How to determine the correct 'audience' and 'uri' when using OAuth 2.0 JSON Web Token (JWT) Bearer Token Flow

Question

I have correctly been able to use "OAuth 2.0 Web Server Authentication Flow" and now I'd like to switch to "OAuth 2.0 JWT Bearer Token Flow".

I wrote a test application in Node.js with the values two values:

audience: 'https://instance.salesforce.com'

and

uri: 'https://instance.salesforce.com/services/oauth2/token'

The response that is coming back is stating:

null
400
{"error":"invalid_grant","error_description":"audience is invalid"}

Also, when I look at the Salesforce Dashboard Login History, I can see "Failed: Audience Invalid".

The question I have is, how do I determine the correct 'audience' and 'uri' value. At the moment, I am using the sandbox.

The help article about JWT Token Flow is a great resource for identifying values that are acceptable for the audience and the URI for the target endpoint. Are you using values shown in the documentation and receiving errors? — Mark Pond, Commented Apr 13, 2018 at 21:42

Mohith Shrivastava · Accepted Answer · 2018-04-13 22:00:32Z

4

You only need audience for the oauth 2.0 JWT bearer token flow and for the salesforce sandbox the value is always https://test.salesforce.com .

You don't need uri for this flow .The below document is a great resource for this

answered Apr 13, 2018 at 22:00

91.9k19 gold badges161 silver badges214 bronze badges

Thank you, in my case I need the audience value to be test.salesforce.com and it I post it to test.salesforce.com/services/oauth2/token.
– Kris
Commented Apr 16, 2018 at 18:46
Is this URI different for a full org? for example, if my full org's URL is something like "https://<company name>--full.my.salesforce.com". I'm using "force:auth:jwt:grant --clientid XXXXX --jwtkeyfile server.key --setdefaultdevhubusername -u <Username> -r https://<company name>--full.my.salesforce.com" command and getting this error "Error authenticating with JWT config due to: audience is invalid"
– Bahman.A
Commented Mar 23, 2021 at 16:26
It is login.salesforce.com or test.salesforce.com for sandbox
– Mohith Shrivastava
Commented Mar 23, 2021 at 16:28
Sounds like this is the same for enhanced domains?
– Andy Ray
Commented Nov 16, 2022 at 23:50

Add a comment |

1 Answer 1