sf org refresh sandbox doesn't authorize to the new org

[stafik]

Summary

I've used SF CLI to create and refresh sandboxes in my CI/CD pipeline successfully. Something broke down around 2 weeks ago. Create/refresh progress started freezing at the last step - Authenticating.

Steps To Reproduce

1. Refresh an existing developer sandbox using: sf org refresh sandbox --definition-file developer-sandbox-def.json --target-org prodOrgAlias --wait 600 --no-prompt. developer-sandbox-def.json is as follows:

{ "sandboxName": "sbxName" }

2. Notice that the Refreshing org stage finishes and Authenticating keeps running forever.

Expected result

I'd expect that the Authenticating... stage finishes quickly and my pipeline gets authenticated to the new org. It was the case in the past.

Actual result

The Authenticating... stage keeps running for a few hours until my pipeline times out.
Running sf org resume sandbox --job-id 0GRW60000000YT7OAM -o prodOrgAlias lists the entire progress but it still doesn't authenticate to the org.

Additional information

I think I haven't changed anything in my pipeline recently so I'd suspect that something broke down due to Summer '25 release or because we enabled API Access Control - link in prod org. I'm not sure how API Access Control would block the Authorization stage?

Here's a full log from my CI/CD pipeline that should have refreshed a dev sandbox. I cut some Refreshing org... lines and replaced with ellipsis.

$ sf org refresh sandbox --definition-file developer-sandbox-def.json --target-org prodOrgAlias --wait 600 --no-prompt
───── Sandbox Refresh ─────
Stages:
1. Creating new sandbox
2. Refreshing org
3. Authenticating
◯ Creating new sandbox - Skipped
▶ Refreshing org…
   Copy progress: 0%
   Status: Pending
   Status: Processing
   Copy progress: 5%
   Copy progress: 9%
▶ Refreshing org…
   Copy progress: 10%
   Copy progress: 11%
▶ Refreshing org…
   Copy progress: 12%
   Copy progress: 14%
▶ Refreshing org…
...
▶ Refreshing org…
   Copy progress: 16%
   Copy progress: 24%
   Copy progress: 25%
▶ Refreshing org…
...
▶ Refreshing org…
   Copy progress: 26%
▶ Refreshing org…
...
▶ Refreshing org…
   Copy progress: 27%
▶ Refreshing org…
...
▶ Refreshing org…
   Copy progress: 28%
   Copy progress: 47%
▶ Refreshing org…
   Copy progress: 54%
▶ Refreshing org…
   Copy progress: 55%
▶ Refreshing org…
...
▶ Refreshing org…
   Copy progress: 56%
▶ Refreshing org…
   Copy progress: 58%
...
   Copy progress: 71%
▶ Refreshing org…
...
▶ Refreshing org…
   Copy progress: 86%
   Copy progress: 94%
▶ Refreshing org…
...
▶ Refreshing org…
   Copy progress: 95%
   Status: Activating
▶ Refreshing org…
...
▶ Refreshing org…
✔ Refreshing org (5h 42m)
▶ Authenticating…
   Status: Completed
   Copy progress: 100%
▶ Authenticating…
▶ Authenticating…
▶ Authenticating…
▶ Authenticating…
▶ Authenticating…
▶ Authenticating…
▶ Authenticating…
▶ Authenticating…
▶ Authenticating…
▶ Authenticating…
▶ Authenticating…
▶ Authenticating…
▶ Authenticating…
▶ Authenticating…
▶ Authenticating…
▶ Authenticating…
▶ Authenticating…
▶ Authenticating…
▶ Authenticating…
▶ Authenticating…
▶ Authenticating…
▶ Authenticating…
▶ Authenticating…
▶ Authenticating…
▶ Authenticating…
▶ Authenticating…
▶ Authenticating…
▶ Authenticating…
▶ Authenticating…
▶ Authenticating…
▶ Authenticating…
▶ Authenticating…
▶ Authenticating…
▶ Authenticating…
▶ Authenticating…
▶ Authenticating…
▶ Authenticating…
▶ Authenticating…
▶ Authenticating…
▶ Authenticating…
▶ Authenticating…
▶ Authenticating…
▶ Authenticating…
▶ Authenticating…
▶ Authenticating…
▶ Authenticating…
▶ Authenticating…
▶ Authenticating…
▶ Authenticating…
▶ Authenticating…
▶ Authenticating…
✔ Authenticating (4h 18m)
Status: Completed
Copy progress: 100%
Elapsed time: 10h 0m
Warning: The wait time for the sandbox refresh has been exhausted. See the results below for more information.
Run "sf org resume sandbox --job-id 0GRW60000000YT7OAM -o [MASKED]" to check for status.
If the org is ready, checking the status also authorizes the org for use with Salesforce CLI.

