I am trying to build a connected app- connected to our prod environment so that our developers could spin up scratch orgs and work there, however I dont want them to be able to use org:login and change anything. So far the ive tried:

  1. created a permission set for creating and editing ors and have assigned it to a read only user used to login to the connected app but i cant spin scratch orgs.
  2. Ive tried limiting the connected apps permissions but i can still use org:login and see into the org.

any suggestion or recommendation is welcomed


You can provide your developers with a Permission Set entitling them to utilize Salesforce DX without providing them with System Administrator access to Production (the Dev Hub). A Connected App is not required in this case.

The required permissions are

To give full access to the Dev Hub org, the permission set must contain these permissions.

Object Settings > Scratch Org Info > Read, Create, and Delete
Object Settings > Active Scratch Org > Read and Delete
Object Settings > Namespace Registry > Read

You're not required to provide access to other core objects (such as Account) and are free to assign developers a profile that does not include these objects, so that they're unable to view data in the org.

For a continuous integration workflow, you'll want to use a Connected App with the JWT flow, but your developers won't use this flow directly - it'll be configured only via the CI solution itself.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.