I try to run canvas app in Salesforce after deploy the Web App to Heroku. But in salesforce get "This App must be invoked via a signed request" instead the message Hello User.FullName. Following all instructions during Canvas Developer Guide


"<%@ page import="canvas.SignedRequest" %>
<%@ page import="java.util.Map" %>
    // Pull the signed request out of the request body and verify/decode it.
    Map<String, String[]> parameters = request.getParameterMap();
    String[] signedRequest = parameters.get("signed_request");
    if (signedRequest == null) {%>
        This App must be invoked via a signed request!<%
    String yourConsumerSecret=System.getenv("CANVAS_CONSUMER_SECRET");
    //String yourConsumerSecret="1818663124211010887";
    String signedRequestJson = SignedRequest.verifyAndDecodeAsJson(signedRequest[0], yourConsumerSecret);


<title>Hello World Canvas Example</title>

<link rel="stylesheet" type="text/css" href="/sdk/css/canvas.css" />

<!-- Include all the canvas JS dependencies in one file -->
<script type="text/javascript" src="/sdk/js/canvas-all.js"></script>
<!-- Third part libraries, substitute with your own -->
<script type="text/javascript" src="/scripts/json2.js"></script>

    if (self === top) {
        // Not in Iframe
        alert("This canvas app must be included within an iframe");

    Sfdc.canvas(function() {
        var sr = JSON.parse('<%=signedRequestJson%>');
        // Save the token
        Sfdc.canvas.byId('username').innerHTML = sr.context.user.fullName;


<h1>Hello <span id='username'></span></h1>

As it appears, signedRequest == null, but I don't undestand why

  • Is the connected app in Salesforce configured to send a signed request? Jul 27, 2016 at 20:40
  • Apparently, Yes. As in Canvas Developer Guide I have established: Access Method - Signed Request(POST) Jul 28, 2016 at 8:41
  • Is the user accessing the canvas app already admin-approved, or are they using self-authorization? In the latter case they may not get the signed-request POST until the OAuth flow has been completed. Jul 28, 2016 at 9:00
  • Yeah, It was self-authorization. I have changed to admin-approved and now It is working fine. Thank you very much, Daniel ! But can you explain how to resolve problem with OAuth flow? Jul 28, 2016 at 10:01
  • And maybe you can help me with another my problem of Canvas Developer Guide? salesforce.stackexchange.com/questions/133490/… Jul 28, 2016 at 10:24

1 Answer 1


To the original question. Is the canvas app is using self-authorization rather than admin-approved users then the first access to the app will be as part of the OAuth flow rather than a POST with the signed-request.

You would need to detect this and complete the OAuth flow first before the signed-request POST will occur.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .