I am having trouble getting the hang of the JWT Oauth flow and how it exactly works. Is a user supposed to enter their username on your website, which you then generate the JWT on your server and then post to Salesforce?

Any help is much appreciated.


JWT doesn't sound like the correct solution to your problem but to expand on Keith's answer a bit:

The JWT OAuth flow is predicated on a previously set up mutual trust between you (the app developer) and the Salesforce user who is using your app. If that trust hasn't already been established, you're not going to create this trusted relationship by just posting some data to Salesforce with their username.

First, the user needs to "trust" your connected app. This is usually by an admin preauthorizing it or the user using it in the past.

At this point, because you're now trusted...

An incoming request to Salesforce that has been signed by the private key of the Connected App's certificate is the proof that you are the same entity which the user trusted initially, allowing your connected app to access Salesforce on their behalf. If you meet these conditions, you'll get a successful response with tokens.

Without the prior trust, you're out of luck.


The JWT flow makes most sense when doing server to server communication using pre-agreed user names. The authentication is done via a shared certificate that is part of the connected app configuration. Essential an access channel is being opened that is secured by the certificate without the need for a password.

The approach you describe of allowing users to enter just a username would allow anyone who could obtain or guess a username to have access to Salesforce through your website which is probably not what you want.

Other OAUTH flows allow Salesforce to display a normal username/password dialog and then provide an authentication token back to your website that it can then use for further requests. This leaves the authentication responsibility with Salesforce which is a good thing as home-grown solutions often have security problems.

See Digging Deeper into OAuth 2.0 on Force.com for the various flows available.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.