How to authenticate CI to an org
The pipeline needs to log in to Salesforce orgs without a human. It does this from SFDX auth URLs stored as repository variables. This guide wires them up.
Get an auth URL
From a machine already authenticated to the org:
Copy the sfdxAuthUrl value from the JSON output (it starts force://). Treat it as a secret —
it grants full access to the org.
The URL is a credential
Never paste an auth URL into logs, tickets, or chat. The scripts pipe it through stdin and redact it from all output; keep the same discipline yourself.
Store it as a repository variable
In Repository settings → Pipelines → Repository variables, add a secured variable:
| Org | Variable name |
|---|---|
| DevHub | DEVHUB_AUTH_URL |
| SIT | SIT_AUTH_URL |
| UAT | UAT_AUTH_URL |
| PRODUCTION | PRODUCTION_AUTH_URL |
The stage variable name is <ENV>_AUTH_URL, upper-cased, where <ENV> is the environment a branch
maps to (see the branch model).
The pipeline's ci auth-devhub and ci auth-deploy steps read these; nothing else is required
(ci group).
Build-status credentials (for quick deploys)
Quick deploys publish and read a commit build status via the Bitbucket REST API, which needs its own credentials:
- Create a repository access token with repository read + write scopes (Repository settings → Security → Access tokens).
- Add it as the secured repository variable
BITBUCKET_ACCESS_TOKEN.
Missing build-status creds are non-fatal
Without them the deploy runs in full instead of quick-deploying — see quick deploy.