I have created my plugin using sfdx plugins:generate and then I deployed it to npm. When I try to install it using sfdx plugins:install I got the message: This plugin is not digitally signed and its authenticity cannot be verified. Continue installation y/n?.

So my question is: How do I do to sign my SFDX Plugin?

2 Answers 2


Salesforce is still working on this and in future they plan to provide a mechanism how extension authors can sign the plugin .

Currently if you want to avoid that warning , it is a manual process .

If you are on MAC you can find the sfdx folder located at below directory


In the sfdx folder create a file named unsignedPluginWhiteList.json and add the below


Here plugin-name is the name of your plugin .

If you are on windows the sfdx directory will be at C:\Users\username.config\sfdx



If you need to install automatically your plugin, like in a Dockerfile or in a CI process, you can use the following line :

echo 'y' | sfdx plugins:install yourpluginname

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .