Deploying ExtlClntAppOauthSettings fails from cli but not from VS Code

[branderson-js]

Note
Before you submit your issue, make sure that:

• You're using the latest version of Salesforce CLI.
  @salesforce/cli/2.122.6 linux-x64 node-v22.9.0
• You've searched both open and closed issues for related posts.
• You've used the doctor command to diagnose common issues.

{
  "versionDetail": {
    "architecture": "linux-x64",
    "cliVersion": "@salesforce/cli/2.122.6",
    "nodeVersion": "node-v22.9.0",
    "rootPath": "/usr/local/home/branderson/.npm-packages/lib/node_modules/@salesforce/cli",
    "shell": "bash",
    "pluginVersions": [
      "@oclif/plugin-autocomplete 3.2.40 (core)",
      "@oclif/plugin-commands 4.1.40 (core)",
      "@oclif/plugin-help 6.2.37 (core)",
      "@oclif/plugin-not-found 3.2.74 (core)",
      "@oclif/plugin-plugins 5.4.55 (core)",
      "@oclif/plugin-search 1.2.37 (core)",
      "@oclif/plugin-update 4.7.18 (core)",
      "@oclif/plugin-version 2.2.36 (core)",
      "@oclif/plugin-warn-if-update-available 3.1.55 (core)",
      "@oclif/plugin-which 3.2.43 (core)",
      "@salesforce/cli 2.122.6 (core)",
      "agent 1.27.3 (core)",
      "apex 3.9.5 (core)",
      "api 1.3.8 (core)",
      "auth 4.1.4 (core)",
      "code-analyzer 5.5.0 (user)",
      "data 4.0.67 (core)",
      "deploy-retrieve 3.24.7 (core)",
      "info 3.4.100 (core)",
      "limits 3.3.74 (core)",
      "marketplace 1.3.8 (core)",
      "org 5.9.64 (core)",
      "packaging 2.24.11 (core)",
      "schema 3.3.90 (core)",
      "settings 2.4.54 (core)",
      "sobject 1.4.82 (core)",
      "telemetry 3.6.71 (core)",
      "templates 56.4.7 (core)",
      "trust 3.7.113 (core)",
      "user 3.6.48 (core)"
    ]
  },
  "sfdxEnvVars": [],
  "sfEnvVars": [
    [
      "SF_MDAPI_TEMP_DIR",
      "/home/branderson/.sf/manifestCache/deployZips"
    ],
    [
      "SF_LOG_LEVEL",
      "trace"
    ],
    [
      "SF_USE_GENERIC_UNIX_KEYCHAIN",
      "true"
    ],
    [
      "SF_CONTAINER_MODE",
      "true"
    ],
    [
      "SF_NPM_REGISTRY",
      "https://jfrog/artifactory/api/npm/npm-remote/"
    ],
    [
      "SF_AUTOUPDATE_DISABLE",
      "true"
    ],
    [
      "SF_DISABLE_AUTOUPDATE",
      "true"
    ],
    [
      "SF_UPDATE_INSTRUCTIONS",
      "Use \"npm update --global @salesforce/cli\" to update npm-based installations."
    ]
  ],
  "proxyEnvVars": [
    [
      "HTTP_PROXY",
      "http://localhost:1010"
    ],
    [
      "HTTPS_PROXY",
      "http://localhost:1010"
    ]
  ],
  "cliConfig": {
    "arch": "x64",
    "bin": "sf",
    "binAliases": [
      "sfdx"
    ],
    "cacheDir": "/home/branderson/.cache/sf",
    "channel": "stable",
    "configDir": "/home/branderson/.config/sf",
    "dataDir": "/home/branderson/.local/share/sf",
    "dirname": "sf",
    "flexibleTaxonomy": true,
    "home": "/home/branderson",
    "isSingleCommandCLI": false,
    "name": "@salesforce/cli",
    "npmRegistry": "https://jfrog/artifactory/api/npm/npm-remote/",
    "nsisCustomization": "scripts/nsis.nsi",
    "platform": "linux",
    "root": "/usr/local/home/branderson/.npm-packages/lib/node_modules/@salesforce/cli",
    "shell": "bash",
    "theme": {
      "bin": "blueBright",
      "command": "blueBright",
      "dollarSign": "green",
      "flag": "green",
      "flagDefaultValue": "blueBright",
      "flagOptions": "blueBright",
      "flagRequired": "red",
      "sectionHeader": "blue",
      "topic": "blueBright",
      "json": {
        "brace": "whiteBright",
        "bracket": "whiteBright",
        "comma": "green",
        "key": "blueBright",
        "string": "greenBright",
        "number": "blue",
        "boolean": "redBright",
        "null": "blackBright"
      }
    },
    "topicSeparator": " ",
    "updateConfig": {
      "node": {
        "options": [
          "--no-deprecation"
        ]
      },
      "s3": {
        "bucket": "dfc-data-production",
        "host": "https://developer.salesforce.com",
        "templates": {
          "target": {
            "baseDir": "<%- bin %>",
            "manifest": "<%- channel === 'stable' ? '' : 'channels/' + channel + '/' %><%- platform %>-<%- arch %>",
            "unversioned": "<%- channel === 'stable' ? '' : 'channels/' + channel + '/' %><%- bin %>-<%- platform %>-<%- arch %><%- ext %>",
            "versioned": "<%- channel === 'stable' ? '' : 'channels/' + channel + '/' %><%- bin %>-v<%- version %>/<%- bin %>-v<%- version %>-<%- platform %>-<%- arch %><%- ext %>"
          },
          "vanilla": {
            "baseDir": "<%- bin %>",
            "manifest": "<%- channel === 'stable' ? '' : 'channels/' + channel + '/' %>version",
            "unversioned": "<%- channel === 'stable' ? '' : 'channels/' + channel + '/' %><%- bin %><%- ext %>",
            "versioned": "<%- channel === 'stable' ? '' : 'channels/' + channel + '/' %><%- bin %>-v<%- version %>/<%- bin %>-v<%- version %><%- ext %>"
          }
        }
      }
    },
    "userAgent": "@salesforce/cli/2.122.6 linux-x64 node-v22.9.0",
    "valid": true,
    "version": "2.122.6",
    "warned": false,
    "windows": false,
    "_base": "@oclif/core@4.8.0",
    "_commands": {},
    "_topics": {},
    "commandPermutations": {
      "validPermutations": {}
    },
    "pluginLoader": {
      "options": {
        "root": "/usr/local/home/branderson/.npm-packages/lib/node_modules/@salesforce/cli/dist"
      },
      "errors": [],
      "plugins": {},
      "pluginsProvided": false
    },
    "topicPermutations": {
      "validPermutations": {}
    },
    "nodeEngine": ">=18.6.0"
  },
  "pluginSpecificData": {
    "@salesforce/plugin-deploy-retrieve": [
      {
        "sourceApiVersion": "66.0",
        "targetOrgApiVersion": "66.0"
      }
    ],
    "@salesforce/plugin-auth": [
      {
        "isUsingGenericKeychain": true,
        "sfCryptoV2Support": true,
        "cryptoVersion": "v1"
      }
    ]
  },
  "diagnosticResults": [
    {
      "testName": "salesforcedx plugin isn’t installed",
      "status": "pass"
    },
    {
      "testName": "you don't have any linked plugins",
      "status": "pass"
    },
    {
      "testName": "http_proxy and HTTP_PROXY environment variables match",
      "status": "pass"
    },
    {
      "testName": "https_proxy and HTTPS_PROXY environment variables match",
      "status": "pass"
    },
    {
      "testName": "[@salesforce/plugin-trust] can ping: https://registry.npmjs.org",
      "status": "pass"
    },
    {
      "testName": "[@salesforce/plugin-trust] can ping: https://registry.yarnpkg.com",
      "status": "pass"
    },
    {
      "testName": "[@salesforce/plugin-trust] can ping: https://jfrog/artifactory/api/npm/npm-remote/",
      "status": "pass"
    },
    {
      "testName": "using latest or latest-rc CLI version",
      "status": "pass"
    },
    {
      "testName": "[@salesforce/plugin-deploy-retrieve] sourceApiVersion matches apiVersion",
      "status": "pass"
    },
    {
      "testName": "[@salesforce/plugin-deploy-retrieve] sourceApiVersion matches default target org max apiVersion",
      "status": "pass"
    },
    {
      "testName": "can access: https://test.salesforce.com",
      "status": "pass"
    },
    {
      "testName": "can access: https://appexchange.salesforce.com/services/data",
      "status": "pass"
    },
    {
      "testName": "can access: https://developer.salesforce.com/media/salesforce-cli/sf/channels/stable/sf-win32-x64-buildmanifest",
      "status": "pass"
    },
    {
      "testName": "[@salesforce/plugin-auth] CLI supports v2 crypto",
      "status": "pass"
    },
    {
      "testName": "[@salesforce/plugin-auth] CLI using stable v1 crypto",
      "status": "pass"
    }
  ],
  "suggestions": [
    "Check https://github.com/forcedotcom/cli/issues for CLI issues posted by the community.",
    "Check http://status.salesforce.com for general Salesforce availability and performance.",
    "using npm registry https://jfrog/artifactory/api/npm/npm-remote/ from npm config"
  ],
  "logFilePaths": [
    "/usr/local/home/branderson/workspaces/fe-2778551/+share+/salesforce/1770921767399-command-stdout.log",
    "/usr/local/home/branderson/workspaces/fe-2778551/+share+/salesforce/1770921767399-command-debug.log"
  ],
  "commandExitCode": 1,
  "commandName": "sf project deploy start --metadata ExtlClntAppOauthSettings:Pardot_API_for_Apex_oauth --dev-debug"
}

