I'm trying to follow the instructions in https://help.salesforce.com/articleView?id=remoteaccess_oauth_jwt_flow.htm&type=5 and get an invalid request with an error description of "refresh_token scope is required and the connected app should be installed and preauthorized."

In the documentation it says I should "Install and preauthorize the app" - but I have no idea how to go about this, and I can't find the appropriate docs. I've looked around several config screens for the app and can't see anything obvious. As a salesforce novice I'm stuck!

1 Answer 1


There are much more detailed instructions on setting up JWT authentication in the Salesforce DX Developer Guide, because JWT is often used for CI and other headless authentication use cases. While the documentation is somewhat SFDX-specific, it covers establishing a JWT flow well.

The first couple of steps you'll need to do are

Your digital certificate gets uploaded on the app, and the critical "preauthorize" step takes place at the Connected App level as well:

In the OAuth Policies section, select Admin approved users are pre-authorized for Permitted Users, and click OK.

Click Manage Profiles and then click Manage Permission Sets. Select the profiles and permission sets that are pre-authorized to use this connected app. Create permission sets if necessary.

This allows JWT authentication requests to complete (for users on the relevant Profiles and Permission Sets) with no UI-based authorization at all.

  • I have followed all those steps (only difference is I don't have any permission sets - are they required or can you use profiles only?) Feb 12, 2019 at 13:12
  • You can use profiles only, so long as you pre-authorize them. What scopes do you have selected?
    – David Reed
    Feb 12, 2019 at 13:15
  • 4
    Aha - the app was missing the "Perform requests on your behalf at any time (refresh_token, offline_access)" OAuth scope, after reading the instructions for Create a Connected App the error message suddenly makes a lot of sense! Feb 12, 2019 at 13:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .