4

I am trying to get JWT Bearer Token Flow to work. But get the error user hasn't approved this consumer. I have read these posts:

Salesforce JWT User Hasn't Approved This Consumer (Again)

OAuth 2.0 JWT Bearer Token Flow

OAuth 2.0 JWT Bearer Token Flow giving a user hasn't approved this consumer error

and all seem to say the same, that the application needs to be authorized. I am doing this, but still get the error. Is there something else that I am missing?

Authorize

POST https://login.salesforce.com/services/oauth2/authorize HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Host: login.salesforce.com
Content-Length: 151
Expect: 100-continue
Connection: Keep-Alive

response_type=code&client_id=3MV...4QJ3&redirect_uri=https%3A%2F%2Flocalhost

JWT Request

POST https://login.salesforce.com/services/oauth2/token HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Host: login.salesforce.com
Content-Length: 666
Expect: 100-continue

grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Ajwt-bearer&assertion=eyJhbGciOiJ...pjCY1Ug

JWT Response

HTTP/1.1 400 Bad Request
Date: Sat, 10 Feb 2018 13:40:45 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Content-Security-Policy: upgrade-insecure-requests 
Cache-Control: no-cache,must-revalidate,max-age=0,no-store,private
Set-Cookie: BrowserId=A1Sl9NmzQ5eoVt_etmmBbg;Path=/;Domain=.salesforce.com;Expires=Wed, 11-Apr-2018 13:40:45 GMT;Max-Age=5184000
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: application/json;charset=UTF-8
Content-Length: 82

{"error":"invalid_grant","error_description":"user hasn't approved this consumer"}
  • 4
    What are the scopes you've selected for your connected app? (api + refresh_token/offline_access seem to both be required.) Are you using the same user for the JWT as you are for authroizing? Do you need users to self-authorize (having an admin mark certain profiles as pre-authorized makes the JWT flow a bit easier at the cost of a little security). – Derek F Feb 10 '18 at 14:39
  • 1
    Also, you can check to see if your authorization attempt actually went through by checking a few places. If authorization did succeed, you should see a session for your specified user in the "User Session Information" page (setup menu -> search for "session management"). You should also see your connected app in the "OAuth connected apps" related list of your user's detail page. – Derek F Feb 10 '18 at 14:45
  • 3
    Changing from All users must self-authorize to Admin approved users are pre-authorized did the trick. Thanks for that! I guess this is the option I should go with since the integration is from another system. But let's say I wanted to go with All users must self-authorize. What would I have to do? – user3274635 Feb 10 '18 at 15:21
  • 2
    I'm not entirely sure, since I've only ever used the pre-authorized setting myself. That's why I was asking questions and pointing you to places where you could check to see if the user-driver authorization had actually worked. The other questions you linked suggest that you need to first use a flow that generates a refresh token (user-agent, or web server flows). – Derek F Feb 10 '18 at 15:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.