AuthMe

One-click Salesforce DX project setup from AuthMe Suite: grant-based org launch, auth through the Salesforce CLI, and workspace bootstrap.

Works With

This extension works well with the Salesforce Dev Pack, but does not install or require it. AuthMe's launch flow only requires the Salesforce CLI.

Features

Project Setup (AuthMe Suite)

• Opens orgs from AuthMe Suite via a grant-based deep link (no Salesforce session token in the URL)
• Exchanges a one-time grant with the AuthMe server, then authenticates with sf org login access-token
• Stores no session token on disk (SF CLI owns auth)
• Creates Salesforce DX projects and opens them in a new VS Code window
• Legacy SID-in-URL links are rejected; current launches use an opaque one-time grant

Developer Tooling

• Prettier / Prettier Apex / XML plugin setup for Salesforce projects
• Workspace bootstrap under a configurable Salesforce DX workspace path
• Getting Started walkthrough and AuthMe status bar when a project is open

The status bar names the selected login with AuthMe's server-resolved display label. The longer Salesforce CLI alias is an internal, collision-safe execution key; it appears only in the tooltip for diagnostics and is never used as the visible project label.

Editor launch protocol

AuthMe stages the alias change across installed clients. During adoption it emits:

vscode://avidev9.authme/launch?v=1&server=<https-origin>&grant=<opaque>

At the reviewed fleet cutover it emits launch-v2?v=2. This extension accepts both paired path/version forms. v1 retains the username-derived Salesforce CLI alias so mixed installed versions agree; v2 requires the consume response's canonical loginId and derives a collision-safe login hash alias. A mismatched path/version fails closed.

1. Extension validates the server origin against authme.server.allowedOrigins (exact match; no TOFU)
2. POST {server}/api/v1/editor-launches/consume with { "grant": "..." }
3. Maps the response into project setup (token only in memory for sf org login access-token)
4. Scaffolds / re-auths the SFDX project and opens a new window. An open_and_refresh intent first forces sf project retrieve start --manifest manifest/package.xml.

Grant lifetime is short (~90s) and single-use. Tokens and grants are never written to disk or the AuthMe output channel.

Scope

Core does one thing: get you from an org in AuthMe Suite to a working SFDX project. Apex documentation generation and Apex log download were removed in 0.11.0 — install v0.10.1 if you still need them. The AI agent generation subsystem, org context builder, and schema field tooling left earlier. Anything that ships separately does so with its own activation, storage, and auth; core does not depend on it through files, commands, APIs, or extension dependencies.

Commands

Configuration

TLS certificates

AuthMe automatically makes Salesforce CLI and npm use certificates trusted by the operating system, including corporate proxy and private root CAs. Usually there is nothing to configure in the extension.

For older Node runtimes that cannot read the operating system trust store, the advanced authme.network.caBundlePath setting accepts an absolute path to a PEM bundle. AuthMe validates the bundle and supplies it through NODE_EXTRA_CA_CERTS.

AuthMe does not disable TLS verification. Settings such as NODE_TLS_REJECT_UNAUTHORIZED=0 or VS Code's --ignore-certificate-errors should not be used because they allow man-in-the-middle attacks.

Core Project File

Core writes .authme/project.json during project setup and uses workspaceContains:.authme/project.json to activate in generated projects.

{
  "name": "<selected-login display name from the grant consume response>",
  "projectName": "<normalized workspace folder name>",
  "path": "<absolute project path>",
  "org": {
    "id": "<required canonical 15-character Salesforce organization id>",
    "instanceUrl": "https://....my.salesforce.com",
    "username": "<sf username>",
    "alias": "<workspace name plus login identity discriminator>"
  },
  "timestamp": "<ISO 8601>"
}

Credentials are NEVER in this file. Core runs authenticated operations through the Salesforce CLI using org.alias; access tokens remain in the CLI auth store. The launch URI carries only protocol version, server origin, and opaque grant; it never supplies this display name or other organization/login metadata.

License

This package is not distributed under an open-source license (UNLICENSED).