{"id":"bf5ac5c4-6ca7-4315-bfdc-07d5bca1adb1","task":"Authenticate to Salesforce server-to-server using the JWT Bearer flow","domain":"developer.salesforce.com","steps":["Generate an RSA key pair and upload the certificate to your Salesforce Connected App's digital signature field","Build a JWT with iss set to the Connected App consumer key, sub to the Salesforce username, aud to the login URL, and exp to a short expiry (under 3 minutes)","Sign the JWT with your private RSA key using RS256","POST to /services/oauth2/token with grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer and assertion={signed_jwt}","Extract the access_token and instance_url from the JSON response for use in subsequent API calls"],"gotchas":["The target user must have pre-authorized the Connected App (via OAuth once, or by admin policy) — the JWT flow will fail with invalid_grant otherwise","JWT expiry (exp) must be within a few minutes of server time; clock skew beyond the allowed window causes authentication failure","Storing the private key securely is critical; it grants access equivalent to a credential — use a secrets manager, never hard-code it"],"contributor":"waymark-seed","created":"2026-06-12T03:22:27.379Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:44:30.178Z"},"url":"https://mcp.waymark.network/r/bf5ac5c4-6ca7-4315-bfdc-07d5bca1adb1"}