AuthMe

One-click Salesforce DX project setup from AuthMe Suite: grant-based org launch, auth through the Salesforce CLI, and workspace bootstrap.

Works With

This extension works with the Salesforce Dev Pack, which is automatically recommended on install.

Features

Project Setup (AuthMe Suite)

Opens orgs from AuthMe Suite via a grant-based deep link (no Salesforce session token in the URL)
Exchanges a one-time grant with the AuthMe server, then authenticates with sf org login access-token
Stores no session token on disk (SF CLI owns auth)
Creates Salesforce DX projects and opens them in a new VS Code window
Legacy SID-in-URL links still work during transition

Developer Tooling

Prettier / Prettier Apex / XML plugin setup for Salesforce projects
Workspace bootstrap under a configurable Salesforce DX workspace path
Getting Started walkthrough and AuthMe status bar when a project is open

Editor launch protocol (Suite v2)

Preferred deep link from AuthMe Suite:

vscode://avidev9.authme/launch?v=1&server=<https-origin>&grant=<opaque>

Extension validates the server origin against authme.server.allowedOrigins (exact match; no TOFU)
POST {server}/api/v1/editor-launches/consume with { "grant": "..." }
Maps the response into project setup (token only in memory for sf org login access-token)
Scaffolds / re-auths the SFDX project and opens a new window. An open_and_refresh intent first forces sf project retrieve start --manifest manifest/package.xml.

Grant lifetime is short (~90s) and single-use. Tokens and grants are never written to disk or the AuthMe output channel.

Scope

Core does one thing: get you from an org in AuthMe Suite to a working SFDX project. Apex documentation generation and Apex log download were removed in 0.11.0 — install v0.10.1 if you still need them. The AI agent generation subsystem, org context builder, and schema field tooling left earlier. Anything that ships separately does so with its own activation, storage, and auth; core does not depend on it through files, commands, APIs, or extension dependencies.

Commands

Command	Description
`AuthMe: Setup packages`	Install required packages (Prettier, plugins)
`AuthMe: Upgrade Salesforce CLI`	Upgrade to latest Salesforce CLI
`AuthMe: Show Output`	Open the AuthMe log output channel

Configuration

Setting	Default	Description
`authme.workspace.path`	-	Path to your Salesforce DX workspace folder
`authme.cli.sfPath`	-	Absolute path to `sf` when auto-detection fails
`authme.cli.npmPath`	-	Absolute path to `npm` when auto-detection fails
`authme.cli.additionalPaths`	`[]`	Extra directories to search for CLI binaries
`authme.network.caBundlePath`	-	Advanced fallback path to an additional PEM CA bundle
`authme.server.allowedOrigins`	`["https://authme2.sfdxy.com"]`	Trusted AuthMe server origins for grant launch

TLS certificates

AuthMe automatically makes Salesforce CLI and npm use certificates trusted by the operating system, including corporate proxy and private root CAs. Usually there is nothing to configure in the extension.

For older Node runtimes that cannot read the operating system trust store, the advanced authme.network.caBundlePath setting accepts an absolute path to a PEM bundle. AuthMe validates the bundle and supplies it through NODE_EXTRA_CA_CERTS.

AuthMe does not disable TLS verification. Settings such as NODE_TLS_REJECT_UNAUTHORIZED=0 or VS Code's --ignore-certificate-errors should not be used because they allow man-in-the-middle attacks.

Core Project File

Core writes .authme/project.json during project setup and uses workspaceContains:.authme/project.json to activate in generated projects.

{
  "name": "<display name from URI>",
  "projectName": "<normalized name; also SF CLI alias and folder name>",
  "path": "<absolute project path>",
  "org": {
    "id": "<15/18-char org id, may be empty>",
    "instanceUrl": "https://....my.salesforce.com",
    "username": "<sf username>",
    "alias": "<same as projectName>"
  },
  "timestamp": "<ISO 8601>"
}

Credentials are NEVER in this file. Core runs authenticated operations through the Salesforce CLI using org.alias; access tokens remain in the CLI auth store.

License

See LICENSE file for details.