Authentication

The plugin does not introduce a new auth model. It inherits whatever sf session is active for the target org alias, which means the same login command you already use for sf project deploy works here.

Interactive, on a developer laptop:

sf org login web --alias staging
sf org login web --alias prod

Headless, on a CI runner:

sf org login jwt \
  --username admin@mycompany.com \
  --jwt-key-file server.key \
  --client-id <connected-app-client-id> \
  --alias prod

Every plugin command accepts --target-org <alias> (or -o <alias>) and uses that alias’s stored session. There is no separate token to manage and no secret to rotate beyond the standard sf auth.