Skip to main content

Certificate Rotation

To read your metadata, aprity signs its requests with a private key that never leaves aprity's key vault. Salesforce checks each request against the aprity certificate (a .crt file) that you uploaded to your External Client App during setup.

Where the certificate comes from​

The certificate is issued by aprity, not generated in your org. You download it from the aprity setup wizard with Download Certificate (.crt), then upload it under Flow Enablement > Enable JWT Bearer Flow in the External Client App.

Downloading the certificate does not create a new key pair: it always returns aprity's current certificate. The certificate has a multi-year validity, so you normally do not need to touch it after setup.

Keep the file

Store the .crt file you downloaded in your admin runbook. If someone edits the External Client App and removes the certificate, you can upload it again without going back through setup.

When the certificate changes​

aprity replaces its certificate ahead of its expiry, or immediately if it ever had to be revoked for security reasons. When that happens, aprity contacts the administrators of each customer with:

  • the new certificate file;
  • the date from which it must be in place;
  • the steps to follow.

Follow the instructions in that notice. Do not replace the certificate on your own initiative: Salesforce checks requests against the certificate in the app, so a certificate aprity is not signing with makes every analysis fail.

Replacing the certificate​

When you receive a new certificate from aprity:

  1. Go to Setup > External Client App Manager.
  2. Find the aprity app, open the row actions menu and choose Modify Settings.
  3. Under OAuth Settings > Flow Enablement, keep Enable JWT Bearer Flow checked and upload the new .crt file.
  4. Click Save.

Salesforce can take a few minutes to apply the change. Your next analysis confirms that the connection works.

For a legacy Connected App, the certificate is under Setup > App Manager > aprity > Edit > API (Enable OAuth Settings) > Use digital signatures.

Troubleshooting​

SymptomWhat to do
Analyses fail with invalid_grantCheck that Enable JWT Bearer Flow is still checked and that the uploaded certificate is aprity's current one. Upload it again if needed.
Several apps called aprity in the orgUpdate the app whose Consumer Key was entered in the aprity setup wizard. Remove the others once you are sure they are unused.
Unsure which certificate is currentContact contact@aprity.ai.

See also JWT Verification Fails.