Azure / Azure/azure-functions-core-tools
feat: Add func keys list command for local development with --enableAuth
- Dominant language
- C#
- Stars
- 1.5k
- Forks
- 498
- Avg merge
- 5d 4h
- Merged PRs (30d)
- 15
Description
## Feature Request
### Problem
When running a Function App locally with `func start --enableAuth`, keys (master, function, and system keys) are stored in Azurite blob storage. There is no built-in CLI command to retrieve these keys locally.
Users currently have to manually query Azurite's `azure-webjobs-secrets` blob container to find and parse the keys. This workaround:
- Requires users to know internal implementation details of how keys are stored in Azurite
- Is fragile — the storage format/location could change between releases
- Creates unnecessary friction for the `--enableAuth` local dev experience
This affects anyone testing trigger extensions, webhooks, or any endpoint that requires key-based auth locally — including extension webhooks (e.g., `blobs_extension`, `eventgrid_extension`, `durabletask_extension`, `connector_extension`), HTTP triggers with function keys, and admin APIs with the master key.
### Current Workaround
```powershell
$connStr = ""
$blobs = az storage blob list --container-name azure-webjobs-secrets --connection-string $connStr -o json | ConvertFrom-Json
$blobName = ($blobs | Sort-Object { $_.properties.lastModified } | Select-Object -Last 1).name
az storage blob download --container-name azure-webjobs-secrets --name $blobName --connection-string $connStr --file host-keys.json --no-progress
$keys = Get-Content host-keys.json | ConvertFrom-Json
# Then manually navigate $keys.masterKey, $keys.functionKeys, $keys.systemKeys
```
### Proposed Solution
Add a `func keys list` (or similar) command that works during local development when `--enableAuth` is active. For example:
```bash
func keys list
# Output:
# Master Key:
#
#
# Function Keys:
# default:
#
# System Keys (extensions):
# blobs_extension:
# connector_extension:
# ...
func keys list --type system
# Show only system keys
func keys list --type function
# Show only function keys
```
This would mirror the `az functionapp keys list` command available for deployed apps, providing a consistent experience between local and cloud development.
### Key Types That Should Be Supported
| Key Type | Purpose | Example Use |
|----------|---------|-------------|
| **Master Key** | Full admin access to all endpoints and admin APIs | `GET /admin/host/status?code=` |
| **Function Keys** | Invoke specific functions via HTTP trigger | `GET /api/MyFunction?code=` |
| **System Keys** | Used by extensions for webhook/trigger endpoints | `POST /runtime/webhooks/?code=` |
### Motivation
- Exposing the app via dev tunnels for local testing of trigger callbacks requires system keys
- Testing auth-dependent flows (extension webhooks, trigger callbacks) needs easy key access
- Verifying key-based access before deploying should be frictionless
- The current workaround leaks internal storage details that could change between releases
### Related
- #3394
Contributor guide
Research direction
Start by locating the existing CLI command handlers for func and the local --enableAuth/Azurite key-storage path. Define the func keys list entry point and supported master, function, and system key output, then verify that filtering by --type retrieves the expected local keys without requiring users to inspect blob storage.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, csharp
- Domain
- authentication, backend, cli
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100