Description
Starting in August 2025, when you use the org open command with the --json or --url-only flags, the generated URLs in the output will be single-use only. This means that the URLs can be used only one time; subsequent use won’t allow you to log into the org.
These are the specific commands that will see the change:
sf org open --jsonsf org open --url-onlysf org open --url-only --json
From now until August 2025, the generated URLs in the output will continue to be multi-use. We now also print a deprecation warning to remind you of the upcoming change.
What about org open without --json or --url-only?
As of version 2.81.8 (March 26, 2025), when you use org open without the --json or --url-only flags, the generated URL used to immediately open the org in a browser is already single-use. This doesn’t directly affect you because Salesforce CLI opens the browser.
Special note for Code Builder and other “headless” environments: When you run org open without --json or --url-only in a Code Builder terminal, the URL to open an org in a browser is always displayed, rather than a browser automatically opening. This is normal and expected behavior. The same behavior happens if you set SF _CONTAINER_MODE to true, such as in a continuous integration (CI) job. As of version 2.81.8, the displayed URL in these headless environments is single-use only and expires in 60 seconds.
Why are we making this change?
The way that the org open command currently generates the URL to open an org has some unwanted side effects:
- The URL can be used multiple times in a browser to gain access to your org.
- The URL’s expiration date depends on your connected app OAuth settings.
Single-use URLs work the same way to open your org, but have these constraints:
- They can be used only once.
- The URLs expire 60 seconds after they are generated.
Test the new behavior change
If you're using these URLs for testing automation or external integrations, make sure they work with the new format.
To immediately force the URLs in all output of org open to be single-use, including when outputting to JSON, set the new SF_SINGLE_USE_ORG_OPEN_URL environment variable to true.
For example, from a macOS terminal:
$ export SF_SINGLE_USE_ORG_OPEN_URL=trueAfter setting the environment variable, the output of org open --url-only, for example, displays a single-use URL, even before August 2025.