I am attempting to authorize a developer Sandbox using JWT in an attempt to implement a CI process. I found this related question on the subject:

Can I connect to a sandbox using JWT Flow and Prod connect app?

I have attempted to follow the advice given there. I am able to use JWT in my production org without any issues. The sandbox I am attempting to auth into was created off of production, so the connected app that I use in production is also in the Sandbox, but with a different client secret. However when I try to authorize into the sandbox:

sfdx force:auth:jwt:grant --clientid <clientId-from-sandbox> 
--jwtkeyfile <path-to-server.key> 
--username <sytem-admin> --instanceurl <instance-url-for-sandbox>

I get the following error:

ERROR:  This org appears to have a problem with its OAuth configuration. 
Reason: invalid_grant - audience is invalid 

Anyone have any idea what I'm doing wrong here?

  • For the <instance-url-for-sandbox> variable, are you using the full qualified URL to the SB, or just test.salesforce.com?
    – Rodrigo
    Jan 11, 2019 at 16:11
  • @Rodrigo I'm using the full qualified url as all of our sandboxes utilize My Domain. Though I have tried using test.salesforce.com to no avail. Jan 11, 2019 at 16:57
  • Did you find an answer to your question? I'm running into the same issue. Have you tried using the clientId-from-production instead of the clientId-from-sandbox?
    – Marty C.
    Apr 18, 2019 at 0:35
  • Well, I'm glad I'm not the only one. I did not get this resolved and I actually had to put this project aside and continue to do my authentications with the web interface. I've been meaning to take another crack at it but haven't found the time. I can't remember if I tried the client Id from production, but if you try it, please report back! Apr 30, 2019 at 14:43

1 Answer 1


I was having similar issue. I made below changes and was able to Authorize.

  1. Set environment variable SFDX_AUDIENCE_URL export SFDX_AUDIENCE_URL=https://test.salesforce.com

  2. Change Client key - When connected app is copied from Production it will have new client key in production. So open connected app via setup -> App -> connected APP and copy client key

  3. Update value of key "sfdcLoginUrl" to https://test.salesforce.com in file sfdx-project.json. This file is present in sfdx directory. I used bash to update file.

echo '{"packageDirectories": [ { "path": "force-app", "default": true }],"namespace": "","sfdcLoginUrl": "https://test.salesforce.com","sourceApiVersion": "45.0" }' > sfdx-project.json

After making these changes it works!

  • 1
    another tip for those using this to log into newly refreshed sandboxes easier -- You have to use sfdx force:auth:logout -u sandboxAlias to remove the old org / info. For some reason when I tried to overwrite the alias using the JWT Grant method, I still ended up with the "User hasn't approved this consumer". After "removing" the "old" org auth info from my local SFDX orgs, this was fixed.
    – Zerkz
    Aug 8, 2020 at 15:52
  • Do you think this can work in a developer org? I am getting a grant not found error.
    – digidigo
    Mar 4, 2023 at 22:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .