11

I'm trying to connect to a sandbox using the sfdx cli and the JWT flow through force:auth:jwt:grant. According to this Salesforce DX doc, we can use the same connected app information from Production to connect to our Scratch Org.

Is it something that should work for sandbox too ? I'm getting a "Failed: Not approved" error.

Connected app in sandbox comes from the refresh but has a different consumer key. The Permission set is set correctly on my user.

Is there a way to connect to a recently refreshed sandbox using the JWT flow (without manually changing something like the consumer key) ?

Improve this question

2 Answers 2

Reset to default
5

You can use the Connected App from your production org, but to avoid the user hasn't approved this consumer error, I've found that you need to authenticate using the password and the Connected App's Client Id first. Then you'll be able to authenticate with JWT using the key.

Improve this answer
4
  • Are you using the Production Connected App's Client Id? What command are you using to authenticate?
    – Nicholas
    Commented May 4, 2021 at 13:28
  • Yes, the client id of the Connected App created in prod. Using force cli, I use force login -i test --connected-app-client-id xxx, then force login -i test --connected-app-client-id xxx -u [email protected] -key path/to/app.key
    – xn.
    Commented May 4, 2021 at 15:48
  • I see, this is possible using github.com/ForceCLI/force but its an interactive (browser) session. The first command anyway redirects to an error page. The second, as expected, has the usual ERROR: user hasn't approved this consumer
    – Nicholas
    Commented May 6, 2021 at 9:22
  • You'll need to add localhost:3835/oauth/callback to your Connected App as a callback url for the interactive authentication.
    – xn.
    Commented May 6, 2021 at 16:04
4

I assume you are trying to JWT into a developer sandbox just refreshed or created from production. If so, I had the same exact problem. I was trying to login with the same --clientid and --jwtkeyfile as the Production org and the --username --instanceurl flags pointing to the sandbox admin user and https://test.salesforce.com respectively. This was failing with:

Reason: invalid_grant - user hasn't approved this consumer

I was, however, able to login if I used the new/different consumer key from the sandbox.

Not sure this is going to work for my use case, as I'm trying to use developer sandboxes in a CI setup. Not sure how I'll get at those updated consumer key on the freshly created/refreshed developer sandboxes.

Would still be interested to head if any others have a suggestion.

Edit: After digging around a bit, it appears this is a limitation on Salesforce.

https://success.salesforce.com/ideaView?id=08730000000DiZoAAK

Improve this answer
2
  • I'm having a similar issue. We have just refresh our sandboxes and GitHub can no longer login "user hasn't approved this consumer". I have updated the consumer key to point to the new sandbox. All other details are exactly the same. Any idea how to approve the consumer?
    – jonny-harte
    Commented Jun 21, 2022 at 16:36
  • Any update about it?
    – vt89
    Commented Apr 29 at 14:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .