Our managed package requires a connected app with JWT flow to be configured by the SF admin.

The admin chooses the “Admin approved users are pre-authorized” option, creates a custom permission set, and selects it for allowed permissions sets in the manage connected app page.

Everything works on the first connection and then it fails on every subsequent attempt with the error:

{"error":"invalid_grant","error_description":"user hasn't approved this consumer"}

despite having correctly assigned permission set to their users.

User Login History

The connected app has the following OAuth Scopes selected:

  • Access and manage your data (API)
  • Perform requests on your behalf at any time (refresh_token, offline_access)

We have double-checked the configuration and confirmed the IP range restrictions settings. It’s worth noting that other customers have not encountered any issues connecting to the app, so this issue seems unique to this particular client (a large enterprise org).

What could be causing this issue?

3 Answers 3


After many meetings with support, they recommended changing IP Relaxation
setting from Enforce IP restrictions to Relax IP restrictions and then back to Enforce IP restrictions in the connected app manage page and the problem disappeared.


There is no need to use refresh_token permission because "The refresh token is never used in the JWT Bearer flow, and does not need to be stored (or updated)." - always you can generate new session id by using JWT, without making negative impact on user experience.

I'm guessing that the critical piece of information is this: "for users with a custom profile, it only works on the first connection, and then it fails" It can be some issue with the refresh_token flow (which normally happens on every connection except the first one, which works).

I would try to remove refresh_token scope to make sure that JWT is always used

  • Thanks for the suggestion, unfortunately still the same error
    – ApexAdam
    Commented Apr 25, 2023 at 10:59
  • We found out that the issue actually is also appearing for the admin profile
    – ApexAdam
    Commented Apr 25, 2023 at 11:48

Sounds to me that it's related to the connected app policies

This is how I've configured a connected app policies based on a documentation from Salesforce and on our case works fine.

  • Permitted Users: Admin Approved users are pre-authorized
  • Single Logout: Single Logout Disabled
  • Refresh Token Policy: Refresh token is valid until revoked
  • Application Permissions: Perform requests at any time

Also, in the policies page you can set the list of profiles that have access to the connected app, make sure the custom profile is listed there.

  • Thank you for the suggestion, we compared the configuration between the org where the issues appears and an org where everything works and the configuration of the connected app are 1:1
    – ApexAdam
    Commented Apr 25, 2023 at 11:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .