I'm working with a website developer to do some integration with a Salesforce REST API that I've written. We're using JWT oauth flow for the website to authenticate with the Salesforce sandbox. The integration was working fine for several weeks, but a few days ago it stopped working with this error:

{"message":"Session expired or invalid","errorCode":"INVALID_SESSION_ID"}

I had not made any changes to the connected app or to the user ID or profile in Salesforce. The website has been using the same access token this whole time.

My question: Assuming the "exp" parameter was set correctly in the JWT with a future date, is there anything else that could be causing this error? [The website dev set up the JWT and there's an 8-hour time difference, so I haven't confirmed the exp value from him yet.]


The "exp" parameter that's part of the JWT does not have anything to do with how long the access token you get as a result of the JWT flow is valid for. Rather, this parameter tells Salesforce how long the JWT itself is valid for (for the purpose of generating the access token that you end up using in other API requests).

The session timeout for OAuth flows can be managed via the connected app you're using. If you aren't managing session timeout via the connected app, then your org's default session timeout is used.

If I had to guess, I'd say that your external (to Salesforce) system simply failed to make a request before the session id (i.e. the access token) timed out.

Making a successful request to the Salesforce API resets the session timeout; but once your session has timed out, you'll need to have your external system run through the JWT flow again to get a new access token.

| improve this answer | |
  • Thanks for your quick reply, I'll ask the website dev to do the JWT flow again. – David Cheng Mar 27 '18 at 16:24
  • It turns out there was a typo in the header that the website system was sending. – David Cheng Mar 28 '18 at 14:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.