I'm trying to connect to a sandbox using the sfdx cli and the JWT flow through force:auth:jwt:grant. According to this Salesforce DX doc, we can use the same connected app information from Production to connect to our Scratch Org.

Is it something that should work for sandbox too ? I'm getting a "Failed: Not approved" error.

Connected app in sandbox comes from the refresh but has a different consumer key. The Permission set is set correctly on my user.

Is there a way to connect to a recently refreshed sandbox using the JWT flow (without manually changing something like the consumer key) ?


You can use the Connected App from your production org, but to avoid the user hasn't approved this consumer error, I've found that you need to authenticate using the password and the Connected App's Client Id first. Then you'll be able to authenticate with JWT using the key.

  • Are you using the Production Connected App's Client Id? What command are you using to authenticate?
    – Nicholas
    May 4 '21 at 13:28
  • Yes, the client id of the Connected App created in prod. Using force cli, I use force login -i test --connected-app-client-id xxx, then force login -i test --connected-app-client-id xxx -u user@example.com -key path/to/app.key
    – xn.
    May 4 '21 at 15:48
  • I see, this is possible using github.com/ForceCLI/force but its an interactive (browser) session. The first command anyway redirects to an error page. The second, as expected, has the usual ERROR: user hasn't approved this consumer
    – Nicholas
    May 6 '21 at 9:22
  • You'll need to add localhost:3835/oauth/callback to your Connected App as a callback url for the interactive authentication.
    – xn.
    May 6 '21 at 16:04

I assume you are trying to JWT into a developer sandbox just refreshed or created from production. If so, I had the same exact problem. I was trying to login with the same --clientid and --jwtkeyfile as the Production org and the --username --instanceurl flags pointing to the sandbox admin user and https://test.salesforce.com respectively. This was failing with:

Reason: invalid_grant - user hasn't approved this consumer

I was, however, able to login if I used the new/different consumer key from the sandbox.

Not sure this is going to work for my use case, as I'm trying to use developer sandboxes in a CI setup. Not sure how I'll get at those updated consumer key on the freshly created/refreshed developer sandboxes.

Would still be interested to head if any others have a suggestion.

Edit: After digging around a bit, it appears this is a limitation on Salesforce.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.