Authorize an Org Using a Browser

Authorize an org with a browser by running a CLI command and entering your credentials in the browser that automatically opens. That’s it!

Use this authorization method when multi-factor authentication (MFA) is enabled on your org, either directly with a username and password or via single sign-on (SSO).

You must have the Approve Uninstalled Connected Apps user permission to complete this task. Org administrators have the permission by default.

  1. Open a terminal (macOS and Linux) or command prompt (Windows).

  2. Run the org login web CLI command. We recommend using the --alias flag to make it easy to refer to the org later.

    Use the --set-default flag if you want the org to be the default for commands that accept the --target-org flag. If you’re authorizing a Dev Hub org, use the --set-default-dev-hub flag instead. See the org login web command for examples.

  3. In the browser window that opens, sign in to your org with your Salesforce login credentials. Click Allow, which allows Salesforce CLI to access to your org.

  4. Close the browser window. Your org is now authorized!

If the URL that you use to log in to your org isn’t the default (login.salesforce.com), update your project configuration file (sfdx-project.json). Set the sfdcLoginUrl option to your My Domain login URL. For example:

This example is for a sandbox.

Alternatively, you can use the --instance-url flag of org login web to specify the URL. This value overrides the login URL you specified in the sfdx-project.json file. For example:

We recommend that you use your enhanced My Domain login URL, as it isn’t affected by org migrations that change your org’s Salesforce instance. Be sure you use the version that ends in my.salesforce.com instead of the URL you see in Lightning Experience (.lightning.force.com). To verify the valid My Domain URL, from Setup, enter My Domain in the Quick Find box, then select My Domain.

The orgs you authorize for Salesforce CLI are required to have either an external client app (preferred) or a connected app. We provide a default connected app called Salesforce CLI. If you need more security or control, such as specifying IP ranges, create your own external client app or connected app (only if you need to create scratch orgs or sandboxes). You can also configure the default connected app to be more secure.

See Also