Next, I run another pipeline that invokes sf org resume and sf org list to see if the org has been authenticated:

$ sf org resume sandbox --job-id 0GRW60000000YT7OAM -o $ORG_ALIAS || true
Warning: Could not find a cache entry for 0GRW60000000YT7OAM.
If you are resuming a sandbox operation from a different machine note that we cannot set the alias/set-default flag values as those are saved locally.
───── Resume Sandbox ─────
Stages:
1. Creating new sandbox
2. Refreshing org
3. Authenticating
▶ Creating new sandbox…
   Copy progress: 0%
   Name: sbxName
   ID: 0GRW60000000YT7OAM
   Status: Completed
✔ Creating new sandbox (395ms)
   Copy progress: 100%
✔ Refreshing org (0ms)
▶ Authenticating…
▶ Authenticating (244ms)
Status: Completed
Copy progress: 100%
Elapsed time: 641ms
Run "sf org resume sandbox --job-id 0GRW60000000YT7OAM -o [MASKED]" to check for status.
If the org is ready, checking the status also authorizes the org for use with Salesforce CLI.
$ sf org list
     Type    Alias       Username                  Org Id              Status    
---------------------------------------------------------------------------------
 🍁  DevHub  production  [MASKED]  00D1i000000xxxxxx  Connected 
Legend:  🌳=Default DevHub, 🍁=Default Org      Use --all to see expired and deleted scratch orgs

System Information

I'm using Bash.

$ sf version --verbose --json
{
  "architecture": "linux-x64",
  "cliVersion": "@salesforce/cli/2.94.6",
  "nodeVersion": "node-v22.16.0",
  "osVersion": "Linux 6.8.0-1021-aws",
  "rootPath": "/usr/local/lib/nodejs/lib/node_modules/@salesforce/cli",
  "shell": "bash",
  "pluginVersions": [
    "@oclif/plugin-autocomplete 3.2.30 (core)",
    "@oclif/plugin-commands 4.1.26 (core)",
    "@oclif/plugin-help 6.2.29 (core)",
    "@oclif/plugin-not-found 3.2.57 (core)",
    "@oclif/plugin-plugins 5.4.41 (core)",
    "@oclif/plugin-search 1.2.25 (core)",
    "@oclif/plugin-update 4.6.43 (core)",
    "@oclif/plugin-version 2.2.30 (core)",
    "@oclif/plugin-warn-if-update-available 3.1.41 (core)",
    "@oclif/plugin-which 3.2.36 (core)",
    "@salesforce/cli 2.94.6 (core)",
    "agent 1.23.0 (core)",
    "apex 3.6.19 (core)",
    "api 1.3.3 (core)",
    "auth 3.7.2 (core)",
    "data 4.0.39 (core)",
    "deploy-retrieve 3.22.26 (core)",
    "info 3.4.67 (core)",
    "limits 3.3.57 (core)",
    "marketplace 1.3.8 (core)",
    "org 5.8.3 (core)",
    "packaging 2.16.0 (core)",
    "schema 3.3.68 (core)",
    "settings 2.4.32 (core)",
    "sobject 1.4.61 (core)",
    "telemetry 3.6.45 (core)",
    "templates 56.3.51 (core)",
    "trust 3.7.99 (core)",
    "user 3.6.26 (core)",
    "@salesforce/sfdx-scanner 4.12.0 (user) published 58 days ago (Tue Apr 29 2025)",
    "sfdx-git-delta 6.14.0 (user) published 0 days ago (Thu Jun 26 2025)"
  ]
}

Thanks in advance, because I'm running out of ideas.

