I am trying to create a 2GP that includes an Aura component which loads a canvas app using force:canvasApp. I have successfully created this aura component in my packaging organisation, by creating a lightning component through the developer console. After this, I could add the component to a page through the page editor. It showed up as custom component, but also showed Page > Visualforce in menu on the right of the page which opens when you drag and drop a component into the page.

I start to run into issues when I recreate the Aura component and add it to a 2GP. I have referenced the connected app through a metadata xml file. After creating the package, creating a package version and installing the package into a scratch org, I can add the component to a Lead Record page. However, as soon as I add it, it shows this error message:

Your browsing session has ended or is invalid. Please re-login to Salesforce.com again.

After inspecting the Chrome devtools, I get a more specific error on the signed request PUT call:

[{"message":"This session is not valid for use with the REST API","errorCode":"INVALID_SESSION_ID"}]

The connected app has the following set of permissions:

Perform requests on your behalf at any time      
Provide access to custom applications        
Access your basic information        
Full access      
Provide access to your data via the Web      
Access and manage your data

The canvas app settings for the connected app include both Visualforce Component and Lightning Component as valid locations. I have compared the connected applications, and they are identical.

I noticed three things in the PUT request:

  • The successful signedrequest call states the display location is Visualforce, while the unsuccessful request states Aura
  • The page editor states in the scratch organisation shows Page > <application name> while the packaging organisation shows Page > Visualforce.
  • The signedrequest in the packaging org does not specify the namespace, even though the Aura component has it on the <force:canvasApp> declaration (services/data/v52.0/platformconnect/signedrequest?canvas=<connectedAppName>). The signedrequest in the scratch does specify the namespace (services/data/v52.0/platformconnect/signedrequest?canvas=<connectedAppName>&namespace=<namespace>).

Could any of the above be related to the issue I am running into? If not, what could be the issue?

Many thanks in advance!

1 Answer 1


After many hours of trial and error, I realized the issue was caused by how I logged into the organisation. Using sfdx force:org:open does not provide the correct context for REST API usage. Instead you need to generate a password for the user account using sfdx force:user:password:generate and login through the lightning login portal.

  • Have you opened a bug with Salesforce? If it becomes a known issue I want to +1 it.
    – tggagne
    Commented Oct 18, 2022 at 12:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .