I am trying to implement the OAuth 2.0 JWT Bearer Token Flow on my node.js app using these instructions, but I'm unable to authenticate successfully, getting this error:

{"error":"invalid_grant","error_description":"user hasn't approved this consumer"}


1) All users may self-authorize

2) I followed this answer, which states that I need to login first myself.

so I opened the following link using my browser: https://login.salesforce.com/services/oauth2/authorize?response_type=token&client_id=my_client_id&redirect_uri=https://login.salesforce.com/services/oauth2/success

and authenticated, I was then redirected to https://login.salesforce.com/services/oauth2/success and got the following response in the URL: https://login.salesforce.com/services/oauth2/success#access_token=my_access_token&instance_url=https%3A%2F%2Fmyorg.my.salesforce.com&id=https%3A%2F%2Flogin.salesforce.com%2Fid%2F00D1t0000gdfEA2%2F0051t000003gdfGIAAY&issued_at=1564389252266&signature=gdfgdfMa8SYkZu6Rn6K4iY%3D&scope=full&token_type=Bearer

3) OAuth Scopes includes:

Full Access

4) The redirect_uri used in the auth call matchs the callback uri registered for my app

Here's my code to authenticate:

function jwtLogin(){
    const jsforce = require('jsforce');
    const jwt = require("salesforce-jwt-bearer-token-flow");

    // create the connection to the org
    let conn = new jsforce.Connection();

    // load the private key for the token
    let privateKey = require('fs').readFileSync('./certificates/server.key', 'utf8');

      iss: 'my_Consumer_Key',
      sub: 'my_username',
      aud: 'https://login.salesforce.com',
      privateKey: privateKey
    }, function(err, response) {
        if (err) {
          console.error('error is: '+JSON.stringify(err));
        } else {
            instanceUrl: response.instance_url,
            accessToken: response.access_token
          console.log('Successfully connected to Org');

    module.exports = conn;     

Under Login History, I see the following line: Failed: Not approved

What am I missing?

  • What is the value for Permitted Users in Policies? – rahul gawale Jul 29 '19 at 9:51
  • 1
    @rahulgawale All users may self-authorize – Json Jul 29 '19 at 9:52
  • did you run into any login screen after the first call? – rahul gawale Jul 29 '19 at 10:13
  • from my app? no. I run my app with npm start and I see in the console: {"error":"invalid_grant","error_description":"user hasn't approved this consumer"} – Json Jul 29 '19 at 10:48
  • please check if your Consumer key is correct? also try with admin user – rahul gawale Jul 29 '19 at 13:23

This was a policy issue related to Permitted Users under the Connected App, once I changed it from 'All users may self-authorize' to 'Admin approved users are pre-authorized' issue was resolved.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.