I am trying to get JWT Bearer Token Flow to work. But get the error user hasn't approved this consumer. I have read these posts:

Salesforce JWT User Hasn't Approved This Consumer (Again)

OAuth 2.0 JWT Bearer Token Flow

OAuth 2.0 JWT Bearer Token Flow giving a user hasn't approved this consumer error

and all seem to say the same, that the application needs to be authorized. I am doing this, but still get the error. Is there something else that I am missing?


POST https://login.salesforce.com/services/oauth2/authorize HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Host: login.salesforce.com
Content-Length: 151
Expect: 100-continue
Connection: Keep-Alive


JWT Request

POST https://login.salesforce.com/services/oauth2/token HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Host: login.salesforce.com
Content-Length: 666
Expect: 100-continue


JWT Response

HTTP/1.1 400 Bad Request
Date: Sat, 10 Feb 2018 13:40:45 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Content-Security-Policy: upgrade-insecure-requests 
Cache-Control: no-cache,must-revalidate,max-age=0,no-store,private
Set-Cookie: BrowserId=A1Sl9NmzQ5eoVt_etmmBbg;Path=/;Domain=.salesforce.com;Expires=Wed, 11-Apr-2018 13:40:45 GMT;Max-Age=5184000
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: application/json;charset=UTF-8
Content-Length: 82

{"error":"invalid_grant","error_description":"user hasn't approved this consumer"}
  • 4
    What are the scopes you've selected for your connected app? (api + refresh_token/offline_access seem to both be required.) Are you using the same user for the JWT as you are for authroizing? Do you need users to self-authorize (having an admin mark certain profiles as pre-authorized makes the JWT flow a bit easier at the cost of a little security).
    – Derek F
    Feb 10, 2018 at 14:39
  • 1
    Also, you can check to see if your authorization attempt actually went through by checking a few places. If authorization did succeed, you should see a session for your specified user in the "User Session Information" page (setup menu -> search for "session management"). You should also see your connected app in the "OAuth connected apps" related list of your user's detail page.
    – Derek F
    Feb 10, 2018 at 14:45
  • 4
    Changing from All users must self-authorize to Admin approved users are pre-authorized did the trick. Thanks for that! I guess this is the option I should go with since the integration is from another system. But let's say I wanted to go with All users must self-authorize. What would I have to do? Feb 10, 2018 at 15:21
  • 2
    I'm not entirely sure, since I've only ever used the pre-authorized setting myself. That's why I was asking questions and pointing you to places where you could check to see if the user-driver authorization had actually worked. The other questions you linked suggest that you need to first use a flow that generates a refresh token (user-agent, or web server flows).
    – Derek F
    Feb 10, 2018 at 15:41

2 Answers 2


"user hasn't approved this consumer" This is a common error caused when the user doesn't have a prior refresh_token associated with him/her.

The solution is to perform an Autorization grant (Web Server flow or User-Agent Flow) at least once. I wrote in detail about it; look specifically at step #3 here - https://mannharleen.github.io/2020-03-03-salesforce-jwt/

That should solve the error.

  • Thanks for the link - but I may have found an errata on it as Salesforce has changed. You say to click edit against your app and then "Choose ‘Permitted Users’ = ‘Admin approved users are pre-authorized’ Save ." but "Choose Permitted Users" does not appear on the app edit page.
    – Adam
    Mar 31, 2021 at 14:16

Just a brief addition, as I'm sure the OP has resolved this issue long ago by now. It may be helpful for others in the future.

I had the same issue, while was working in a sandbox

  • created my Connected App
  • built the JWT token via Python 3, PyJWT
  • sent the requests via Python 3, requests

Each piece seemed to be perfectly fine but got back the {'error': 'invalid_grant', 'error_description': "user hasn't approved this consumer"} error every time regardless any (pointless) effort.

For me, the OAuth 2.0 JWT Bearer Token Flow giving a user hasn't approved this consumer error solution worked perfectly fine.

It seems the OP tried to send the authentication via Curl or HTTP client but in fact, it should be opened in a browser.


where the [clientId] is the connected app Consumer Key and the [redirectUri] is the Callback URL. Of course, the domain should be correct for the type of environment the app is running (test.salesforce.com for sandbox, etc.)

When the URL is opened in a browser Salesforce.com - after login - will open up a page similar to this to review and accept the scopes of the requested app.

SF connected app auth

This wouldn't work with a command-line app (curl, http, etc)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .