OAuth 2.0 JWT Bearer Token Flow - "user hasn't approved this consumer"

Question

I am trying to get JWT Bearer Token Flow to work. But get the error user hasn't approved this consumer. I have read these posts:

Salesforce JWT User Hasn't Approved This Consumer (Again)

OAuth 2.0 JWT Bearer Token Flow

OAuth 2.0 JWT Bearer Token Flow giving a user hasn't approved this consumer error

and all seem to say the same, that the application needs to be authorized. I am doing this, but still get the error. Is there something else that I am missing?

Authorize

POST https://login.salesforce.com/services/oauth2/authorize HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Host: login.salesforce.com
Content-Length: 151
Expect: 100-continue
Connection: Keep-Alive

response_type=code&client_id=3MV...4QJ3&redirect_uri=https%3A%2F%2Flocalhost

JWT Request

POST https://login.salesforce.com/services/oauth2/token HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Host: login.salesforce.com
Content-Length: 666
Expect: 100-continue

grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Ajwt-bearer&assertion=eyJhbGciOiJ...pjCY1Ug

JWT Response

HTTP/1.1 400 Bad Request
Date: Sat, 10 Feb 2018 13:40:45 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Content-Security-Policy: upgrade-insecure-requests 
Cache-Control: no-cache,must-revalidate,max-age=0,no-store,private
Set-Cookie: BrowserId=A1Sl9NmzQ5eoVt_etmmBbg;Path=/;Domain=.salesforce.com;Expires=Wed, 11-Apr-2018 13:40:45 GMT;Max-Age=5184000
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: application/json;charset=UTF-8
Content-Length: 82

{"error":"invalid_grant","error_description":"user hasn't approved this consumer"}

Answer 1

"user hasn't approved this consumer" This is a common error caused when the user doesn't have a prior refresh_token associated with him/her.

The solution is to perform an Autorization grant (Web Server flow or User-Agent Flow) at least once. I wrote in detail about it; look specifically at step #3 here - https://mannharleen.github.io/2020-03-03-salesforce-jwt/

That should solve the error.

Answer 2

Just a brief addition, as I'm sure the OP has resolved this issue long ago by now. It may be helpful for others in the future.

I had the same issue, while was working in a sandbox

• created my Connected App
• built the JWT token via Python 3, PyJWT
• sent the requests via Python 3, requests

Each piece seemed to be perfectly fine but got back the {'error': 'invalid_grant', 'error_description': "user hasn't approved this consumer"} error every time regardless any (pointless) effort.

For me, the OAuth 2.0 JWT Bearer Token Flow giving a user hasn't approved this consumer error solution worked perfectly fine.

It seems the OP tried to send the authentication via Curl or HTTP client but in fact, it should be opened in a browser.

https://login.salesforce.com/services/oauth2/authorize?client_id=[clientId]&redirect_uri=[redirectUri]&response_type=code

where the [clientId] is the connected app Consumer Key and the [redirectUri] is the Callback URL. Of course, the domain should be correct for the type of environment the app is running (test.salesforce.com for sandbox, etc.)

When the URL is opened in a browser Salesforce.com - after login - will open up a page similar to this to review and accept the scopes of the requested app.

This wouldn't work with a command-line app (curl, http, etc)