I've created a connected app based on this Trailhead project. Note that this isn't about a trailhead project I'm using what I've learned from Trailhead in a real-world project to implement CI/CD for our Full org. I have authorized my connected app by creating a permission set and adding the user to the assignees and also adding my connected app to the connected apps in the permission sets, but still unable to run the following with success. It all works fine in the prod org but not in my full org. I'm using the following command:

force:auth:jwt:grant --clientid XXXXX --jwtkeyfile server.key --setdefaultdevhubusername -u <Username> -r https://<company name>--full.my.salesforce.com 

and getting this error

ERROR running auth:jwt:grant:  We encountered a JSON web token error, which is likely not an issue with Salesforce CLI. Here's the error: Error authenticating with JWT config due to: audience is invalid

Please help me find out what I'm doing wrong? Thanks!!

1 Answer 1


I'm not set up to test the scenario you've laid out precisely, but I was able to repoduce the error using what I imagine is equivalent code in the developer console. Looks like the -r/--instanceurl flag maps to the aud (audience) parameter for the JWT.

Instead of trying to use the domain for a specific instance (which doesn't work in my testing), you should simply specify either https://login.salesforce.com or https://test.salesforce.com depending on whether you're trying to authenticate with a production or sandbox org (respectively).

Salesforce uses the username (the sub parameter in the JWT payload) to determine which org to authenticate against.

The help for that sfdx command helps confirms this (for sandboxes at least)

To specify a My Domain URL, use the format MyDomainName.my.salesforce.com (not MyDomainName.lightning.force.com). To specify a sandbox, set --instanceurl to https://test.salesforce.com.

  • Thanks for helping. So it doesn't matter that my Full org has a specific URL like I've mentioned in my question, I can use test.salesforce.com since it's a sandbox org and it should work based on the username I provide? just trying to make sure I understood you correctly.
    – Bahman.A
    Mar 23, 2021 at 17:19
  • 1
    @Bahman.A Yes, that's correct (and what looking through the output of sfdx help force:auth:jwt:grant indicates).
    – Derek F
    Mar 23, 2021 at 17:20
  • "To specify a My Domain URL, use the format MyDomainName.my.salesforce.com", I'm using this suggested url "https://<company name>--full.my.salesforce.com". I'm still having trouble understanding the difference between the URL I'm using for my full org vs using "test.salesforce.com."
    – Bahman.A
    Mar 23, 2021 at 17:21
  • 1
    @Bahman.A The --full means you're working with a full copy sandbox called "full", does it not?
    – Derek F
    Mar 23, 2021 at 17:23
  • Thanks so much Derek!! I now understand it completely. Much appreciate your help. Cheers🍻
    – Bahman.A
    Mar 23, 2021 at 17:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .