Skip to content

02 Authentication

Jump to bottom
RemyDuijkeren edited this page Jul 18, 2026 · 14 revisions

Authentication

Flowline delegates all auth to PAC CLI — no credentials stored in Flowline config files, ever. Set up a PAC auth profile once and Flowline picks it up automatically from then on.

Don't have PAC CLI yet? → Install Power Platform CLI

Developer setup — one command

pac auth create --environment https://yourorg-dev.crm4.dynamics.com

Done. A browser opens, you sign in, and Flowline can connect to that environment from now on. Tokens are cached and refreshed automatically — you won't be asked to sign in again.

Multiple environments

One profile per environment, one name each:

pac auth create --environment https://yourorg-dev.crm4.dynamics.com --name "Dev"
pac auth create --environment https://yourorg-test.crm4.dynamics.com --name "Test"
pac auth create --environment https://yourorg.crm4.dynamics.com --name "Prod"

See all profiles and switch the active one:

pac auth list
pac auth select --index 2

Flowline always shows which profile it used before connecting:

Using PAC auth profile 'Dev' (UNIVERSAL)

For the full PAC auth reference → pac auth commands

CI/CD — service principal

Add PAC CLI to your pipeline image, then authenticate with a service principal before running any Flowline command:

pac auth create \
  --applicationId $CLIENT_ID \
  --clientSecret $CLIENT_SECRET \
  --tenant $TENANT_ID \
  --environment $ENV_URL

After that, any Flowline command just works — no extra config needed.

Replace the placeholder values with yours. The one called CLIENT_SECRET — keep that a secret ;-).

# GitHub Actions
- name: Authenticate
  run: |
    pac auth create \
      --applicationId 00000000-0000-0000-0000-000000000000 \
      --clientSecret "$PAC_CLIENT_SECRET" \
      --tenant 00000000-0000-0000-0000-000000000000 \
      --environment https://yourorg.crm4.dynamics.com
  env:
    PAC_CLIENT_SECRET: ${{ secrets.PAC_CLIENT_SECRET }}

- name: Run Flowline
  run: flowline sync   # or push, deploy, generate — any command
# Azure Pipelines
- task: Bash@3
  displayName: Authenticate
  inputs:
    script: |
      pac auth create \
        --applicationId 00000000-0000-0000-0000-000000000000 \
        --clientSecret $(PacClientSecret) \
        --tenant 00000000-0000-0000-0000-000000000000 \
        --environment https://yourorg.crm4.dynamics.com

- task: Bash@3
  displayName: Run Flowline
  inputs:
    script: flowline sync   # or push, deploy, generate — any command

Note for Managed Identity / Azure DevOps Federation: PAC CLI also supports --managedIdentity and --azureDevOpsFederated for keyless auth. See pac auth create.

Run via dnx (no install step)

Both PAC CLI and Flowline are .NET tools, so on a runner with .NET 10 already present, dnx can run either one on demand — no dotnet tool install step, no tool cache to restore. For CI images that are rebuilt or torn down every run, that's one less thing to set up and keep up to date.

dnx microsoft.powerapps.cli.tool --yes auth create \
  --applicationId $CLIENT_ID \
  --clientSecret $CLIENT_SECRET \
  --tenant $TENANT_ID \
  --environment $ENV_URL

dnx flowline --yes sync   # or push, deploy, generate — any command

Auth still persists the same way — dnx runs the same PAC CLI, so the profile created here is picked up whether later commands go through dnx, an installed pac, or Flowline's own internal fallback.

How Flowline selects a profile

When you run a Flowline command, it finds the right PAC auth profile automatically:

  1. Match profiles whose environment URL matches the target
  2. Prefer the one PAC has marked active (pac auth select)
  3. Fall back to the active UNIVERSAL profile if no URL-specific match exists
  4. Multiple matches, none active → interactive: a picker lists candidates; CI: error with a candidate list and pac auth select instructions
  5. No match at all → error with a pac auth create hint

XrmContext generators — one extra step

The default --generator pac needs nothing beyond the PAC auth profile above. The xrmcontext and xrmcontext3 generators are separate external tools that authenticate independently — they can't read from PAC's token cache.

Local dev (personal account)

Flowline still picks up your PAC auth profile for the environment URL, but XrmContext opens its own browser session to authenticate independently. It happens once — the token is cached and subsequent runs are silent. Nothing extra to configure.

Local dev (service principal)

Flowline picks up your PAC auth profile for the environment URL and client ID, but XrmContext can't read PAC's token cache so it needs the secret separately. Pass it with --client-secret:

flowline generate --generator xrmcontext --client-secret <your-secret>

No --client-secret? Flowline will prompt you interactively instead.

CI/CD (service principal)

Pass the secret with --client-secret on the generate step:

# GitHub Actions
- name: Generate types
  run: flowline generate --generator xrmcontext --client-secret "$PAC_CLIENT_SECRET"
  env:
    PAC_CLIENT_SECRET: ${{ secrets.PAC_CLIENT_SECRET }}
# Azure Pipelines
- task: Bash@3
  displayName: Generate types
  inputs:
    script: flowline generate --generator xrmcontext --client-secret $(PacClientSecret)

Flowline also reads the secret from the AZURE_CLIENT_SECRET environment variable if it's already set in your pipeline — useful if other tools share the same credential.

Override credentials on the fly

Use --client-id and --client-secret to pass credentials directly, bypassing whatever is in the PAC auth profile:

flowline generate --generator xrmcontext --client-id <app-id> --client-secret <secret>

→ Generator comparison and XrmContext setup

Troubleshooting

No PAC auth profile found for <url>

No PAC auth profile matches the target environment. Create one:

pac auth create --environment https://yourorg-dev.crm4.dynamics.com --name "Dev"

Multiple PAC auth profiles match <url> (non-interactive)

Multiple profiles are registered for that URL and none is active. Set one as active:

pac auth list
pac auth select --index <n>

Client secret required for '...'

Using an XrmContext generator with a service principal profile but no secret was provided. Pass it with --client-secret:

flowline generate --generator xrmcontext --client-secret <your-secret>

PAC CLI version error (profile file missing or corrupt)

Flowline shows the PAC CLI version and asks you to update:

dotnet tool update --global Microsoft.PowerApps.CLI.Tool
# or
winget upgrade Microsoft.PowerAppsCLI

See also

Clone this wiki locally