Authenticate a Salesforce Org in CI/CD

Set up automated authentication between GitHub Actions and your Salesforce org to continuously scan your code with the ApexGuru engine in Salesforce Code Analyzer. Choose the authentication method that best fits your environment.

• JSON Web Token Bearer Flow: This approach is recommended for enterprise pipelines and team repositories. It uses a Connected App and an X.509 digital certificate to authenticate without storing static access tokens.
• SFDX Auth URL: This lightweight, quick-start method is ideal for solo developers, rapid prototyping, or temporary sandboxes. It captures an existing authenticated CLI session URL into a single repository secret.

Before configuring the authentication method, complete these steps on your local workstation.

• Install the Salesforce CLI
• Identify the target Salesforce org
• Create a dedicated integration user to prevent pipeline failures when team members change roles or leave. We recommend not binding CI/CD pipelines to individual user accounts

This approach is recommended for enterprise pipelines and team repositories. It uses a Connected App and an X.509 digital certificate to authenticate without storing static access tokens.

1. In your local workspace, generate an RSA private key and a self-signed digital certificate using OpenSSL.
   OpenSSL is pre-installed on macOS and available via Git Bash on Windows. See Create a Private Key and Self-Signed Digital Certificate.

   Retain server.key (Private key — store in GitHub) and server.crt (Public cert — upload to Salesforce).

   Remove server.pass.key and server.csr.

2. In your target org, create an external client app to authorize the incoming JWT requests.

   1. In your Salesforce org, click Setup App Manager or External Client Apps and create an external client app.

   2. Select Enable OAuth Settings.

   3. Set the callback URL to http://localhost:1717/OauthRedirect.

   4. Select Enable JWT Bearer Flow and upload your server.crt file.

   5. Add these OAuth scopes.

      1. Manage user data via APIs (api)

      2. Perform requests at any time (refresh_token, offline_access)

      3. Manage user data via Web browsers (web)

   6. Configure pre-authorization policies.

   7. Under OAuth Policies, for Permitted Users, select Admin approved users are pre-authorized.

   8. Under App Policies, add your Integration User’s profile or permission set to the Selected list.

   9. For IP Restrictions, select Relax IP restrictions.

   10. Save the app, and copy the generated Consumer Key (Client ID).

3. Store the credentials in GitHub.

   1. In your GitHub repository, click Settings, click Secrets and variables, and then click Actions.

   2. Click New repository secret and add these key-value pairs.

4. In your .github/workflows/ci.yml pipeline file, add the authentication step before running the Code Analyzer scan.

This lightweight, quick-start method is ideal for solo developers, rapid prototyping, or temporary sandboxes. It captures an existing authenticated CLI session URL into a single repository secret.

1. Log in to your machine using your dedicated integration user, and then print the auth URL.

   Copy the value of the Sfdx Auth Url field, which starts with force://....

   Alternatively, export directly as JSON.

   Copy the value under result.sfdxAuthUrl.

   Note: You need the --verbose flag to display the auth URL. To revoke access later, from Setup, in the Quick Find box, enter Connected Apps OAuth Usage, and then select Connected Apps OAuth Usage. Revoke the Salesforce CLI app for that user.

2. Store the credentials in GitHub.

   In your GitHub repository, click Settings, click Secrets and variables, and then click Actions.

   Click New repository secret and add the value that you copied in the Sfdx Auth Url field.

3. Create or update your pipeline file at .github/workflows/code-analyzer.yml.

   The --sfdx-url-stdin reads the URL from standard input (piped from echo), preventing sensitive tokens from writing to disk. --set-default targets this org for the Code Analyzer execution that follows.

• If several repositories share credentials, don’t duplicate secrets manually. In your GitHub repository, click Settings, click Secrets and variables, and then click Actions. Click New repository secret. Set repository access to All repositories or Selected repositories for centralized management and rotation.
• GitHub-hosted runners draw from a large, dynamic pool of public IP addresses. If your org enforces strict login IP restrictions, apply these resolution steps:
  • JWT: Make sure that the external client app is configured to Relax IP restrictions under OAuth Policies.
  • SFDX Auth URL: Relax the Login IP Ranges, In the Integration User’s profile or org Network Access settings, relax the login IP ranges.
    Alternatively, if your organizational policies forbid relaxing IP rules, use self-hosted GitHub runners with fixed static IP addresses and allowlist those IP addresses in Salesforce.

• ApexGuru
• CI/CD Integration