Moving Authenticated Orgs in Salesforce CLI from One MacBook to Another

1 The Problem

When setting up a new machine, one of the most common pain points for Salesforce developers and architects is migrating authenticated orgs. You don't want to re-authenticate every org manually—especially if you have dozens of sandboxes, DevHubs, and production environments already linked in your CLI.

Salesforce CLI stores authenticated org credentials locally. When you switch machines, these don't automatically carry over.

The challenge is:

• You want to migrate all orgs (aliases, DevHubs, sandboxes, production, etc.) to your new laptop.
• You need a repeatable, secure method that avoids copy-pasting secrets into GitHub or relying on scripts from unverified sources.

2 The Solution

The solution is to export authentication URLs from the old laptop and then import them into the new one. Salesforce CLI provides an sfdxAuthUrl string that encodes your login session. By storing these in local files, you can move them safely to your new machine.

3 Step 1: Export Authenticated Orgs from Old MacBook

On your old laptop, run this script to extract all non-scratch orgs and save their sfdxAuthUrl values into individual files:

#!/bin/bash

# Create export directory
EXPORT_DIR=~/sfdx_auth_export
mkdir -p "$EXPORT_DIR"

# First, generate the org list
sf org list --json > ~/org_list.json

# Extract aliases from the JSON (non-scratch orgs)
aliases=$(jq -r '.result.nonScratchOrgs[].alias // empty' ~/org_list.json)

for alias in $aliases; do
    if [ -n "$alias" ]; then
        # Get the SFDX Auth URL
        auth_url=$(sf org display --target-org "$alias" --verbose --json | jq -r '.result.sfdxAuthUrl // empty')

        if [ -n "$auth_url" ]; then
            # Save to file named after the alias
            echo "$auth_url" > "$EXPORT_DIR/${alias}.sfdxurl"
            echo "Exported $alias"
        else
            echo "Failed to export $alias (no auth URL - may be JWT authenticated)"
        fi
    fi
done

echo "Export complete. Files are in $EXPORT_DIR"

4 Step 2: Transfer Files Securely

Transfer the folder ~/sfdx_auth_export to your new MacBook using one of these secure methods:

5 Step 3: Import Orgs to New MacBook

On your new machine, run the following script to import each .sfdxurl file back into Salesforce CLI:

#!/bin/bash

EXPORT_DIR=~/sfdx_auth_export

for file in "$EXPORT_DIR"/*.sfdxurl; do
    if [ -f "$file" ]; then
        alias=$(basename "$file" .sfdxurl)

        # Import the URL with alias
        sf org login sfdx-url --sfdx-url-file "$file" --alias "$alias"

        echo "Imported $alias"
    fi
done

echo "Import complete. Run 'sf org list' to verify."

After running the script, verify your orgs are available:

# List all authenticated orgs
sf org list

# Test connection to a specific org
sf org display --target-org your-alias

6 Why This Method Is Secure

• Local Only: Everything stays on your machine. No credentials are pushed to third-party repos or cloud storage.
• No Hardcoding: Auth URLs are pulled directly from the CLI instead of being manually copied or typed.
• Repeatable: Works across machines, across orgs, and for both sf (current CLI) and legacy sfdx commands.
• No Third-Party Dependencies: Uses only official Salesforce CLI commands—no random GitHub scripts or npm packages.

For teams, this approach also prevents risky practices like checking authentication files into version control.

7 Frequently Asked Questions

8 Related Reading

Continue your Salesforce CLI and DevOps learning journey with these related guides:

• Salesforce Security Ultimate Guide - Comprehensive security best practices for Salesforce admins and developers
• 7 Ways to Secure Experience Cloud - Essential security measures for Salesforce communities
• Solution vs Technical Architect - Understanding the key differences between architect roles

9 Abbreviations & Glossary