I am trying to implement the OAuth 2.0 JWT Bearer Token Flow on my node.js app using these instructions, but I'm unable to authenticate successfully, getting this error:

{"error":"invalid_grant","error_description":"user hasn't approved this consumer"}


1) All users may self-authorize

2) I followed this answer, which states that I need to login first myself.

so I opened the following link using my browser: https://login.salesforce.com/services/oauth2/authorize?response_type=token&client_id=my_client_id&redirect_uri=https://login.salesforce.com/services/oauth2/success

and authenticated, I was then redirected to https://login.salesforce.com/services/oauth2/success and got the following response in the URL: https://login.salesforce.com/services/oauth2/success#access_token=my_access_token&instance_url=https%3A%2F%2Fmyorg.my.salesforce.com&id=https%3A%2F%2Flogin.salesforce.com%2Fid%2F00D1t0000gdfEA2%2F0051t000003gdfGIAAY&issued_at=1564389252266&signature=gdfgdfMa8SYkZu6Rn6K4iY%3D&scope=full&token_type=Bearer

3) OAuth Scopes includes:

Full Access

4) The redirect_uri used in the auth call matchs the callback uri registered for my app

Here's my code to authenticate:

function jwtLogin(){
    const jsforce = require('jsforce');
    const jwt = require("salesforce-jwt-bearer-token-flow");

    // create the connection to the org
    let conn = new jsforce.Connection();

    // load the private key for the token
    let privateKey = require('fs').readFileSync('./certificates/server.key', 'utf8');

      iss: 'my_Consumer_Key',
      sub: 'my_username',
      aud: 'https://login.salesforce.com',
      privateKey: privateKey
    }, function(err, response) {
        if (err) {
          console.error('error is: '+JSON.stringify(err));
        } else {
            instanceUrl: response.instance_url,
            accessToken: response.access_token
          console.log('Successfully connected to Org');

    module.exports = conn;     

Under Login History, I see the following line: Failed: Not approved

What am I missing?

  • What is the value for Permitted Users in Policies? Commented Jul 29, 2019 at 9:51
  • 1
    @rahulgawale All users may self-authorize
    – Json
    Commented Jul 29, 2019 at 9:52
  • did you run into any login screen after the first call? Commented Jul 29, 2019 at 10:13
  • from my app? no. I run my app with npm start and I see in the console: {"error":"invalid_grant","error_description":"user hasn't approved this consumer"}
    – Json
    Commented Jul 29, 2019 at 10:48
  • please check if your Consumer key is correct? also try with admin user Commented Jul 29, 2019 at 13:23

2 Answers 2


This was a policy issue related to Permitted Users under the Connected App, once I changed it from 'All users may self-authorize' to 'Admin approved users are pre-authorized' issue was resolved.

  • Hi @Json, i have that setting 'Admin approved users are pre-authorized' but still I ma getting this issue. Any other reasons you think Commented Jun 9, 2020 at 13:49
  • 4
    @DeepSinghal Enabling "Admin approved users are pre-authorized" will add a related list to the Manage page of the Connected App, for Profiles. Just add the Profile of the user you want to authorize here, and you should be good to go. Commented Dec 12, 2020 at 1:03
  • 2
    Also note that if you are using curl and you forget a parameter like -- instanceurl it will throw that error too.
    – Json
    Commented May 3, 2022 at 19:32

This answer is complementary to the right answer but I cannot comment there.

If you happen to find this and you already have the Permitted Users as 'Admin approved users are pre-authorized' You can edit it to 'All users may self-authorize' and then edit it back to 'Admin approved users are pre-authorized' as this would add the correct profiles to the related list described by TheLeonKing in the comments

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .