I try to run canvas app in Salesforce after deploy the Web App to Heroku. But in salesforce get "This App must be invoked via a signed request" instead the message Hello User.FullName. Following all instructions during Canvas Developer Guide


"<%@ page import="canvas.SignedRequest" %>
<%@ page import="java.util.Map" %>
    // Pull the signed request out of the request body and verify/decode it.
    Map<String, String[]> parameters = request.getParameterMap();
    String[] signedRequest = parameters.get("signed_request");
    if (signedRequest == null) {%>
        This App must be invoked via a signed request!<%
    String yourConsumerSecret=System.getenv("CANVAS_CONSUMER_SECRET");
    //String yourConsumerSecret="1818663124211010887";
    String signedRequestJson = SignedRequest.verifyAndDecodeAsJson(signedRequest[0], yourConsumerSecret);


<title>Hello World Canvas Example</title>

<link rel="stylesheet" type="text/css" href="/sdk/css/canvas.css" />

<!-- Include all the canvas JS dependencies in one file -->
<script type="text/javascript" src="/sdk/js/canvas-all.js"></script>
<!-- Third part libraries, substitute with your own -->
<script type="text/javascript" src="/scripts/json2.js"></script>

    if (self === top) {
        // Not in Iframe
        alert("This canvas app must be included within an iframe");

    Sfdc.canvas(function() {
        var sr = JSON.parse('<%=signedRequestJson%>');
        // Save the token
        Sfdc.canvas.byId('username').innerHTML = sr.context.user.fullName;


<h1>Hello <span id='username'></span></h1>

As it appears, signedRequest == null, but I don't undestand why

  • Is the connected app in Salesforce configured to send a signed request? Jul 27 '16 at 20:40
  • Apparently, Yes. As in Canvas Developer Guide I have established: Access Method - Signed Request(POST) Jul 28 '16 at 8:41
  • Is the user accessing the canvas app already admin-approved, or are they using self-authorization? In the latter case they may not get the signed-request POST until the OAuth flow has been completed. Jul 28 '16 at 9:00
  • Yeah, It was self-authorization. I have changed to admin-approved and now It is working fine. Thank you very much, Daniel ! But can you explain how to resolve problem with OAuth flow? Jul 28 '16 at 10:01
  • And maybe you can help me with another my problem of Canvas Developer Guide? salesforce.stackexchange.com/questions/133490/… Jul 28 '16 at 10:24

To the original question. Is the canvas app is using self-authorization rather than admin-approved users then the first access to the app will be as part of the OAuth flow rather than a POST with the signed-request.

You would need to detect this and complete the OAuth flow first before the signed-request POST will occur.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.