# Config as code
## auth0-deploy-cli
`npm install -g auth0-deploy-cli` (or run via npx).
1. `a0deploy export --format=yaml --output_folder=tenant-config`: dumps actions, rules (legacy), connections, applications, APIs, email templates, etc. into a directory.
2. Commit it. Review diffs like code.
3. `a0deploy import --input_file=tenant-config`: applies to a tenant. Promote dev -> staging -> prod by importing the same directory.
## What to keep in the repo
- Actions code (also keep the source in your normal repo; the export is the deployed artifact record).
- Connection configs, application settings, API definitions and permissions.
- Email templates, branding settings.
- Tenant settings (session lifetimes, attack protection thresholds).
## Secrets
The export excludes secrets. Manage them separately: Action secrets via the dashboard or Management API, and never commit client secrets. Your CI needs a Management API token with the right scopes for the target tenant.
## Terraform provider
If the team already speaks Terraform, the Auth0 Terraform provider manages the same resources declaratively with plan/apply and state. Pick ONE tool per tenant; mixing CLI and Terraform fights over state.
## Workflow
- Change in dev tenant (dashboard or code) -> export -> diff -> PR -> import to staging -> test logins -> import to prod.
- Emergency dashboard changes get exported back the same day or they become mystery drift.
## Checklist
- Every tenant reproducible from the repo plus secrets.
- No undocumented dashboard changes older than a day.