New answers tagged


JWT is encoded using base64 url-safe scheme so you must decode the signature appropriately when you convert it into bytes, straight base64 decoding won't do. URL-safe base64 encoding is defined in JWS spec (RFC 7515): Base64 encoding using the URL- and filename-safe character set defined in Section 5 of RFC 4648 [RFC4648], with all trailing '=' ...


Simon, Can you follow this code block and double check your results. I just copied the data provided by by default. So replace with your data where needed and let us know your results String algorithmName = 'RSA-SHA256'; String privateKey = 'MIIEogIBAAKCAQEAnzyis1ZjfNB0bBgKFMSvvkTtwlvBsaJq7S5wA+kzeVOVpVWwkWdVha4s38XM/pa/yr47av7+...


It looks like the JWT is issued by your target service @ when you send in username/password. JWT feature of Named Credential is to have Salesforce issue JWT, a different use case. The token is signed by a private key so the issuer of the token (Salesforce vs your service) makes a difference, you can't mix and match them.


You're mixing up two flavors of the authorization available in MC - the so-called "legacy" flow which relied on JWT and the newer oAuth-based flows which do not rely on JWT. (The core SF platform underneath Sales Cloud et al does support auth flows with tokens encoded as JWTs). The legacy flow has been retired as of August 1, 2019. /v2/authorize is part of a ...


The answer was the audience oauth parameter for community users must be community url, instead of on sandbox. According to docs: The audience (aud) identifies the authorization server as an intended audience. Use the authorization server’s URL for the audience value:,, or https://...


I'm not 100% sure that you can do this from within the same org that you're trying to auth with (I'm only about 98% confident that it does work), but you can use an anonymous apex window to test this. You can use Apex to construct everything you need, but the simpler approach is to use some of the classes in the Auth namespace (Auth.JWT, Auth.JWS, and Auth....


To create the JWT assertion, you can use a tool such as You'll need your private key. Since is a 3rd party, only use it for testing in a non-production environment. The public/private key should be deactivated (deleted/rotated/etc) when you're done with your test. Grab the JWT header and payload from examples in SF doc Replace the values of ...


I have put invalid digital signature certificate in my connected app. This is cause for this error. This code is working good.


It can't find your jwtapp keypair. Auth.JWS jws = new Auth.JWS(jwt, 'jwtapp') Confirmed that this is the root cause by running your code with a valid keypair.

Top 50 recent answers are included