I am trying to implement the OAuth 2.0 JWT Bearer Token Flow on my node.js app using these instructions, but I'm unable to authenticate successfully, getting this error:

{"error":"invalid_grant","error_description":"user hasn't approved this consumer"}


1) All users may self-authorize

2) I followed this answer, which states that I need to login first myself.

so I opened the following link using my browser: https://login.salesforce.com/services/oauth2/authorize?response_type=token&client_id=my_client_id&redirect_uri=https://login.salesforce.com/services/oauth2/success

and authenticated, I was then redirected to https://login.salesforce.com/services/oauth2/success and got the following response in the URL: https://login.salesforce.com/services/oauth2/success#access_token=my_access_token&instance_url=https%3A%2F%2Fmyorg.my.salesforce.com&id=https%3A%2F%2Flogin.salesforce.com%2Fid%2F00D1t0000gdfEA2%2F0051t000003gdfGIAAY&issued_at=1564389252266&signature=gdfgdfMa8SYkZu6Rn6K4iY%3D&scope=full&token_type=Bearer

3) OAuth Scopes includes:

Full Access

4) The redirect_uri used in the auth call matchs the callback uri registered for my app

Here's my code to authenticate:

function jwtLogin(){
    const jsforce = require('jsforce');
    const jwt = require("salesforce-jwt-bearer-token-flow");

    // create the connection to the org
    let conn = new jsforce.Connection();

    // load the private key for the token
    let privateKey = require('fs').readFileSync('./certificates/server.key', 'utf8');

      iss: 'my_Consumer_Key',
      sub: 'my_username',
      aud: 'https://login.salesforce.com',
      privateKey: privateKey
    }, function(err, response) {
        if (err) {
          console.error('error is: '+JSON.stringify(err));
        } else {
            instanceUrl: response.instance_url,
            accessToken: response.access_token
          console.log('Successfully connected to Org');

    module.exports = conn;     

Under Login History, I see the following line: Failed: Not approved

What am I missing?

  • What is the value for Permitted Users in Policies? – Rahul Gawale Jul 29 '19 at 9:51
  • 1
    @rahulgawale All users may self-authorize – Json Jul 29 '19 at 9:52
  • did you run into any login screen after the first call? – Rahul Gawale Jul 29 '19 at 10:13
  • from my app? no. I run my app with npm start and I see in the console: {"error":"invalid_grant","error_description":"user hasn't approved this consumer"} – Json Jul 29 '19 at 10:48
  • please check if your Consumer key is correct? also try with admin user – Rahul Gawale Jul 29 '19 at 13:23

This was a policy issue related to Permitted Users under the Connected App, once I changed it from 'All users may self-authorize' to 'Admin approved users are pre-authorized' issue was resolved.

  • Hi @Json, i have that setting 'Admin approved users are pre-authorized' but still I ma getting this issue. Any other reasons you think – Deep Singhal Jun 9 '20 at 13:49
  • 1
    @DeepSinghal Enabling "Admin approved users are pre-authorized" will add a related list to the Manage page of the Connected App, for Profiles. Just add the Profile of the user you want to authorize here, and you should be good to go. – TheLeonKing Dec 12 '20 at 1:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.