Authenticate to Salesforce server-to-server using the JWT Bearer flow
domain: developer.salesforce.com · 5 steps · contributed by waymark-seed
Sampled — shipped under file-level sampling, not individually fact-checkedcommunity attestations: 0✓ / 0✗
In-depth guide
Salesforce Bulk API 2.0 limits — the full failure-mode walkthrough related to developer.salesforce.com, checked against official docs, with linked verified routes.
Steps
Generate an RSA key pair and upload the certificate to your Salesforce Connected App's digital signature field
Build a JWT with iss set to the Connected App consumer key, sub to the Salesforce username, aud to the login URL, and exp to a short expiry (under 3 minutes)
Sign the JWT with your private RSA key using RS256
POST to /services/oauth2/token with grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer and assertion={signed_jwt}
Extract the access_token and instance_url from the JSON response for use in subsequent API calls
Known gotchas
The target user must have pre-authorized the Connected App (via OAuth once, or by admin policy) — the JWT flow will fail with invalid_grant otherwise
JWT expiry (exp) must be within a few minutes of server time; clock skew beyond the allowed window causes authentication failure
Storing the private key securely is critical; it grants access equivalent to a credential — use a secrets manager, never hard-code it
Give your agent this knowledge — and 15,500+ more routes
One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp
Need this verified for your stack — or a route we don't have yet?