I have setup a connected app and want to use the OAuth JWT. Based on my understanding of the salesforce documentation only preauthorized client can use this flow to get an access token.

I have enabled "admin approved users are pre-authorized" setting in my connected and enabled certain profiles under this. the certificate and other settings required for this flow has been set up as well.

I still get the following error while trying to get an access token using the JWT token.

{ error_description: "user hasn't approved this consumer" error: "invalid_grant" }

the grant_type is set to "urn:ietf:params:oauth:grant-type:jwt-bearer" and assertion: "base64url-encoded JWT token"

Appreciate any help to get this working!

  • 1
    Welcome to StackOverflow! Please upvote all useful answers, including those to others' questions. AND please "check" the best answer to your own questions. Thank You!
    – Larry K
    Mar 13 '17 at 19:55

Based from the salesforce documentation:

The authorization server validates the JWT and issues an access_token based upon prior approval of the application.

It means you have to authorize the application at least once.


You don't need to work on the redirectUri.

  • 1
    The client_id is the Salesforce Consumer Key for your app. The redirect_uri is the callback url from your app's OAuth settings within Salesforce. The redirect_uri used in the auth call must match a callback uri registered for your app but the uri does NOT have to work or do anything. Eg use foo.com in both places.
    – Larry K
    Mar 13 '17 at 19:52
  • Of course, use https://test.salesforce.com/... if you're in the test region.
    – Glen Mazza
    Jun 21 '17 at 22:44

"user hasn't approved this consumer" This is a common error caused when the user doesn't have a prior refresh_token associated with him/her.

The solution is to perform an Autorization grant (Web Server flow or User-Agent Flow) at least once.

I wrote in detail about it; look specifically at step #3 here - https://mannharleen.github.io/2020-03-03-salesforce-jwt/

That should solve the error.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.