app)
--no-prompt	Don't prompt for opening browser

sf org login jwt

Login using JWT bearer token (for CI/CD and automation).

# Basic JWT login
sf org login jwt --client-id <connected-app-client-id> \
  --jwt-key-file path/to/server.key \
  --username <salesforce-username> \
  --alias myCiOrg

# JWT login to sandbox
sf org login jwt --client-id <client-id> \
  --jwt-key-file server.key \
  --username [e-mail] \
  --alias sandboxOrg \
  --instance-url https://test.salesforce.com

# JWT login with set default
sf org login jwt --client-id <client-id> \
  --jwt-key-file server.key \
  --username <username> \
  --alias devOrg \
  --set-default \
  --set-default-dev-hub

Prerequisites for JWT Auth

1. Create a Connected App with OAuth settings
2. Generate a digital certificate (private key)
3. Upload certificate to Connected App
4. Enable OAuth settings with api, web, refresh_token, offline_access scopes

Flags

Flag	Description
-i, --client-id	OAuth client ID of connected app
-f, --jwt-key-file	Path to private key file
-u, --username	Salesforce username
-a, --alias	Alias for the org
-r, --instance-url	Instance URL (default: login.salesforce.com)
-d, --set-default	Set as default username
--set-default-dev-hub	Set as default Dev Hub

sf org login sfdx-url

Login using SFDX auth URL (for CI/CD automation).

# Login using auth URL file
sf org login sfdx-url --sfdx-url-file auth-url.txt --alias myOrg

# Login using stdin
echo "force://clientId:clientSecret:refreshToken@instanceUrl" | sf org login sfdx-url --stdin --alias myOrg

# Auth URL format
# force://<clientId>:<clientSecret>:<refreshToken>@<instanceUrl>
# Example:
# force://3MVG9...:12345:5Aep...@https://myorg.my.salesforce.com

Generate Auth URL

# Generate auth URL from existing auth
sf org display --target-org myOrg --verbose

# Or use sf org login access-token
sf org login access-token --auth-url "force://..." --alias myOrg

sf org login device

Login using device code flow (for headless environments).

# Start device login
sf org login device --alias myOrg

# Follow prompts:
# 1. CLI displays a URL and code
# 2. Open URL in browser
# 3. Enter the code
# 4. Complete authentication

sf org login access-token

Authorize an org using an existing Salesforce access token.

# Login with access token (interactive - will prompt for token)
sf org login access-token --instance-url https://mycompany.my.salesforce.com

# Login without prompts (CI/CD use)
# Set SF_ACCESS_TOKEN environment variable first
export SF_ACCESS_TOKEN="<your-access-token>"
sf org login access-token --instance-url https://dev-hub.my.salesforce.com --no-prompt

# Login with alias and set as default
sf org login access-token --instance-url https://myorg.my.salesforce.com \
  --alias myOrg --set-default

# Login and set as default Dev Hub
sf org login access-token --instance-url https://myorg.my.salesforce.com \
  --alias devHub --set-default-dev-hub

Flags

Flag	Description
-a, --alias	Alias for the org
-d, --set-default-dev-hub	Set as default Dev Hub
-p, --no-prompt	Don't prompt for confirmation
-r, --instance-url	URL of the instance (required)
-s, --set-default	Set as default org

CI/CD Usage

For CI/CD pipelines, set the SF_ACCESS_TOKEN environment variable and use --no-prompt:

# In CI/CD environment
export SF_ACCESS_TOKEN="${{ secrets.SF_ACCESS_TOKEN }}"
sf org login access-token --instance-url https://login.salesforce.com --no-prompt