Azure / Azure/azure-functions-core-tools

feat: Add func keys list command for local development with --enableAuth

Open
#5,312 0 comments 2 reactions 0 assignees View on GitHub
enhancement needs-discussion v5
Dominant language
C#
Stars
1.5k
Forks
498
Avg merge
5d 4h
Merged PRs (30d)
15

Description

## Feature Request

### Problem
When running a Function App locally with `func start --enableAuth`, keys (master, function, and system keys) are stored in Azurite blob storage. There is no built-in CLI command to retrieve these keys locally.

Users currently have to manually query Azurite's `azure-webjobs-secrets` blob container to find and parse the keys. This workaround:
- Requires users to know internal implementation details of how keys are stored in Azurite
- Is fragile — the storage format/location could change between releases
- Creates unnecessary friction for the `--enableAuth` local dev experience

This affects anyone testing trigger extensions, webhooks, or any endpoint that requires key-based auth locally — including extension webhooks (e.g., `blobs_extension`, `eventgrid_extension`, `durabletask_extension`, `connector_extension`), HTTP triggers with function keys, and admin APIs with the master key.

### Current Workaround

```powershell
$connStr = ""
$blobs = az storage blob list --container-name azure-webjobs-secrets --connection-string $connStr -o json | ConvertFrom-Json
$blobName = ($blobs | Sort-Object { $_.properties.lastModified } | Select-Object -Last 1).name
az storage blob download --container-name azure-webjobs-secrets --name $blobName --connection-string $connStr --file host-keys.json --no-progress
$keys = Get-Content host-keys.json | ConvertFrom-Json
# Then manually navigate $keys.masterKey, $keys.functionKeys, $keys.systemKeys
```

### Proposed Solution
Add a `func keys list` (or similar) command that works during local development when `--enableAuth` is active. For example:

```bash
func keys list
# Output:
# Master Key:
#
#
# Function Keys:
# default:
#
# System Keys (extensions):
# blobs_extension:
# connector_extension:
# ...

func keys list --type system
# Show only system keys

func keys list --type function
# Show only function keys
```

This would mirror the `az functionapp keys list` command available for deployed apps, providing a consistent experience between local and cloud development.

### Key Types That Should Be Supported

| Key Type | Purpose | Example Use |
|----------|---------|-------------|
| **Master Key** | Full admin access to all endpoints and admin APIs | `GET /admin/host/status?code=` |
| **Function Keys** | Invoke specific functions via HTTP trigger | `GET /api/MyFunction?code=` |
| **System Keys** | Used by extensions for webhook/trigger endpoints | `POST /runtime/webhooks/?code=` |

### Motivation
- Exposing the app via dev tunnels for local testing of trigger callbacks requires system keys
- Testing auth-dependent flows (extension webhooks, trigger callbacks) needs easy key access
- Verifying key-based access before deploying should be frictionless
- The current workaround leaks internal storage details that could change between releases

### Related
- #3394

Contributor guide

Open the contributing guide

Research direction

Start by locating the existing CLI command handlers for func and the local --enableAuth/Azurite key-storage path. Define the func keys list entry point and supported master, function, and system key output, then verify that filtering by --type retrieves the expected local keys without requiring users to inspect blob storage.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, csharp
Domain
authentication, backend, cli
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.