• You understand that GitHub Issues don't adhere to any agreement or SLA.
  • If you require immediate assistance, use official channels such as Salesforce Customer Support.

Summary

Steps To Reproduce

IMPORTANT
Provide a repository that's configured to reproduce the issue. If you are unable to provide a repo, please explain why not. The more info we have from the start, the faster we can resolve your issue.
We may close your issue if you don't include proper instructions.

• Generate a project with sf project generate or fork dreamhouse-lwc.
• Provide detailed step-by-step instructions on how to reproduce the issue.

Expected result

running this command:

sf project deploy start --metadata "ExtlClntAppOauthSettings:Pardot_API_for_Apex_oauth"

should successfully deploy ExtlClntAppOauthSettings to org

Actual result

Failing with this error message:

There was a problem with the OAuth link. The app either isn’t available on this instance of your org or was deprecated or deleted. If the app isn’t available in this instance, wait 10-15 minutes and try again. Otherwise, contact the developer who created this app and uninstall it.

Additional information

When I deploy the exact same file via VS Code extension, it deploys successfully.

This is the source file in question:

<?xml version="1.0" encoding="UTF-8"?>
<ExtlClntAppOauthSettings xmlns="http://soap.sforce.com/2006/04/metadata">
    <commaSeparatedOauthScopes>RefreshToken, Pardot</commaSeparatedOauthScopes>
    <externalClientApplication>Pardot_API_for_Apex</externalClientApplication>
    <isFirstPartyAppEnabled>false</isFirstPartyAppEnabled>
    <label>Pardot_API_for_Apex_oauth</label>
</ExtlClntAppOauthSettings>

System Information

{
  "architecture": "linux-x64",
  "cliVersion": "@salesforce/cli/2.122.6",
  "nodeVersion": "node-v22.9.0",
  "rootPath": "/usr/local/home/branderson/.npm-packages/lib/node_modules/@salesforce/cli",
  "shell": "bash",
  "pluginVersions": [
    "@oclif/plugin-autocomplete 3.2.40 (core)",
    "@oclif/plugin-commands 4.1.40 (core)",
    "@oclif/plugin-help 6.2.37 (core)",
    "@oclif/plugin-not-found 3.2.74 (core)",
    "@oclif/plugin-plugins 5.4.55 (core)",
    "@oclif/plugin-search 1.2.37 (core)",
    "@oclif/plugin-update 4.7.18 (core)",
    "@oclif/plugin-version 2.2.36 (core)",
    "@oclif/plugin-warn-if-update-available 3.1.55 (core)",
    "@oclif/plugin-which 3.2.43 (core)",
    "@salesforce/cli 2.122.6 (core)",
    "agent 1.27.3 (core)",
    "apex 3.9.5 (core)",
    "api 1.3.8 (core)",
    "auth 4.1.4 (core)",
    "code-analyzer 5.5.0 (user) published 135 days ago (Tue Sep 30 2025) (latest is 5.9.0)",
    "data 4.0.67 (core)",
    "deploy-retrieve 3.24.7 (core)",
    "info 3.4.100 (core)",
    "limits 3.3.74 (core)",
    "marketplace 1.3.8 (core)",
    "org 5.9.64 (core)",
    "packaging 2.24.11 (core)",
    "schema 3.3.90 (core)",
    "settings 2.4.54 (core)",
    "sobject 1.4.82 (core)",
    "telemetry 3.6.71 (core)",
    "templates 56.4.7 (core)",
    "trust 3.7.113 (core)",
    "user 3.6.48 (core)"
  ]
}

[github-actions]

Thank you for filing this issue. We appreciate your feedback and will review the issue as soon as possible. Remember, however, that GitHub isn't a mechanism for receiving support under any agreement or SLA. If you require immediate assistance, contact Salesforce Customer Support.

[branderson-js]

Other thing I am noticing is a size difference when deploying from VS Code vs. directly from the CLI.

When deploying from VS Code which succeeds:

When deploying from the CLI which is failing:

[branderson-js]

AH! I think I just discovered the issue, the CLI is automatically injecting an oauthLink tag when I don't want it to. I have my SF_MDAPI_TEMP_DIR variable set and I was able to compare the failing one and the succeeding one.

Why is the CLI injecting this tag whereas VS Code is sending the file through as is?

[branderson-js]

So now I have narrowed it down even further.

When I run this command:

sf project deploy start --source-dir force-app/main/default/extlClntAppOauthSettings/Pardot_API_for_Apex_oauth.ecaOauth-meta.xml

It runs successfully.

But when I run this command:

sf project deploy start --metadata ExtlClntAppOauthSettings:Pardot_API_for_Apex_oauth

It fails.

I am assuming based on the fact that when using --metadata it is doing some sort of download first from the target org and re-deploying? Whereas using the --source-dir deploys the file as is?

I never realized that's what --metadata does. I thought it was just an alias to grab whatever file from your current SF project directory you are in

[EstebanRomero84]

Hey @branderson-js I'n not able to repro this issue. I successfully deployed the ExtlClntAppOauthSettings metadata using the --metadata flag

Can you run the command with --dev-debug flag and share the logs?

[branderson-js]

Ah, after running that command with --dev-debug I see the issue. Since my sandbox has source-tracking enabled, it was doing a check against SourceMember and downloading the file from the sandbox. When I use the --ignore-conflicts flag, it deploys successfully.

@EstebanRomero84 that's why yours works since you're deploying to a Prod org with no source tracking.