I am attempting to authorize a developer Sandbox using JWT in an attempt to implement a CI process. I found this related question on the subject:

Can I connect to a sandbox using JWT Flow and Prod connect app?

I have attempted to follow the advice given there. I am able to use JWT in my production org without any issues. The sandbox I am attempting to auth into was created off of production, so the connected app that I use in production is also in the Sandbox, but with a different client secret. However when I try to authorize into the sandbox:

sfdx force:auth:jwt:grant --clientid <clientId-from-sandbox> 
--jwtkeyfile <path-to-server.key> 
--username <sytem-admin> --instanceurl <instance-url-for-sandbox>

I get the following error:

ERROR:  This org appears to have a problem with its OAuth configuration. 
Reason: invalid_grant - audience is invalid 

Anyone have any idea what I'm doing wrong here?

  • For the <instance-url-for-sandbox> variable, are you using the full qualified URL to the SB, or just test.salesforce.com? – Rodrigo Jan 11 '19 at 16:11
  • @Rodrigo I'm using the full qualified url as all of our sandboxes utilize My Domain. Though I have tried using test.salesforce.com to no avail. – blastocyst.jones Jan 11 '19 at 16:57
  • Did you find an answer to your question? I'm running into the same issue. Have you tried using the clientId-from-production instead of the clientId-from-sandbox? – Marty C. Apr 18 '19 at 0:35
  • Well, I'm glad I'm not the only one. I did not get this resolved and I actually had to put this project aside and continue to do my authentications with the web interface. I've been meaning to take another crack at it but haven't found the time. I can't remember if I tried the client Id from production, but if you try it, please report back! – blastocyst.jones Apr 30 '19 at 14:43

I was having similar issue. I made below changes and was able to Authorize.

  1. Set environment variable SFDX_AUDIENCE_URL export SFDX_AUDIENCE_URL=https://test.salesforce.com

  2. Change Client key - When connected app is copied from Production it will have new client key in production. So open connected app via setup -> App -> connected APP and copy client key

  3. Update value of key "sfdcLoginUrl" to https://test.salesforce.com in file sfdx-project.json. This file is present in sfdx directory. I used bash to update file.

echo '{"packageDirectories": [ { "path": "force-app", "default": true }],"namespace": "","sfdcLoginUrl": "https://test.salesforce.com","sourceApiVersion": "45.0" }' > sfdx-project.json

After making these changes it works!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.