Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Hot answers tagged

39 votes
Accepted

Authentication using JWT

In the JWT Bearer OAuth flow, the connected app is identified by the connected app's consumer key (provided in the "iss" parameter of the JWT claims). Pre-authorizing users has very little to do with ...
user avatar
  • 47k
16 votes

Salesforce JWT User Hasn't Approved This Consumer (Again)

From the Salesforce OAuth JWT Flow documentation (hidden): A JWT OAuth 2.0 bearer assertion request looks at all the previous approvals for the user that include a refresh_token. If matching ...
user avatar
  • 481
16 votes
Accepted

Named Credentials - What is the difference between JWT & JWT Token Exchange

JWT Token: SF will issue the token for you. When your code uses the named credential to call your 3rd party service, SF will send the newly issued JWT token to your 3rd party service as a bearer token ...
user avatar
  • 6,150
9 votes

Salesforce JWT User Hasn't Approved This Consumer (Again)

For either the sub or prn value, make sure you are using a username that exists in that org. For the aud make sure you are using test.salesforce.com for a sandbox environment and login.salesforce.com ...
user avatar
  • 343
8 votes

SalesforceDX: Log in to sandbox by username/password from command line without browser involved

sfdx force:auth only provides the JWT and web OAuth login methods: sfdx force:auth commands: (get help with sfdx help force:auth:COMMAND) force:auth:jwt:grant authorize an org using the JWT ...
user avatar
  • 86.2k
7 votes

This org appears to have a problem with its OAuth configuration. Reason: invalid_grant - audience is invalid

Run the following command first export SFDX_AUDIENCE_URL=https://test.salesforce.com Then run sfdx force:auth:jwt:grant --clientid <myclientid> --jwtkeyfile server.key --instanceurl https://...
user avatar
6 votes

Setting Up JWT oAuth Flow

just as an FYI: you could have avoided the manual login if you had set the policy settings to: Permitted Users: Admin approved users are pre-authorized and then assigned the Connected App to the ...
user avatar
6 votes
Accepted

JWT Bearer Token flow for Community: Invalid Token

I ended up finding what was causing the error. In the doc that I mentioned in my question they were suggesting the use of https://community.force.com/customers as the token endpoint. But in Configure ...
user avatar
  • 143
6 votes
Accepted

Error authenticating with JWT config due to: audience is invalid

I'm not set up to test the scenario you've laid out precisely, but I was able to repoduce the error using what I imagine is equivalent code in the developer console. Looks like the -r/--instanceurl ...
user avatar
  • 47k
5 votes

Salesforce JWT User Hasn't Approved This Consumer (Again)

"user hasn't approved this consumer" This is a common error caused when the user doesn't have a prior refresh_token associated with him/her. The solution is to perform an Autorization grant (Web ...
user avatar
  • 627
5 votes

Can I connect to a sandbox using JWT Flow and Prod connect app?

You can use the Connected App from your production org, but to avoid the user hasn't approved this consumer error, I've found that you need to authenticate using the password and the Connected App's ...
user avatar
  • 2,318
5 votes
Accepted

Server to Server JWT Authentication Certificate management

The JWT Authentication Flow can be initiaded using the usual OAuth2 Authorization Flow. Setup: Setup the App, get the required client_key and client_secret Build > Create > Apps Create a new Keypair ...
user avatar
  • 161
5 votes

JWT bearer token flow in web app

If you plan to implement an integration that requires the user to login regulary, then you can just use OAuth2 flow and invoke it whenever the user interacts with your app. However, if you intend to ...
user avatar
5 votes
Accepted

How do I install and preauthorize app so I can use the JWT Bearer token flow?

There are much more detailed instructions on setting up JWT authentication in the Salesforce DX Developer Guide, because JWT is often used for CI and other headless authentication use cases. While the ...
user avatar
  • 86.2k
4 votes
Accepted

JWT bearer token flow in web app

tl;dr: Using the JWT Bearer flow is highly unlikely to save you any trouble. Just bite the bullet and implement controls to use the refresh token flow. full version: The more I think about this, the ...
user avatar
  • 47k
4 votes

Can I connect to a sandbox using JWT Flow and Prod connect app?

