4

I have been going through this link Sfdx authorization for org and find out to check org information via salesforce cli we have to use this command below

sfdx force:org:display --targetusername <username>

But when we use --verbose parameter with this command above we get more information like Salesforce DX authentication URL

Sfdx Auth Url  force://SalesforceDevelopmentExperience:[email protected]

So I tried it and just want to know is there any expiration date for this Sfdx auth URL which I'm getting from the command. As I'm using dev hub org and normal org(production org) alias name in place of --targetusername like below

sfdx force:org:display -u my-dev-org --verbose

Any help regarding this will save my time.

1 Answer 1

4

In the Salesforce CLI command reference, it describes the way to create valid sfdx auth urls as either of these two formats:

force://<refreshToken>@<instanceUrl>
force://<clientId>:<clientSecret>:<refreshToken>@<instanceUrl>

In either case, the refresh token is the "expirable" part of the url.

Any user authorized with the command line will be issued a refresh token using the standard Salesforce/OAuth flow. There isn't a date for this to be expired, but the user, or a system administrator can revoke the token from the org at anytime by using one of the following means.

  1. Going to Setup > Users > Username and revoking the OAuth connected app from the list of connected apps.
  2. Issuing the command force:auth:logout from the command line from a client machine who has that same refresh token stored.

What number 2 means is that if you go to two different machines and run force:auth:web:login they will each have their own refresh token. Running auth:logout on one wont affect the authorization of the other. But if you were to share a single SfdxAuthUrl between two machines, by using force:auth:sfdxurl:store, then they are sharing an authorization token. That means if either of those runs auth:web:logout the refresh token would be invalidated for all.

4
  • can you explain why the revoking of refresh token would happen when using force:auth:sfdxurl:store Sep 17, 2020 at 2:56
  • Can you explain further? Are you saying there's an existing org auth that you stored using auth:sfdxurl:store that no longer has a refresh token?
    – pchittum
    Sep 17, 2020 at 10:49
  • "But if you take that URL, and use it to run force:auth:sfdxurl:store on another machine, then either of those machines could revoke the token making the authorization on the other machine invalid" from what you said, I am seeing a behavior that makes the refresh token invalid Sep 17, 2020 at 14:24
  • Oh...ok. I'll try to flesh out that explanation.
    – pchittum
    Sep 17, 2020 at 17:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .