1

Can someone provide/point me in the direction of detailed instructions to set up a connected app & JWT token for JWT-Based Authorization Flow? Salesforce documentation isn't super clear.

I've created a new connected app:

1: Filled out required fields in the "Basic Information" section

2: Checked: Enable OAuth Settings

3: Checked: Enable for Device Flow (not sure if this is right)

4: Left the default callback URL for the step above

5: checked "Use digital signatures"

6: Created a Self Signed Cert using these steps.

7: Uploaded cert under "Use digital signatures"

8: Added the following scopes (not sure if these are right)

  • Access your basic information (id, profile, email, address, phone)
  • Full access (full)
  • Perform requests on your behalf at any time (refresh_token, offline_access)

9: Unchecked: Require Secret for Web Server Flow (not sure about this)

Under "Manage" I have the following settings:

  • Permitted Users: All users may self-authorize
  • IP Relaxation: Relax IP restrictions

However, when I tried to authenticate using sfdx force:auth:jwt:grant --clientid <Consumer_Key> --jwtkeyfile server.key --username <Username> --setdefaultdevhubusername, I get the following error:

An error occurred authorizing this org. name: invalid_grant message: user hasn't approved this consumer

Improve this question
2
  • Could you share more details about your use case? Are your using JWT tokens for authenticating with a desktop application? Did you consider using oAuth2 for web server flow? Just curious.
    – Salesforcesmarty
    Mar 15, 2017 at 5:01
  • 1
    @Salesforcesmarty its for continuous integration using SFDX and JWT is the only supported option
    – NSjonas
    Mar 15, 2017 at 18:16

2 Answers 2

Reset to default
6

just as an FYI: you could have avoided the manual login if you had set the policy settings to:

Permitted Users: Admin approved users are pre-authorized

and then assigned the Connected App to the profile of your user, i.e. an API Only profile.

As you already mentioned yourself, all of your other settings were perfect.

Cheers

Improve this answer
3

Turns out I just needed to authorize the client app for my user by logging in with the standard web oauth flow once first.

Improve this answer
2
  • 2
    Thanks for this insight, NSjonas. But this is ridiculous... isn't the point of this to remove the need for manual steps? We're trying to do this from our build system... and this means that whenever we spin up a new build agent, we have to manually remote in and log in through the web anyway?!
    – Jay Querido
    Mar 15, 2019 at 19:59
  • Hi, did you find a solution to this? I'm having a similar issue. Just refreshed my sandbox and am getting "user hasn't approved this consumer" even though Admin approved users are pre-authorized and the System Admin profile is added.
    – jonny-harte
    May 3, 2022 at 23:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .