Error while trying to authorize an org through JWT from SFDX CLI on Windows.

sfdx force:auth:jwt:grant --clientid <myclientid> --jwtkeyfile server.key --instanceurl https://mysandbox.my.salesforce.com --username <myusername> --setalias PraveenDevJWT

I am trying using the above mentioned SFDX CLI command. I have made sure that the user I am using is assigned to the Profile to which the connected app is assigned to.

Here is the error that I see:

ERROR: This org appears to have a problem with its OAuth configuration. Reason: invalid_grant - audience is invalid

username: myusername,

clientId: myclientid,

loginUrl: 'Not Specified'

privateKey: server.key.

Try this:

Verify the OAuth configuration for this org. For JWT:

Ensure the private key is correct and the cert associated with the connected app has not expired.

Ensure the following OAuth scopes are configured [api, refresh_token, offline_access].

Ensure the username is assigned to a profile or perm set associated with the connected app.

Ensure the connected app is configured to pre-authorize admins.

The error message says loginUrl: which I reckon can be the issue, but I am not sure how to set it (if it is really required). Can anyone please help with this? Thanks.

2 Answers 2


Run the following command first

export SFDX_AUDIENCE_URL=https://test.salesforce.com

Then run

sfdx force:auth:jwt:grant --clientid <myclientid> --jwtkeyfile server.key --instanceurl https://mysandbox.my.salesforce.com --username <myusername> --setalias PraveenDevJWT

Running the above-mentioned commands, worked for me.


  • Hi @Praveen Tata.. This worked for me. Any idea why this is required?
    – wesfaith
    Jul 27, 2019 at 4:50
  • @wesfaith I am not totally sure, but it seems like it points the Audience URL to the test.salesforce.com which is not by default set. So, in order to make the CLI know that we want to connect to a sandbox, we need to explicitly tell the Audience URL. Jul 29, 2019 at 15:33
  • Seems to be, based on the document below, thank for sharing @PraveenTata: help.salesforce.com/… Apr 11, 2020 at 21:50

1- go to "sfdx-project.json" file

2- change "sfdcLoginUrl" from "https://login.salesforce.com" to "https://test.salesforce.com"

3- authorize your org again

It will work

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .