docs: JWT authorizations documentation #170

mandelbro · 2025-10-30T16:57:09Z

Description

This pull request adds the documentation JWT (headless) authentication in the Heroku AppLink plugin, providing examples for CI/CD and automation scenarios.

WI

Replace this text with a summary of the change(s) including relevant
motivations, context, and or links.

📋 Documentation Requiring CX Review

README.md Section: Lines 28-196 (the entire JWT Authorization section)
Source Files
- src/lib/jwtAuthCommand.ts (base command with shared text)
- src/commands/salesforce/authorizations/add/jwt.ts
- src/commands/datacloud/authorizations/add/jwt.ts

Live Commands:

heroku salesforce:authorizations:add:jwt --help
heroku datacloud:authorizations:add:jwt --help

Local installation and manual testing instructions

…ication - Added a new section on JWT Authorization, detailing its use for headless authentication in CI/CD pipelines. - Included step-by-step instructions for generating RSA key pairs, configuring Connected Apps in Salesforce, and adding JWT authorization via CLI. - Enhanced the table of contents to reflect new sections and commands related to JWT authorization for both Salesforce and Data Cloud. - Updated command descriptions and examples for clarity and consistency.

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Signed-off-by: Chris Montes <cmontes@heroku.com>

…ected App configuration

heicheng18 · 2025-11-03T16:01:55Z

README.md


 - [@heroku-cli/plugin-applink](#heroku-cliplugin-applink)
 - [Usage](#usage)
+- [JWT Authorization (Headless Authentication)](#jwt-authorization-headless-authentication)


Can this whole section be in a Dev Center article instead? For example, I put the info in a draft: https://devcenter.heroku.com/articles/jwt-heroku-applink?preview_key=35c92d2249f1e86e60eaf0f11bbb0d40652e3830d3f420ea4ec06960c80e8340

heicheng18 · 2025-11-03T16:02:17Z

README.md

+# JWT Authorization (Headless Authentication)
+
+The AppLink plugin supports JWT (JSON Web Token) authorization for headless
+authentication in CI/CD pipelines and automated workflows. This eliminates the


Suggested change

authentication in CI/CD pipelines and automated workflows. This eliminates the

authentication in CI/CD pipelines and automated workflows. JWT authorization eliminates the

heicheng18 · 2025-11-03T16:02:46Z

README.md

+# Generate private key and self-signed certificate
+openssl req -x509 -newkey rsa:4096 -keyout server.key -out server.crt -days 365 -nodes
+
+# Extract public key for Connected App


Suggested change

# Extract public key for Connected App

# Extract public key for connected app

heicheng18 · 2025-11-03T16:03:08Z

README.md

+### 2. Configure Connected App in Salesforce
+
+Follow the official Salesforce documentation to create and configure your
+Connected App:


Suggested change

Connected App:

connected app:

heicheng18 · 2025-11-03T16:03:33Z

README.md

+
+### 3. Pre-authorize Users
+
+Follow the official guide for


Suggested change

Follow the official guide for

Follow the official Salesforce documentation for

heicheng18 · 2025-11-03T16:33:48Z

src/lib/jwtAuthCommand.ts

      required: true,
-      description: 'path to file containing private key to authorize with',
+      description:
+        'Path to file containing RSA private key in PEM format. Generate with: openssl req -x509 -newkey rsa:4096 -keyout server.key -out server.crt -days 365 -nodes',


Suggested change

'Path to file containing RSA private key in PEM format. Generate with: openssl req -x509 -newkey rsa:4096 -keyout server.key -out server.crt -days 365 -nodes',

'path to file containing RSA private key in PEM format to authorize with',

heicheng18 · 2025-11-03T16:34:09Z

src/lib/jwtAuthCommand.ts

      char: 'l',
-      description: 'Salesforce login URL',
+      description:
+        'Salesforce login URL (default: https://login.salesforce.com for production, https://test.salesforce.com for sandboxes)',


Suggested change

'Salesforce login URL (default: https://login.salesforce.com for production, https://test.salesforce.com for sandboxes)',

'Salesforce login URL',

heicheng18 · 2025-11-03T16:34:26Z

src/lib/jwtAuthCommand.ts

      required: true,
-      description: 'username for authorization',
+      description:
+        'Salesforce username that has been authorized for the Connected App. Must be a valid user in the target org.',


