Salesforce DX Developer Guide

How Salesforce Developer Experience (DX) Tooling Changes the Way You Work
Provide Developers Access to Salesforce DX Tools
Project Setup
Authorization
Authorize an Org Using a Browser
Authorize an Org Using the JWT Flow
Create a Private Key and Self-Signed Digital Certificate
Create an External Client App in Your Org
Create a Connected App in Your Org
Use the Default Connected App Securely
Use an Existing Access Token
Authorize an Org Using Its SFDX Authorization URL
Authorization Information for an Org
View Org Authentication Secrets
Log Out of an Org
Metadata Coverage
Scratch Orgs
Sandboxes
Track Changes Between Your Project and Org
Work with Data
Salesforce DX MCP Server and Tools
Development
Build and Release Your App
Unlocked Packages
Continuous Integration
Troubleshoot Salesforce DX
Limitations for Salesforce DX
PDF

Note: This release is in preview. Features described here don’t become generally available until the latest general availability date that Salesforce announces for this release. Before then, and where features are noted as beta, pilot, or developer preview, we can’t guarantee general availability within any particular time frame or at all. Make your purchase decisions only on the basis of generally available products and features.

Authorize an Org Using a Browser

Authorize an org with a browser by running a CLI command and entering your credentials in the browser that automatically opens. That’s it!
Use this authorization method when multi-factor authentication (MFA) is enabled on your org, either directly with a username and password or via single sign-on (SSO). 

You must have the Approve Uninstalled Connected Apps user permission to complete this task. Org administrators have the permission by default.

Important

  1. Open a terminal (macOS and Linux) or command prompt (Windows).
  2. Run the org login web CLI command. We recommend using the --alias flag to make it easy to refer to the org later. 
    1sf org login web --alias my-org
    Use the --set-default flag if you want the org to be the default for commands that accept the --target-org flag. If you’re authorizing a Dev Hub org, use the --set-default-dev-hub flag instead. See the org login web command for examples.
  3. In the browser window that opens, sign in to your org with your Salesforce login credentials. Click Allow, which allows Salesforce CLI to access to your org.
  4. Close the browser window. Your org is now authorized!
If the URL that you use to log in to your org isn’t the default (login.salesforce.com), update your project configuration file (sfdx-project.json). Set the sfdcLoginUrl option to your My Domain login URL. For example:
1"sfdcLoginUrl" : "https://MyDomainName.my.salesforce.com"

This example is for a sandbox.

1"sfdcLoginUrl" : "https://MyDomainName--SandboxName.sandbox.my.salesforce.com"

Alternatively, you can use the --instance-url flag of org login web to specify the URL. This value overrides the login URL you specified in the sfdx-project.json file. For example:

1sf org login web --alias my-hub-org --instance-url https://exciting.sandbox.my.salesforce.com

We recommend that you use your enhanced My Domain login URL, as it isn’t affected by org migrations that change your org’s Salesforce instance. Be sure you use the version that ends in my.salesforce.com instead of the URL you see in Lightning Experience (.lightning.force.com). To verify the valid My Domain URL, from Setup, enter My Domain in the Quick Find box, then select My Domain.

Note

The orgs you authorize for Salesforce CLI are required to have either an external client app (preferred) or a connected app. We provide a default connected app called Salesforce CLI. If you need more security or control, such as setting the refresh token timeout or specifying IP ranges, create your own external client app or connected app (only if you need to create scratch orgs or sandboxes). You can also configure the default connected app to be more secure.