I've followed the docs here to create a cert and configured the following;
- OAuth scopes:
- Permitted users:
Admin approved users are pre-authorized
- Profiles: All (even though I suspect
System Administratorshould be enough)
I can successfully authenticate to the DevHub with
force:auth:jwt:grant, but cannot authorize an associated Scratch Org. I run the following command;
sfdx force:auth:jwt:grant \ --clientid 3MVG97quAmFZJfVz.WJ55DLNvbWWJlZL.ag6Zr_Xp4u5TXmwoRKSdXVzB.KrzU1oXwQIkjCxczxHWcQpWBotZ \ --jwtkeyfile /keys/server.key \ --setalias scratchorg \ --username firstname.lastname@example.org \ --instanceurl https://test.salesforce.com
But receive the following error;
ERROR running force:auth:jwt:grant: This org appears to have a problem with its OAuth configuration. Reason: invalid_grant - user hasn't approved this consumer username: email@example.com, clientId: 3MVG97quAmFZJfVz.WJ55DLNvbWWJlZL.ag6Zr_Xp4u5TXmwoRKSdXVzB.KrzU1oXwQIkjCxczxHWcQpWBotZ, loginUrl: <Not Specified>, privateKey: /keys/server.key Try this: Verify the OAuth configuration for this org. For JWT: Ensure the private key is correct and the cert associated with the connected app has not expired. Ensure the following OAuth scopes are configured [api, refresh_token, offline_access]. Ensure the username is assigned to a profile or perm set associated with the connected app. Ensure the connected app is configured to pre-authorize admins.
- Similar question #1 - solved by waiting, but my scratch org has been up for 24 hours.
- Similar question #2 - the following values for
instanceurldo not solve this; login, test, community
- Blog post #1 - same as the official docs, still throws error
- Blog post #2 - Step 3 Option 1 mentions setting
Admin approved users are pre-authorizedand enabling profiles, I've already done this
- Similar question #3 - suggests the application needs to be authorized, which I'm guessing it is already, per Blog post #2 above.
How can I authorize my scratch org using JWT?