Action Required: The SF_TEMP_SHOW_SECRETS Compatibility Workaround Will Be Removed on October 28th, 2026 #3658

Summary

⚠️ After October 28th, 2026, access tokens, passwords, and SFDX Auth URLs will only be available through the dedicated sf org auth show-* commands. At that time, the temporary SF_TEMP_SHOW_SECRETS environment variable will stop working.

This change will occur when the CLI is promoted to latest on Wednesday, October 28th, 2026. Any workflows that set SF_TEMP_SHOW_SECRETS=true must be migrated to use the show-* commands before that date.

This is the final step of the credential-exposure changes announced in #3560.

Background

In #3560, we removed sensitive authentication artifacts (access tokens, passwords, and SFDX Auth URLs) from the standard and --json output of commands like sf org display, and we introduced dedicated commands for retrieving them explicitly. To give teams time to migrate, we shipped a temporary environment variable (SF_TEMP_SHOW_SECRETS) that restored the previous output. That variable was always intended to be temporary and was slated to be removed in "Summer 2026". We are now setting the official date.

What is changing, and when

Until October 28th, 2026, SF_TEMP_SHOW_SECRETS=true continues to work as it does today. On and after October 28th, 2026, setting it has no effect, and the affected commands behave as they do without it.

Why we are removing it

The environment variable reintroduces the exact exposure it was meant to contain by putting long-lived credentials back into standard command output where automated systems and AI agents can capture and store them in plain text. This is not a safe long-term control because an AI agent could set the variable itself. The dedicated show-* commands are the durable replacement. Retrieval becomes an explicit, auditable action that you can also deny-list from an AI agent's allowed commands.

What you need to do

If a workflow currently relies on SF_TEMP_SHOW_SECRETS, switch it to the matching command below. Each command supports --json and --no-prompt for non-interactive use in CI/CD.

• Access token: sf org auth show-access-token
• SFDX Auth URL: sf org auth show-sfdx-auth-url
• User password: sf org auth show-user-password

Example retrieving an access token in a pipeline:

# Before
ACCESS_TOKEN=$(sf org display --json --target-org my-org | jq -r '.result.accessToken')

# After
ACCESS_TOKEN=$(sf org auth show-access-token --json --no-prompt --target-org my-org | jq -r '.result.accessToken')

What is NOT changing

• The sf org auth show-* commands remain the supported way to retrieve these values. Removing the workaround does not remove your ability to retrieve a credential when you genuinely need one.
• sf org login sfdx-url is unchanged. Existing SFDX Auth URLs stored as CI/CD secrets continue to authenticate.
• The @salesforce/core (sfdx-core) library APIs are unchanged.
• CLI versions released before 2.136.8 are unaffected by this change.