I am trying to implement the OAuth 2.0 JWT Bearer Token Flow on my node.js app using these instructions, but I'm unable to authenticate successfully, getting this error:

{"error":"invalid_grant","error_description":"user hasn't approved this consumer"}


1) All users may self-authorize

2) I followed this answer, which states that I need to login first myself.

so I opened the following link using my browser: https://login.salesforce.com/services/oauth2/authorize?response_type=token&client_id=my_client_id&redirect_uri=https://login.salesforce.com/services/oauth2/success

and authenticated, I was then redirected to https://login.salesforce.com/services/oauth2/success and got the following response in the URL: https://login.salesforce.com/services/oauth2/success#access_token=my_access_token&instance_url=https%3A%2F%2Fmyorg.my.salesforce.com&id=https%3A%2F%2Flogin.salesforce.com%2Fid%2F00D1t0000gdfEA2%2F0051t000003gdfGIAAY&issued_at=1564389252266&signature=gdfgdfMa8SYkZu6Rn6K4iY%3D&scope=full&token_type=Bearer

3) OAuth Scopes includes:

Full Access

4) The redirect_uri used in the auth call matchs the callback uri registered for my app

Here's my code to authenticate:

function jwtLogin(){
    const jsforce = require('jsforce');
    const jwt = require("salesforce-jwt-bearer-token-flow");

    // create the connection to the org
    let conn = new jsforce.Connection();

    // load the private key for the token
    let privateKey = require('fs').readFileSync('./certificates/server.key', 'utf8');

      iss: 'my_Consumer_Key',
      sub: 'my_username',
      aud: 'https://login.salesforce.com',
      privateKey: privateKey
    }, function(err, response) {
        if (err) {
          console.error('error is: '+JSON.stringify(err));
        } else {
            instanceUrl: response.instance_url,
            accessToken: response.access_token
          console.log('Successfully connected to Org');

    module.exports = conn;     

Under Login History, I see the following line: Failed: Not approved

What am I missing?

  • What is the value for Permitted Users in Policies? Jul 29, 2019 at 9:51
  • 1
    @rahulgawale All users may self-authorize
    – Json
    Jul 29, 2019 at 9:52
  • did you run into any login screen after the first call? Jul 29, 2019 at 10:13
  • from my app? no. I run my app with npm start and I see in the console: {"error":"invalid_grant","error_description":"user hasn't approved this consumer"}
    – Json
    Jul 29, 2019 at 10:48
  • please check if your Consumer key is correct? also try with admin user Jul 29, 2019 at 13:23

2 Answers 2


This was a policy issue related to Permitted Users under the Connected App, once I changed it from 'All users may self-authorize' to 'Admin approved users are pre-authorized' issue was resolved.

  • Hi @Json, i have that setting 'Admin approved users are pre-authorized' but still I ma getting this issue. Any other reasons you think Jun 9, 2020 at 13:49
  • 3
    @DeepSinghal Enabling "Admin approved users are pre-authorized" will add a related list to the Manage page of the Connected App, for Profiles. Just add the Profile of the user you want to authorize here, and you should be good to go. Dec 12, 2020 at 1:03
  • Also note that if you are using curl and you forget a parameter like -- instanceurl it will throw that error too.
    – Json
    May 3 at 19:32

This answer is complementary to the right answer and comments there as I cannot comment there.

If you happen to find this and you already have the Permitted Users as 'Admin approved users are pre-authorized' You can edit it to 'All users may self-authorize' and then edit it back to 'Admin approved users are pre-authorized' as this would add the correct profiles to the related list described by TheLeonKing in the comments

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.