i'm trying to get an access token, in order to make a REST call. I've followed this guide https://help.salesforce.com/HTViewHelpDoc?id=remoteaccess_oauth_jwt_flow.htm&language=en_US

Right now, i've set the app's oauth Permitted Users policy to Admin approved users are pre-authorized and the IP Relaxation to Relax IP restrictions

In the profile for the user i am using, i've added the connected app setup/manage users/profiles/myprofile/assigned connected apps

( for the record, initially i've also tried with Permitted Users policy set to All users may self-authorize, and i did the authorization as it is mentioned here https://developer.salesforce.com/page/Digging_Deeper_into_OAuth_2.0_on_Force.com

GET to https://login.salesforce.com/services/oauth2/authorize?client_id=<client_id>&redirect_uri=<redirect_url>&response_type=code

login with the salesforce credentials, click on Approve

POST to https://login.salesforce.com/services/oauth2/token 


  • grant_type:authorization_code
  • code: [the value passed to the callback url]
  • client_id: [client_id]
  • redirect_uri: [the redirect_url sent in the GET and configured in the app settings]
  • client_secret:[client_secret]


In the OAuth config, i've added all the OAuth Scopes to Selected OAuth Scopes (to make sure this won't cause any errors)

So, with this setup, i make a

POST to https://login.salesforce.com/services/oauth2/token 


  • grant_type: urn:ietf:params:oauth:grant-type:jwt-bearer
  • assertion: [the generated JWT assertion]

Now we get to the interesting part: on sandboxes everything works.

on production i get the following response back:

    "error": "invalid_client",
    "error_description": "invalid client credentials"

I am going mad trying to understand what's wrong here. I've noticed the following error in the login history (setup/manage users/login history)

Login Type:Remote Access 2.0 
Status: Failed: Missing Consumer Key Parameter 
Browser: Jakarta HTTP Common

If I decode the assertion, i get Header:

  "alg": "RS256"


  "iss": "[the client id]",
  "sub": "[my username]",
  "aud": "https://login.salesforce.com",
  "exp": 1427455160

So, the things that are different from sandboxes (where it works) and production (where it is not working) :

any ideeas ? :)

  • How long has been since you set the connected app ? It takes some time for the app to be available – Mohith Shrivastava Jul 4 '16 at 14:08
  • ~ 2 weeks, i saw the message that the settings will take 2-10 minutes. I tried after 1h, same behavior – Mihai Jul 4 '16 at 14:45

The problem was the certificate uploaded in the Digital Certificate/Digital Signature field of the connected app. After uploading the proper certificate, the access token is returned.

  • 3
    was this certificate from self signed certificate in salesforce? or you created using a different platform? – manza Feb 4 '20 at 2:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.