# How to Configure Auth0 Domain, Client ID, and Client Secret for Auth0 Deploy CLI

> Configure Auth0 domain, client ID, and client secret for Auth0 Deploy CLI using a config file or environment variables. Get started easily.

- Repository: [Auth0/auth0-deploy-cli](https://github.com/auth0/auth0-deploy-cli)
- Tags: how-to-guide
- Published: 2026-02-25

---

**You can configure the Auth0 Deploy CLI credentials using either a JSON configuration file ([`config.json`](https://github.com/auth0/auth0-deploy-cli/blob/main/config.json)) or environment variables (`AUTH0_DOMAIN`, `AUTH0_CLIENT_ID`, `AUTH0_CLIENT_SECRET`), with environment variables taking precedence by default.**

The `auth0/auth0-deploy-cli` repository provides a command-line tool for managing Auth0 tenant configurations as code. To authenticate against your Auth0 tenant and perform export or import operations, you must configure Auth0 domain, client ID, and client secret for auth0-deploy-cli using one of two supported credential methods documented in the source code.

## Configuration Methods for Auth0 Deploy CLI

The CLI supports interchangeable credential sources. Choose the method that best fits your security model and CI/CD pipeline requirements.

### Method 1: JSON Configuration File

Create a [`config.json`](https://github.com/auth0/auth0-deploy-cli/blob/main/config.json) file in your project root containing the three required authentication keys. According to [`docs/configuring-the-deploy-cli.md`](https://github.com/auth0/auth0-deploy-cli/blob/main/docs/configuring-the-deploy-cli.md) (lines 15-19), the CLI loads this file when you pass the `-c` or `--config_file` flag.

```json
{
  "AUTH0_DOMAIN": "my-tenant.us.auth0.com",
  "AUTH0_CLIENT_ID": "abc123DEF456ghi789JKL0",
  "AUTH0_CLIENT_SECRET": "super-secret-value"
}

```

Reference the configuration file when running commands:

```bash
a0deploy export -c config.json -f yaml -o ./local/

```

The repository includes a `config.json.example` file that provides the skeleton structure for these required keys.

### Method 2: Environment Variables

Export the three variables directly in your shell before invoking the CLI. As documented in [`docs/configuring-the-deploy-cli.md`](https://github.com/auth0/auth0-deploy-cli/blob/main/docs/configuring-the-deploy-cli.md) (lines 36-39) and demonstrated in [`examples/yaml/README.md`](https://github.com/auth0/auth0-deploy-cli/blob/main/examples/yaml/README.md), this approach works well for ephemeral CI/CD environments.

```bash
export AUTH0_DOMAIN=my-tenant.us.auth0.com
export AUTH0_CLIENT_ID=abc123DEF456ghi789JKL0
export AUTH0_CLIENT_SECRET=super-secret-value

a0deploy import --input_file=./local/tenant.yaml

```

## Configuration Precedence and Runtime Validation

The [`src/context/index.ts`](https://github.com/auth0/auth0-deploy-cli/blob/main/src/context/index.ts) file contains the runtime logic that merges credential sources and validates their presence. When both a configuration file and environment variables are present, **environment variables take precedence** over [`config.json`](https://github.com/auth0/auth0-deploy-cli/blob/main/config.json) values.

The runtime validator requires all three parameters—`AUTH0_DOMAIN`, `AUTH0_CLIENT_ID`, and `AUTH0_CLIENT_SECRET`—to be present before executing any tenant operations. If you omit any credential, the CLI throws a validation error during context initialization.

To force the CLI to ignore environment variables and use only the JSON configuration file, pass the `--env=false` flag:

```bash
a0deploy export -c config.json --env=false -f yaml -o ./local/

```

## Step-by-Step Setup Workflow

Follow this sequence to establish secure authentication for your deployment automation:

1. **Create a client** in your Auth0 dashboard (typically named `auth0-deploy-cli-extension`) and copy the **Domain**, **Client ID**, and **Client Secret** values from the application settings.

2. **Select your configuration strategy**:
   - *File-based*: Add the three keys to [`config.json`](https://github.com/auth0/auth0-deploy-cli/blob/main/config.json) (referencing `config.json.example` for structure).
   - *Environment-based*: Export the three variables in your terminal session or CI environment configuration.

3. **Execute CLI commands** using your chosen authentication method:
   ```bash
   # Using the config file

   a0deploy export -c config.json -f yaml -o ./local/
   
   # Using only environment variables

   a0deploy import --input_file=./local/tenant.yaml
   ```

## Summary

- The Auth0 Deploy CLI accepts credentials via [`config.json`](https://github.com/auth0/auth0-deploy-cli/blob/main/config.json) or environment variables containing `AUTH0_DOMAIN`, `AUTH0_CLIENT_ID`, and `AUTH0_CLIENT_SECRET`.
- **Environment variables override configuration file values** by default according to the merging logic in [`src/context/index.ts`](https://github.com/auth0/auth0-deploy-cli/blob/main/src/context/index.ts).
- Use the `--env=false` flag to disable environment variable loading and enforce file-based configuration only.
- The [`docs/configuring-the-deploy-cli.md`](https://github.com/auth0/auth0-deploy-cli/blob/main/docs/configuring-the-deploy-cli.md) provides the authoritative reference for both methods (lines 15-19 for file-based, lines 36-39 for environment variables).

## Frequently Asked Questions

### Can I use both a config file and environment variables simultaneously?

Yes. The CLI merges both sources during context initialization in [`src/context/index.ts`](https://github.com/auth0/auth0-deploy-cli/blob/main/src/context/index.ts), with environment variables taking precedence over [`config.json`](https://github.com/auth0/auth0-deploy-cli/blob/main/config.json) values. This allows you to define default credentials in a file while overriding specific values via environment variables for different deployment environments.

### What happens if I omit the client secret in my configuration?

The deployment will fail immediately during the initialization phase. The validation logic in [`src/context/index.ts`](https://github.com/auth0/auth0-deploy-cli/blob/main/src/context/index.ts) explicitly checks for the presence of `AUTH0_CLIENT_SECRET` alongside the domain and client ID, throwing an error if any required credential is missing.

### Where can I find the client credentials in my Auth0 dashboard?

Navigate to **Applications > Applications** in your Auth0 dashboard and select the application created for deployment (typically named `auth0-deploy-cli-extension`). The **Domain**, **Client ID**, and **Client Secret** appear on the **Settings** tab. Store the client secret securely and never commit it to version control.

### How do I disable environment variable loading?

Pass the `--env=false` flag when running any `a0deploy` command. This forces the CLI to read credentials exclusively from the specified configuration file, ignoring any exported environment variables that might be present in the shell environment.