The SFDX URL can be used to authenticate to the Salesforce CLI without needing any JWT Token or using the browser to key in the credential.
In fact it is the easiest way to authenticate through CLI. Let me explain how salesforce CLI authenticates today.
The first time when you log in via the CLI, you go to the salesforce login screen and key in credentials (if you are not using JWT flow. For JWT the certificate takes care of it).
What happens next time when you do a
sfdx force:org:open? It does not ask for the credential and instead, you log in straight.
How does this happens?
Salesforce stores the access token and refreshes token (It got to also has clientId and client secret of the connected app somewhere too) the first time and then uses it for the subsequent requests. You can go to the $HOME directory of your computer and cd into the .sfdx folder to see for every org there will be a .json file having some information which I am sure will be fun for you.
Use your local computer and authenticate to as many orgs you need to login and note its sfdx url and use it in the CI system without having to worry about JWT tokens and connected app.
CI system (which is headless) can easily log in using an
auth:sfdxurl:store. Look into the docs here for more.
All you have to do in your CI once you have sfdx auth url is
sfdx force:auth:sfdxurl:store -f <file containing sfdx auth url>
You do this using below
echo $SFDXURL_HUB > /tmp/sfdx.url
sfdx force:auth:sfdxurl:store -f /tmp/sfdx.url -a circle_build_$CIRCLE_BUILD_NUM --setdefaultdevhubusername
$SFDXURL_HUB is the environment variable I am assuming to have the sfdx URL
One of the reasons why salesforce does not speak much about this in docs is security. You can shoot yourself in foot with this if you expose the client secret and clientId like that.
So care should be taken to either store this sfdx auth url in an environment variable that cannot be easily reached except for someone with access.
Or use a technique like an open SSL shown here to encrypt it.