I assume you are trying to JWT into a developer sandbox just refreshed or created from production. If so, I had the same exact problem. I was trying to login with the same --clientid and --jwtkeyfile ...
user avatar
  • 321
4 votes
Accepted

sfdx force:auth:jwt:grant ignoring the instanceurl param

I finally managed to solve this myself, but I still believe there is a small bug in SFDX CLI that steered me off my course when debugging this. The root cause turned out to be an incorrect system ...
user avatar
4 votes
Accepted

Unusual OAuth JWT Bearer Token Flow (Outbound) Integration Pattern

According to the specs you've provided, it makes sense that you cannot use Named Credentials or any of the standard ways of doing this. I assume the responses aren't standard either, so it makes it ...
user avatar
4 votes
Accepted

Journey Builder customAcvitity JWT decoded, no organization id

The solution we managed to get the fuel refresh token on the frontend with postmonger (https://salesforce.stackexchange.com/a/185155/61173) Then we used the response from the API (we used https://www....
user avatar
4 votes

JWT authentication without a username?

I really wouldn't call it a hitch. It's good security practices. In order to authenticate into the org, you need a subject who exists in that org and the URL for the org (My Domain in most cases). ...
user avatar
  • 22.3k
4 votes
Accepted

JWT Token always expires after 'exp' provided in the claims

RFC7523, which defines JWT authentication, specifies in section 3.4 that The authorization server MUST reject any JWT with an expiration time that has passed, subject to allowable clock skew ...
user avatar
  • 86.2k
4 votes
Accepted

Salesforce OAuth 2.0 JWT Bearer Token Flow - Token Expiration

The length of time that your access token is valid is determined by the session timeout value in the Connected App's policies. By default, I believe that this timeout is not set, in which case the ...
user avatar
  • 47k
4 votes
Accepted

Using JWT when calling out from Salesforce to third party API

A Named Credential can issue a specific type of JWT out of the box (see this answer for more details on how it works) HttpRequest req = new HttpRequest(); req.setEndpoint('callout:MyJWT/some_path'); ...
user avatar
  • 6,150
4 votes
Accepted

Salesforce CI/CD, from Change Set to SFDX with GitLab

The best place to start is Trailhead. Here are some cool stuff on it which can explore:- Build an Automated CI/CD Pipeline with GitLab Continuous Integration Using Salesforce DX GitLab + Salesforce: ...
user avatar
  • 12.6k
3 votes
Accepted

How to determine the correct 'audience' and 'uri' when using OAuth 2.0 JSON Web Token (JWT) Bearer Token Flow

You only need audience for the oauth 2.0 JWT bearer token flow and for the salesforce sandbox the value is always https://test.salesforce.com . You don't need uri for this flow .The below document ...
user avatar
3 votes
Accepted

SalesforceDX: Log in to sandbox by username/password from command line without browser involved

You could use the auth command from the sfpowerkit plugin: sfpowerkit auth:login https://github.com/Accenture/sfpowerkit It supports login with username-password combination (probably will need ...
user avatar
3 votes

JWT verify signature

As of now the Apex Crypto Class doesn't support the verify method. https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_classes_restful_crypto.htm And most of the examples ...
user avatar
3 votes
Accepted

Setting Up JWT oAuth Flow

Turns out I just needed to authorize the client app for my user by logging in with the standard web oauth flow once first.
user avatar
  • 9,446
3 votes

JWT Bearer flow vs. Username+Password flow in server-to-server integration

I think it is similar to why passwords in db are not stored in straight way, but hashed values are stored. In case, when someone not allowed will get access to it - he will not be able to operate with ...
user avatar
3 votes
Accepted

OAuth 2.0 JWT Bearer Token Flow - "error":"unsupported_grant_type"

Root cause: you need to explicitly set the Content-Type: headers = { 'Content-Type': 'application/x-www-form-urlencoded' } r = requests.post("https://login.salesforce.com/...
user avatar
  • 6,150

Only top scored, non community-wiki answers of a minimum length are eligible