[github-actions]

Thank you for filing this issue. We appreciate your feedback and will review the issue as soon as possible. Remember, however, that GitHub isn't a mechanism for receiving support under any agreement or SLA. If you require immediate assistance, contact Salesforce Customer Support.

[iowillhoit]

Hey @stafik, thank you for the info. I looked at our telemetry for this command and I am not seeing any significant with the error rates over the last several versions. I have a few questions:

• You said that even when you run the resume command, the sandbox still does not authenticate? I am curious because the table you shared shows Connected.
• Could you add the --dev-debug flag to your command and see if there is any useful information in the logs?
• What happens if you install an older version of the CLI (eg 2.80.12)? Does the command still hang?
  • If it does, I think we can safely rule out the CLI.
  • If it does not hang, something might have changed in the CLI

If I were to guess, the API Access Control is probably the culprit. Can you confirm that the Connected App that you are authenticating with is allowlisted in the Access Control? (docs)

[stafik]

Hi @iowillhoit,
thanks for the tips and sorry for a late reply. It takes almost a day to refresh a sandbox so it took me some time to check your suggestions.

You said that even when you run the resume command, the sandbox still does not authenticate? I am curious because the table you shared shows Connected.

Yes, it puzzled me too. That's why I tried running sf org resume followed by sf org list. I'd expect to see the authenticated sandbox in the sf org list results, however I couldn't find it.

If I were to guess, the API Access Control is probably the culprit. Can you confirm that the Connected App that you are authenticating with is allowlisted in the Access Control?

Thanks for the suggestion! Yes. I have a production deploymentUser, which has a customProfile assigned. I use it to jwt auth to the prod org, using my custom 'customConnApp'. I added the 'customProfile' to the 'customConnApp' and to the standard Salesforce CLI connected app in my prod org. To my surprise, it didn't make any difference.

Eventually, I got to the point that probably granting the Use Any API Client user permission helped. I haven't still had time to toggle this permission back and forth to test if it's really a missing piece of puzzle. I'll come back to the matter in 3 weeks, investigate the matter more and come with the rest of the answers.

Thanks for your support!

[github-actions]

This issue has not received a response in 7 days. It will auto-close in 7 days unless a response is posted.

[stafik]

A few moments later...
I came back to the topic and run a few more tests and finally got to the root cause. Apparently my Salesforce deployment pipeline user required Use any API client user permission when we enabled API Access Control in production org.

Here are some details.
I run my pipeline that created a new sandbox and run an Apex script using sf apex run right after the sandbox is ready and the SF CLI was still authorized to the sandbox. Running the Apex script failed:

...
✔ Refreshing org (5h 6m)
▶ Authenticating…
   Status: Completed
   Copy progress: 100%
✔ Authenticating (1m 39.33s)
Status: Completed
Copy progress: 100%
Elapsed time: 5h 8m
Your sandbox is ready.
You can open it by running "sf org open -o [MASKED].sbx"
$ sf apex run --target-org [MASKED].sbx --file script.apex
Error (1): Unable to refresh session due to: Error authenticating with JWT.
Errors encountered:
user hasn't approved this consumer
user hasn't approved this consumer

I was not aware that enabling API Access Control in production org results in switching all connected apps to be again not approved in a new sandbox. I assumed approved apps in production org would be copied over to a new sandbox. That was maybe the case before enabling API Access Control.

#3368 shed actually some light on my issue so thanks for posting it.

Case closed.