Precautionary Measures on Connection Secrets with Deploy CLI

This article addresses an issue where connection secrets are overwritten with incorrect values during an export and import process using the Auth0 Deploy Command Line Interface (CLI).

• Auth0 Deploy CLI

A change in Auth0 Deploy CLI v8.9.0 causes connection secrets to be masked with a dummy value by default during an export. If this exported configuration is later imported, the dummy value replaces the actual connection secret on the tenant.

To prevent the connection secret from being exported and subsequently overwritten, add options.client_secret to the EXCLUDED_PROPS array for connections in the Deploy CLI configuration JSON file.

{
    "AUTH0_DOMAIN": "YOUR_DOMAIN_HERE,
    "AUTH0_CLIENT_ID": "YOUR_CLIENT_ID_HERE",
    "AUTH0_CLIENT_SECRET": "YOUR_CLIENT_SECRET_HERE",
    "EXCLUDED_PROPS": {
        "clients": [
            "client_secret"
        ],
        "connections": [
            "options.client_secret"
        ]
    },
    ...
}