Our QA sandbox refreshed and now the client app that communicates via a connected app using JWT flow is getting a bearer token and getting a 401. I always thought that once you have a bearer token that it is valid. The client app bearer token shared with me gives a 'Invalid Signature' when I verify on JWT.IO.

Could this be because the client app folks need to update their certificate?

I checked the integration user associated with the client app and they seem to have the right permissions.


When the org is refreshed, connected app will have a new consumer key (aka client_id in oAuth), thus invalidating all previously issued access tokens. You'll need to provide a new client id to all client apps.

A failure to verify a signature on jwt.io is likely a red herring...but you might have another, unrelated issue. Best to create a new question on here for that.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.