I have an OAuth JWT Bearer token flow set up like this:

  • Admin approved users are pre-authorized
  • all profiles added to approved list
  • Relax IP restrictions
  • api, refresh_token/offline_access oauth scopes defined

It works fine for System Administrator, but fails randomly for Customer Community Login license user with: invalid_grant "user hasn't approved this consumer". Then it works, and after 5 minutes fails again.

It doesn't seem like I hit the login limit (from Setup -> Company Information related list: Customer Community Logins: Allowance 10,000 Amount Used :4,661 5/16/2019 7:59 PM)

There are a few similar questions out there but I still could not find the answer.

1 Answer 1


The answer was the audience oauth parameter for community users must be community url, instead of test.salesforce.com on sandbox. According to docs:

The audience (aud) identifies the authorization server as an intended audience. Use the authorization server’s URL for the audience value: https://login.salesforce.com, https://test.salesforce.com, or https://community.force.com/customers if implementing for a community.

It was a bit misleading because using test.salesforce.com failed only sometimes.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.