**TL;DR:** Click-ops tenants drift. The deploy CLI exports tenant config to a local repo so changes are reviewed, diffed, and replayable across tenants and environments. Manage them separately: Action secrets via the dashboard or Management API, and never commit client secrets.

# Config as code

## auth0-deploy-cli

`npm install -g auth0-deploy-cli` (or run via npx).

1. `a0deploy export --format=yaml --output_folder=tenant-config`: dumps actions, rules (legacy), connections, applications, APIs, email templates, etc. into a directory.
2. Commit it. Review diffs like code.
3. `a0deploy import --input_file=tenant-config`: applies to a tenant. Promote dev -> staging -> prod by importing the same directory.

## What to keep in the repo

- Actions code (also keep the source in your normal repo; the export is the deployed artifact record).
- Connection configs, application settings, API definitions and permissions.
- Email templates, branding settings.
- Tenant settings (session lifetimes, attack protection thresholds).

## Secrets

The export excludes secrets. Manage them separately: Action secrets via the dashboard or Management API, and never commit client secrets. Your CI needs a Management API token with the right scopes for the target tenant.

## Terraform provider

If the team already speaks Terraform, the Auth0 Terraform provider manages the same resources declaratively with plan/apply and state. Pick ONE tool per tenant; mixing CLI and Terraform fights over state.

## Workflow

- Change in dev tenant (dashboard or code) -> export -> diff -> PR -> import to staging -> test logins -> import to prod.
- Emergency dashboard changes get exported back the same day or they become mystery drift.

## Checklist

- Every tenant reproducible from the repo plus secrets.
- No undocumented dashboard changes older than a day.

## When to use this

- This covers exactly what the title says: Tenant config as code.
- You are setting this up for the first time, or auditing an existing setup.
- You want the key gotchas in one place before you start.

## When not to use this

- You are doing a different workflow with Tenant; these steps are specific to the title above.
- You need the full reference docs; this is the short path, not the manual.

## Compatibility

- Not pinned to a specific version; follows current Tenant behavior.

---

## Vectle citations

- Exact version: <https://vectle.com/skills/skl_LXxfFnV-AH1A76OowuItOQ/versions/skv_pl6KEu0rAR5unUj4ULkFGA>
- Canonical HTML skill page: <https://vectle.com/skills/skl_LXxfFnV-AH1A76OowuItOQ>
- Current Markdown URL: <https://vectle.com/skills/skl_LXxfFnV-AH1A76OowuItOQ/markdown>

## Selected public attribution and original notices/references

```json
{
  "author": "issueatlas",
  "client": null,
  "notices_and_references": [
    "https://auth0.com/docs/deploy-monitor/deploy-cli-tool"
  ]
}
```