Our QA sandbox refreshed and now the client app that communicates via a connected app using JWT flow is getting a bearer token and getting a 401. I always thought that once you have a bearer token that it is valid. The client app bearer token shared with me gives a 'Invalid Signature' when I verify on JWT.IO.

Could this be because the client app folks need to update their certificate?

I checked the integration user associated with the client app and they seem to have the right permissions.

1 Answer 1


When the org is refreshed, connected app will have a new consumer key (aka client_id in oAuth), thus invalidating all previously issued access tokens. You'll need to provide a new client id to all client apps.

A failure to verify a signature on jwt.io is likely a red herring...but you might have another, unrelated issue. Best to create a new question on here for that.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .