I have a script used weekly to create a scratch org used by a few users for shared config activities (we have not transitioned our non-developer, config only BAs to using the full DX toolset yet). This script creates a scratch org, installs a managed package, adds a couple of users (force:user:create), pushes source, and assigns permission sets to the added users.

I also generate passwords for the users. For some reason today I cannot; I get "ERROR: INVALID_HEADER_TYPE." I was able to generate password for the default user:

sfdx force:user:password:generate --targetusername "[email protected]" 

This worked fine. But doing the same for an added user:

sfdx force:user:password:generate --targetusername "[email protected]"

produces the error. force:user:password:generate doesn't support --verbose (I tried) but I did try the --json option:

    "message": "INVALID_HEADER_TYPE", 
    "status": 1, 
    at HttpApi.getError (/Users/jclark/.local/share/sfdx/client/node_modules/jsforce/lib/http-api.js:250:13)
    at /Users/jclark/.local/share/sfdx/client/node_modules/jsforce/lib/http-api.js:95:22
    at tryCallOne (/Users/jclark/.local/share/sfdx/client/node_modules/promise/lib/core.js:37:12)
    at /Users/jclark/.local/share/sfdx/client/node_modules/promise/lib/core.js:123:15
    at flush (/Users/jclark/.local/share/sfdx/client/node_modules/asap/raw.js:50:29)
    at _combinedTickCallback (internal/process/next_tick.js:131:7)
    at process._tickCallback (internal/process/next_tick.js:180:9)", 
    "name": "INVALID_AUTH_HEADER", 
    "warnings": [ ]

I can find no other info about this error. The JSON implies an auth issue, but other DX commands work fine (e.g., force:org:open successfully logs me in as the default user.) This script worked a week ago. sfdx update reports, "already on latest version: 6.29.0-0a2482692c." What is the source of this error?

Update: I'm running Mac OS 10.13.6 (17G65). Relevant version info:

> $ sfdx plugins --core           
@salesforce/plugin-generator 0.0.10 (core)
@salesforce/sfdx-trust 1.0.8 (core)
builtins 1.0.0 (core)
salesforcedx 43.12.0 (core)

> $ sfdx version       
sfdx-cli/6.29.0-0a2482692c (darwin-x64) node-v8.9.4

> $ node --version                       
  • Can you tell me what OS you are using? Also, what version of the toolbelt plugin are you using? I ask, because I can't duplicate this using Mac OSX and CLI version sfdx-cli/6.29.0 (darwin-x64) node-v10.4.0 with salesforcedx 43.12.0 plugin version. Commented Aug 27, 2018 at 18:42
  • @DaveCarroll I've updated the post with version info Commented Aug 27, 2018 at 18:47
  • And you get the error when you run the password:generate command, correct? Commented Aug 27, 2018 at 18:52
  • @DaveCarroll Correct, the example sfdx force:user:password:generate above produces only "ERROR: INVALID_HEADER_TYPE." as output. Commented Aug 27, 2018 at 19:48
  • This is odd. I wonder if something in the cached credentials may be corrupted. If can MOVE the stuff in the hidden .sfdx folder to another location and try the steps again and it works, then corruption might be the cause. Without being able to reproduce this behavior I'm not sure we can find the cause. Commented Aug 27, 2018 at 21:19

1 Answer 1


To generate password for secondary users, you have to put them in the --onbehalfof parameter. E.g.:

sfdx force:user:generate:password -u -o

You can do it for multiple secondary users at once by separating their usernames with commas.

To make it verbose, use "--loglevel trace" or "--loglevel debug"

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .