i'm trying to get an access token, in order to make a REST call. I've followed this guide https://help.salesforce.com/HTViewHelpDoc?id=remoteaccess_oauth_jwt_flow.htm&language=en_US

Right now, i've set the app's oauth Permitted Users policy to Admin approved users are pre-authorized and the IP Relaxation to Relax IP restrictions

In the profile for the user i am using, i've added the connected app setup/manage users/profiles/myprofile/assigned connected apps

( for the record, initially i've also tried with Permitted Users policy set to All users may self-authorize, and i did the authorization as it is mentioned here https://developer.salesforce.com/page/Digging_Deeper_into_OAuth_2.0_on_Force.com

GET to https://login.salesforce.com/services/oauth2/authorize?client_id=<client_id>&redirect_uri=<redirect_url>&response_type=code

login with the salesforce credentials, click on Approve

POST to https://login.salesforce.com/services/oauth2/token 


  • grant_type:authorization_code
  • code: [the value passed to the callback url]
  • client_id: [client_id]
  • redirect_uri: [the redirect_url sent in the GET and configured in the app settings]
  • client_secret:[client_secret]


In the OAuth config, i've added all the OAuth Scopes to Selected OAuth Scopes (to make sure this won't cause any errors)

So, with this setup, i make a

POST to https://login.salesforce.com/services/oauth2/token 


  • grant_type: urn:ietf:params:oauth:grant-type:jwt-bearer
  • assertion: [the generated JWT assertion]

Now we get to the interesting part: on sandboxes everything works.

on production i get the following response back:

    "error": "invalid_client",
    "error_description": "invalid client credentials"

I am going mad trying to understand what's wrong here. I've noticed the following error in the login history (setup/manage users/login history)

Login Type:Remote Access 2.0 
Status: Failed: Missing Consumer Key Parameter 
Browser: Jakarta HTTP Common

If I decode the assertion, i get Header:

  "alg": "RS256"


  "iss": "[the client id]",
  "sub": "[my username]",
  "aud": "https://login.salesforce.com",
  "exp": 1427455160

So, the things that are different from sandboxes (where it works) and production (where it is not working) :

any ideeas ? :)

  • How long has been since you set the connected app ? It takes some time for the app to be available Commented Jul 4, 2016 at 14:08
  • ~ 2 weeks, i saw the message that the settings will take 2-10 minutes. I tried after 1h, same behavior
    – Mihai
    Commented Jul 4, 2016 at 14:45

1 Answer 1


The problem was the certificate uploaded in the Digital Certificate/Digital Signature field of the connected app. After uploading the proper certificate, the access token is returned.

  • 5
    was this certificate from self signed certificate in salesforce? or you created using a different platform?
    – manza
    Commented Feb 4, 2020 at 2:14
  • 4
    What makes a "proper" certificate? I created a key and cert like this: openssl req -x509 -nodes -newkey rsa:4096 -keyout key.pem -out cert.pem -sha256 -days 365, and I'm getting the same error
    – Dave
    Commented Nov 17, 2021 at 1:11
  • 1
    As others have said, what makes a certificate "proper"? Commented May 26, 2022 at 20:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .