I have created a scratch org and installed a connected app to it. I've set the policy to "Admin Approved users are pre-authorized". I've given the connected app access to a permission set and assigned an integration user to that permission set.

However, when I try to get the access token, it gives me the error: "user hasn't approved this consumer" with "invalid_grant".

The weird thing is that the login history for the integration user doesn't have any failed attempts. I believe it should at least show a failed attempt on the login history.

When I installed the connected app to a developer edition org that's on login.salesforce.com, it worked fine.

  • Can you share the api call you are making? With credentials x'd out. Commented Aug 24, 2023 at 21:11

1 Answer 1


I don't believe this is an issue specific to scratch orgs; I believe it's specific to the JWT flow. With the JWT flow, you need to first go through a different OAuth 2.0 flow (one that can give you a refresh token) like the web-server flow.

From the OAuth 2.0 JWT Bearer documentation, near the bottom (emphasis mine)

The OAuth 2.0 JWT bearer and SAML assertion bearer flow requests look at all previous approvals for the user that include a refresh token. If Salesforce finds matching approvals, it combines the values of the approved scopes. Salesforce then issues an access token. If Salesforce doesn’t find previous approvals that included a refresh token or any available approved scopes, the request fails as unauthorized.

Earlier in that page, it suggests that a profile/permission set is sufficient when you're using Admin approved users are pre-authorized but I have not found this to be the case in practice1. So far, I've only had success with the JWT flow by going through that other flow first.

Further reading suggests that toggling the IP Relaxation setting back and forth may work. There's also another official documentation page that suggests that you might need to assign the connected app (for a permission set) or modify the "connected app access" section (for a profile). I'll have to investigate this a bit more tomorrow.

1: After spending some more time with this, it was just the process of getting the connected app installed that made me think this.

After getting the connected app into your target org, and setting up "admin approved users are pre-authorized", the JWT flow should work with any user with a pre-approved profile or permission set

  • I've tried toggling the IP Relaxation and also doing the other flow first. The same error still occurs. I'm able to see that the user got access via the connected app on the user's page.
    – Kiet T
    Commented Aug 29, 2023 at 19:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .