We have a managed package that uses oauth both online and offline to interact with the Salesforce APIs on behalf of a user. When the user launches the managed package, they authorize the app. From there, we generate and use a JWT bearer token (https://help.salesforce.com/articleView?id=remoteaccess_oauth_jwt_flow.htm&language=en_US&type=0) to hit the API on behalf of the user (including when the user is offline).

This works fine, until the managed package is upgraded. What happens then is that Salesforce still shows in "Connected Apps Oauth Usage" that the app is authorized to make oauth calls on behalf of the user, but any calls that we make fail ("user has not approved this consumer"). We've found that if we manually revoke the oauth grant and then re-launch the managed package to go through authorization again that the grant is recreated and valid. This doesn't work with our workflow though.

Questions: has anybody seen this before? This seems like a bug in Salesforce. Am I missing something?

Is there a workaround that we should try? Ideally, an admin should be able to upgrade the package and then do nothing else, and the previously-granted oauth grant should keep on working.


I've run into this issue as well and talked with the salesforce team responsible for the connected app and the packaging team. The issue is how the connected app and package works. You generate a new managed package containing a CA the CA version is automatically incremental as well.
If the connected app package is upgraded in a SF org, all existing auth tokens are wiped out or invalidated. The reasoning is that the new connected app is a version newer and SF assumes the CA permissions invalidate existing oath tokens.

If the CA is set up as "users must self authorize" then every time the package and therefore the CA changes, they must reauthorize themselves.

If the CA is set up the other way, "Admin approved users are pre-authorized" and a profile or permission set , once the existing oath tokens are wiped out they can be immediately recreated without customer involvement.

I know it's not ideal but that is what I have learned.

Hope that helps!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.