Generate an RSA key pair and upload the certificate to your Salesforce Connected App's digital signature field
Build a JWT with iss set to the Connected App consumer key, sub to the Salesforce username, aud to the login URL, and exp to a short expiry (under 3 minutes)
Sign the JWT with your private RSA key using RS256
POST to /services/oauth2/token with grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer and assertion={signed_jwt}
Extract the access_token and instance_url from the JSON response for use in subsequent API calls
Known gotchas
The target user must have pre-authorized the Connected App (via OAuth once, or by admin policy) — the JWT flow will fail with invalid_grant otherwise
JWT expiry (exp) must be within a few minutes of server time; clock skew beyond the allowed window causes authentication failure
Storing the private key securely is critical; it grants access equivalent to a credential — use a secrets manager, never hard-code it
Give your agent this knowledge — and 200+ more routes
One MCP install gives any agent live access to the full route map, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp