Skip to main content

JWT Verification Fails

aprity reads your org's metadata as an integration user, with the Salesforce JWT Bearer flow. You set this up in the aprity Setup Wizard: you create an External Client App with the aprity certificate, paste its Consumer Key, then enter the integration user's username and click Configure & Verify.

If the check fails, the wizard shows one of these messages:

  • "Verification failed. Please check credentials and retry."
  • "Verification failed. Please provide a custom MyDomain URL and retry."

Salesforce does not say which setting is wrong. Check the causes below in this order.

note

Salesforce now creates External Client Apps instead of Connected Apps. The aprity setup wizard uses an External Client App. The same app also serves the aprity web portal sign-in and AI clients (MCP).

1. The integration user's profile is not pre-authorized​

This is the most common cause.

  1. Find the integration user's actual profile: Setup > Users, find the username you entered, and read the Profile column. It is often a custom profile, not System Administrator.
  2. Open Setup > External Client App Manager, find aprity, open the row actions menu at the far right, and select Modify Policies.
  3. Expand OAuth Policies. Under Plugin Policies, check that Permitted Users is Admin approved users are pre-authorized.
  4. Under App Policies, check that the profile from step 1 is in Selected Profiles.

The Select Profiles picker only appears once Permitted Users is set to Admin approved users are pre-authorized.

Check that the save worked

After you save, open Modify Policies again and confirm the profile is still in Selected Profiles.

Grant access with profiles here, not with the aprity permission sets: managed-package permission sets can be rejected when you save the policy.

2. The integration user lacks the aprity Admin permission set​

The integration user needs the aprity Admin permission set (Setup > Permission Sets > aprity Admin > Manage Assignments). The profile allows the JWT sign-in; the permission set gives access to the aprity objects and Apex classes.

3. The certificate is missing or wrong​

  1. In the External Client App, under Flow Enablement, check that Enable JWT Bearer Flow is checked.
  2. Check that the uploaded certificate is the .crt file downloaded from the wizard (Download Certificate (.crt)) for this org.

If in doubt, download the certificate again from the wizard and upload it again.

4. The Consumer Key is wrong​

In the wizard step Enter Consumer Key, paste the Consumer Key of the aprity External Client App: open the app, go to the Settings tab, expand OAuth Settings, and click Consumer Key and Secret. Copy the key only. aprity never uses the Consumer Secret.

If you have several External Client Apps, make sure you copy the key of the one that holds the aprity certificate.

5. The username is wrong​

Enter the full Salesforce username of the integration user, as shown in Setup > Users. Sandbox usernames usually end with the sandbox name, for example admin@company.com.uat.

6. "Please provide a custom MyDomain URL"​

The wizard detects your login URL automatically from your org's My Domain. If detection fails, it shows Custom MyDomain URL Required. Enter your My Domain login URL (for example https://yourcompany.my.salesforce.com, or the sandbox My Domain URL) and click Retry Verification.

The URL must use HTTPS and have no path, query or credentials.

7. Recent changes have not reached Salesforce yet​

Changes to an External Client App can take several minutes to apply. If you just changed a setting, wait a few minutes and retry.

Still failing?​

Contact aprity support with:

  • The exact message from the wizard.
  • Your Salesforce Org ID (Setup > Company Information).
  • Whether the org is a production org or a sandbox.
  • The integration user's profile name.

Do not send the Consumer Secret, passwords or the certificate private key.