Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Action Required: The `SF_TEMP_SHOW_SECRETS` Compatibility Workaround Will Be Removed on October 28th, 2026

Aperta
  • Qualcosa non va?
#3,658 0 commenti 1 reazione 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
25/100
Tipo di issue
Documentazione
Chiarezza
Da chiarire
Stato di attività
Attiva
Stack tecnologico
shell
Ambito
cli, documentation

Direzione di ricerca

This issue is an announcement and names no repository files, tests, or concrete documentation entry to update. Start by checking whether a maintainer has identified a documentation location or separate implementation task; done would require an explicitly scoped repository change that reflects the October 28th, 2026 migration guidance.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

announcement

Summary

⚠️ After October 28th, 2026, access tokens, passwords, and SFDX Auth URLs will only be available through the dedicated sf org auth show-* commands. At that time, the temporary SF_TEMP_SHOW_SECRETS environment variable will stop working.

This change will occur when the CLI is promoted to latest on Wednesday, October 28th, 2026. Any workflows that set SF_TEMP_SHOW_SECRETS=true must be migrated to use the show-* commands before that date.

This is the final step of the credential-exposure changes announced in https://github.com/forcedotcom/cli/issues/3560.

Background

In #3560, we removed sensitive authentication artifacts (access tokens, passwords, and SFDX Auth URLs) from the standard and --json output of commands like sf org display, and we introduced dedicated commands for retrieving them explicitly. To give teams time to migrate, we shipped a temporary environment variable (SF_TEMP_SHOW_SECRETS) that restored the previous output. That variable was always intended to be temporary and was slated to be removed in "Summer 2026". We are now setting the official date.

What is changing, and when

Date Milestone
October 21st, 2026 available on latest-rc for validation
October 28th, 2026 promoted to latest; SF_TEMP_SHOW_SECRETS no longer has any effect

Until October 28th, 2026, SF_TEMP_SHOW_SECRETS=true continues to work as it does today. On and after October 28th, 2026, setting it has no effect, and the affected commands behave as they do without it.

Why we are removing it

The environment variable reintroduces the exact exposure it was meant to contain by putting long-lived credentials back into standard command output where automated systems and AI agents can capture and store them in plain text. This is not a safe long-term control because an AI agent could set the variable itself. The dedicated show-* commands are the durable replacement. Retrieval becomes an explicit, auditable action that you can also deny-list from an AI agent's allowed commands.

What you need to do

If a workflow currently relies on SF_TEMP_SHOW_SECRETS, switch it to the matching command below. Each command supports --json and --no-prompt for non-interactive use in CI/CD.

  • Access token: sf org auth show-access-token
  • SFDX Auth URL: sf org auth show-sfdx-auth-url
  • User password: sf org auth show-user-password

Example retrieving an access token in a pipeline:

# Before
ACCESS_TOKEN=$(sf org display --json --target-org my-org | jq -r '.result.accessToken')

# After
ACCESS_TOKEN=$(sf org auth show-access-token --json --no-prompt --target-org my-org | jq -r '.result.accessToken')

What is NOT changing

  • The sf org auth show-* commands remain the supported way to retrieve these values. Removing the workaround does not remove your ability to retrieve a credential when you genuinely need one.
  • sf org login sfdx-url is unchanged. Existing SFDX Auth URLs stored as CI/CD secrets continue to authenticate.
  • The @salesforce/core (sfdx-core) library APIs are unchanged.
  • CLI versions released before 2.136.8 are unaffected by this change.
Lingua principale
Nessun dato sulla lingua
Stelle
571
Fork
80
Merge medio
14h 43m
PR unite (30g)
5

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di forcedotcom/cli

Tutte le issue di forcedotcom/cli

Issue simili

Altre issue su CLI

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.