How to Configure Auth0 Domain, Client ID, and Client Secret for Auth0 Deploy CLI

You can configure the Auth0 Deploy CLI credentials using either a JSON configuration file (config.json) or environment variables (AUTH0_DOMAIN, AUTH0_CLIENT_ID, AUTH0_CLIENT_SECRET), with environment variables taking precedence by default.

The auth0/auth0-deploy-cli repository provides a command-line tool for managing Auth0 tenant configurations as code. To authenticate against your Auth0 tenant and perform export or import operations, you must configure Auth0 domain, client ID, and client secret for auth0-deploy-cli using one of two supported credential methods documented in the source code.

Configuration Methods for Auth0 Deploy CLI

The CLI supports interchangeable credential sources. Choose the method that best fits your security model and CI/CD pipeline requirements.

Method 1: JSON Configuration File

Create a config.json file in your project root containing the three required authentication keys. According to docs/configuring-the-deploy-cli.md (lines 15-19), the CLI loads this file when you pass the -c or --config_file flag.

{
  "AUTH0_DOMAIN": "my-tenant.us.auth0.com",
  "AUTH0_CLIENT_ID": "abc123DEF456ghi789JKL0",
  "AUTH0_CLIENT_SECRET": "super-secret-value"
}

Reference the configuration file when running commands:

a0deploy export -c config.json -f yaml -o ./local/

The repository includes a config.json.example file that provides the skeleton structure for these required keys.

Method 2: Environment Variables

Export the three variables directly in your shell before invoking the CLI. As documented in docs/configuring-the-deploy-cli.md (lines 36-39) and demonstrated in examples/yaml/README.md, this approach works well for ephemeral CI/CD environments.

export AUTH0_DOMAIN=my-tenant.us.auth0.com
export AUTH0_CLIENT_ID=abc123DEF456ghi789JKL0
export AUTH0_CLIENT_SECRET=super-secret-value

a0deploy import --input_file=./local/tenant.yaml

Configuration Precedence and Runtime Validation

The src/context/index.ts file contains the runtime logic that merges credential sources and validates their presence. When both a configuration file and environment variables are present, environment variables take precedence over config.json values.

The runtime validator requires all three parameters—AUTH0_DOMAIN, AUTH0_CLIENT_ID, and AUTH0_CLIENT_SECRET—to be present before executing any tenant operations. If you omit any credential, the CLI throws a validation error during context initialization.

To force the CLI to ignore environment variables and use only the JSON configuration file, pass the --env=false flag:

a0deploy export -c config.json --env=false -f yaml -o ./local/

Step-by-Step Setup Workflow

Follow this sequence to establish secure authentication for your deployment automation:

1. Create a client in your Auth0 dashboard (typically named auth0-deploy-cli-extension) and copy the Domain, Client ID, and Client Secret values from the application settings.

2. Select your configuration strategy:

   • File-based: Add the three keys to config.json (referencing config.json.example for structure).
   • Environment-based: Export the three variables in your terminal session or CI environment configuration.

3. Execute CLI commands using your chosen authentication method:

   # Using the config file
   
   a0deploy export -c config.json -f yaml -o ./local/
   
   # Using only environment variables
   
   a0deploy import --input_file=./local/tenant.yaml

Summary

• The Auth0 Deploy CLI accepts credentials via config.json or environment variables containing AUTH0_DOMAIN, AUTH0_CLIENT_ID, and AUTH0_CLIENT_SECRET.
• Environment variables override configuration file values by default according to the merging logic in src/context/index.ts.
• Use the --env=false flag to disable environment variable loading and enforce file-based configuration only.
• The docs/configuring-the-deploy-cli.md provides the authoritative reference for both methods (lines 15-19 for file-based, lines 36-39 for environment variables).

Frequently Asked Questions

Can I use both a config file and environment variables simultaneously?

Yes. The CLI merges both sources during context initialization in src/context/index.ts, with environment variables taking precedence over config.json values. This allows you to define default credentials in a file while overriding specific values via environment variables for different deployment environments.

What happens if I omit the client secret in my configuration?

The deployment will fail immediately during the initialization phase. The validation logic in src/context/index.ts explicitly checks for the presence of AUTH0_CLIENT_SECRET alongside the domain and client ID, throwing an error if any required credential is missing.

Where can I find the client credentials in my Auth0 dashboard?

Navigate to Applications > Applications in your Auth0 dashboard and select the application created for deployment (typically named auth0-deploy-cli-extension). The Domain, Client ID, and Client Secret appear on the Settings tab. Store the client secret securely and never commit it to version control.

How do I disable environment variable loading?

Pass the --env=false flag when running any a0deploy command. This forces the CLI to read credentials exclusively from the specified configuration file, ignoring any exported environment variables that might be present in the shell environment.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}