Skip to content

authenticateClientCredentials

authenticateClientCredentials(options): Promise<ClientCredentialsAuthResult>

Defined in: packages/simply-core/src/auth/clientCredentialsAuth.ts:85

Authenticates to a Salesforce org using the OAuth 2.0 Client Credentials grant, and persists the result to the local Salesforce CLI auth store exactly like sf login org jwt/sf org login web do — the returned org is aliasable and usable via --target-org anywhere in the sf/ simply ecosystem afterward.

The Salesforce CLI has no built-in support for this grant (only web, JWT, and SFDX auth-url). This proxies @jsforce/jsforce-node’s generic OAuth2 token exchange into @salesforce/core’s AuthInfo, mirroring the same access-token handoff the JWT flow uses internally after its own token exchange.

The Connected App’s OAuth policy must include the api and id/openid scopes — AuthInfo resolves the username/org ID via the /services/oauth2/userinfo endpoint, which depends on them. Unlike JWT or web auth, a Client Credentials token runs as the single “run as” user configured on the Connected App in Setup, not a per-request user.

ClientCredentialsAuthOptions

Login URL, Connected App credentials, and optional alias/default settings.

Promise<ClientCredentialsAuthResult>

The persisted AuthInfo, along with the resolved username/org ID/instance URL.

InvalidClientCredentialsSecretError if not exactly one of consumerSecret/ consumerSecretFile is given.

ClientCredentialsAuthError if the token exchange fails.