For an OAuth 2.0 process, do you need multiple connected apps for each instanceUrl?

Question

I am building an integration from my platform whereby you can export data to your Salesforce instance, having authenticated via OAuth 2.0.

I'm experiencing the below when attempting to get an access token in the OAuth 2.0 process:

{
    "error": "invalid_grant",
    "error_description": "authentication failure"
}

This is the endpoint and structure I'm using, the client_id and client_secret are both set in the body:

https://test.salesforce.com/services/oauth2/token?grant_type=authorization_code&code=somerandomcode&redirect_uri=https://my-callback-url.com

This is not occurring in my local development environment. Only in a production environment. And only when attempting to authenticate into a Salesforce Sandbox environment.

Have I missed something here - do I need to create a connected app in the setup of every Salesforce instance? Or can any users just authenticate through and reuse the same connected application?

i.e if I have a Sandbox with an instanceUrl of https://cs1.salesforce.com, which I'd like to export data to, and I have a connected app hosted at https://um3.salesforce.com, will this cause the above error?

Could this be something to do with secure cookies where https are enforced in production but not locally? I'm at a lost here.

Any help is much appreciated.

Answer 1

Your connected app needs to be present in each org that you want to authenticate in, but you don't need to go and re-create the connected app manually (which would give you a different consumer key and client secret each time).

Instead, you can "install" the connected app from one org into other orgs (which ensures the consumer key/client secret stays the same).

I'm not having much luck in finding decent documentation for this, but from personal experience with the JWT Bearer flow, that process goes something like this:

1. Attempt to authorize in your target org with your existing custom app
2. Get denied
3. Log in to your target org
4. Go to "Connected Apps OAuth Usage"
   • Setup -> "Administer" header -> Manage Apps -> Connected Apps OAuth Usage in classic
   • Setup -> "Platform Tools" header -> Apps -> Connected Apps -> Connected Apps OAuth Usage in lex
5. Find the name of your connected app
6. Click the "Install" button
   • If it has already been installed, you'll see an "Uninstall" button (which you wouldn't want to click)