Suggested change

'Salesforce username that has been authorized for the Connected App. Must be a valid user in the target org.',

'Salesforce username authorized for the connected app',

heicheng18 · 2025-11-03T16:34:51Z

src/lib/jwtAuthCommand.ts

    alias: flags.string({
      description:
-        'alias for the authorization (defaults to applink:{developer_name})',
+        'Alias for the authorization (defaults to applink:{developer_name}). Used to retrieve credentials via SDK.',


Suggested change

'Alias for the authorization (defaults to applink:{developer_name}). Used to retrieve credentials via SDK.',

'[default: applink:{developer_name}] alias for authorization to retrieve credentials via SDK',

heicheng18 · 2025-11-03T16:51:31Z

README.md

+Follow the official guide for
+[Managing Connected App Policies](https://help.salesforce.com/s/articleView?id=sf.connected_app_manage_oauth.htm):
+
+In your Connected App settings, click **Manage** > **Edit Policies**:


Suggested change

In your Connected App settings, click **Manage** > **Edit Policies**:

In your connected app settings, click **Manage** > **Edit Policies**:

mandelbro added 2 commits October 30, 2025 11:45

docs: Adds JWT command descriptions for Data Cloud and Salesforce

1708a2b

mandelbro requested a review from Copilot October 30, 2025 16:57

mandelbro requested a review from a team as a code owner October 30, 2025 16:57

Copilot AI reviewed Oct 30, 2025

View reviewed changes

docs: Adds documentation for manually testing JWT authorizations

9df705a

mandelbro force-pushed the montes/docs/jwt-auth-documentation branch from dd839f9 to 9df705a Compare October 30, 2025 19:36

mandelbro changed the title ~~Montes/docs/jwt auth documentation~~ docs: JWT authorizations documentation Oct 30, 2025

mandelbro added 3 commits October 30, 2025 14:58

Removes troubleshooting section of readme

5ade027

Signed-off-by: Chris Montes <cmontes@heroku.com>

Fixes TOC

3f2188d

docs: Update README with step-by-step setup guide for Salesforce Conn…

8a5e9d0

…ected App configuration

heicheng18 reviewed Nov 3, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

docs: JWT authorizations documentation #170

docs: JWT authorizations documentation #170

mandelbro commented Oct 30, 2025 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

heicheng18 Nov 3, 2025

Uh oh!

heicheng18 Nov 3, 2025

Uh oh!

heicheng18 Nov 3, 2025

Uh oh!

heicheng18 Nov 3, 2025

Uh oh!

heicheng18 Nov 3, 2025

Uh oh!

heicheng18 Nov 3, 2025

Uh oh!

heicheng18 Nov 3, 2025

Uh oh!

heicheng18 Nov 3, 2025

Uh oh!

heicheng18 Nov 3, 2025

Uh oh!

heicheng18 Nov 3, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	authentication in CI/CD pipelines and automated workflows. This eliminates the
	authentication in CI/CD pipelines and automated workflows. JWT authorization eliminates the

	# Extract public key for Connected App
	# Extract public key for connected app

	Follow the official guide for
	Follow the official Salesforce documentation for

	'Path to file containing RSA private key in PEM format. Generate with: openssl req -x509 -newkey rsa:4096 -keyout server.key -out server.crt -days 365 -nodes',
	'path to file containing RSA private key in PEM format to authorize with',

	'Salesforce login URL (default: https://login.salesforce.com for production, https://test.salesforce.com for sandboxes)',
	'Salesforce login URL',

	'Salesforce username that has been authorized for the Connected App. Must be a valid user in the target org.',
	'Salesforce username authorized for the connected app',

	'Alias for the authorization (defaults to applink:{developer_name}). Used to retrieve credentials via SDK.',
	'[default: applink:{developer_name}] alias for authorization to retrieve credentials via SDK',

	In your Connected App settings, click Manage > Edit Policies:
	In your connected app settings, click Manage > Edit Policies:

docs: JWT authorizations documentation #170

Are you sure you want to change the base?

docs: JWT authorizations documentation #170

Conversation

mandelbro commented Oct 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

📋 Documentation Requiring CX Review

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

mandelbro commented Oct 30, 2025 •

edited

Loading