The credential should successfully authenticate against the Salesforce Sandbox. n8n should either: - Add an optional Custom Domain URL field to the Salesforce JWT credential, used instead of the hardcoded login.salesforce.com / test.salesforce.com for both the JWT aud claim and the token endpoint. - Or auto-detect the My Domain URL from the Salesforce org.

n8n - ✅(Solved) Fix Salesforce JWT credential: test.salesforce.com rejected as JWT audience since Salesforce Spring '26 version [1 pull requests, 3 comments, 4 participants]

n8n2026-04-23 12:57:56

ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

GitHub issue URL

Helpful · Quick feedback

GitHub stats

n8n-io/n8n#28990•Fetched 2026-04-24 06:12:56

View on GitHub

Comments

Participants

Timeline

Reactions

Author

Participants

Timeline (top)

commented ×3subscribed ×2cross-referenced ×1labeled ×1

Error Message

n8n shows:

Bad request - please check your parameters

The actual Salesforce response (obtained by calling the token endpoint directly):

{
  "error": "app_not_found",
  "error_description": "External client app is not installed in this org"
}

Root Cause

The hardcoded URL in the credential source ([reference commit](https://github.com/n8n-io/n8n/commit/6b2d31ca2b40869e1b16982db0a202a7b4e41eba)):

const authUrl =
    credentials.environment === 'sandbox'
    ? 'https://test.salesforce.com'
    : 'https://login.salesforce.com';

Salesforce Spring '26 permanently ended legacy hostname redirections with no option to re-enable ([Salesforce docs](https://help.salesforce.com/s/articleView?id=release-notes.salesforce_release_notes.htm&release=260&type=5), [community summary](https://salesforcetime.com/2025/11/25/end-of-redirections-for-legacy-host-names/)). External Client Apps — which replace the deprecated Connected Apps as of Spring '26 — require the org's My Domain URL as the JWT audience.

Fix Action

Fixed

Fixed by PR: fix(Salesforce Node): Allow overriding JWT audience with My Domain URL (https://github.com/n8n-io/n8n/pull/29016)

PR fix notes

PR #29016: fix(Salesforce Node): Allow overriding JWT audience with My Domain URL

Repository: n8n-io/n8n
Author: jeanibarz
State: open | merged: False
Link: https://github.com/n8n-io/n8n/pull/29016

Description (problem / solution / changelog)

Summary

Salesforce's Spring '26 release ended redirection for legacy hostnames. External Client Apps on affected orgs reject test.salesforce.com and login.salesforce.com as the JWT audience with app_not_found, and the JWT credential had no way to override them.

This PR adds an optional My Domain URL field to the Salesforce JWT credential. When set, it is used as:

the aud claim of the signed JWT,
the token endpoint (/services/oauth2/token), and
the baseURL of the credential's Test request (/services/oauth2/userinfo).

Leaving the field blank keeps the existing environment-based defaults (test.salesforce.com / login.salesforce.com), so no migration is needed for orgs that still accept them.

Both code paths are covered:

The credential's own authenticate() (used for credential tests and generic-request pipelines), via an exported resolveAuthUrl helper in SalesforceJwtApi.credentials.ts.
The Salesforce node's getAccessToken in nodes/Salesforce/GenericFunctions.ts (the real workflow-execution path), via the same shared helper. Without this second change, the Test button would succeed but live workflows on Spring '26 orgs would still fail.

How to test

In a Salesforce sandbox on Spring '26 or later, enable External Client Apps, create a Connected App configured for JWT Bearer, and add the issuer to the org.
In n8n, create a Salesforce JWT API credential with the Connected App's Client ID, the username, and the private key.
Paste the org's My Domain URL (e.g. https://mycompany--uat.sandbox.my.salesforce.com) into the new My Domain URL field.
Click Test — the credential should authenticate. Then run any Salesforce node workflow (e.g. fetch a Lead) — it should succeed.
As a regression check, clear the My Domain URL field and verify that an older sandbox/production org still authenticates against the default URLs.

Verification

Unit tests cover both paths and include an explicit reproducer for issue #28990:

packages/nodes-base/credentials/test/SalesforceJwtApi.credentials.test.ts — 13 tests. The test named signs the JWT with the Spring '26 sandbox My Domain URL as audience (issue #28990) asserts the exact aud: https://acme--sandbox.sandbox.my.salesforce.com shape from the reporter's direct-call matrix.
packages/nodes-base/nodes/Salesforce/__test__/GenericFunctions.test.ts — adds a test that getAccessToken uses the My Domain URL for both the JWT audience and the token endpoint, proving runtime workflows (not just the Test button) are fixed.
Full Salesforce suite: 199/199 tests green locally.

Scope

JWT credential only. SalesforceOAuth2Api has the same hardcoded pattern and may need the same treatment depending on how Spring '26 treats OAuth2 authorization flows — left out of this PR as a separate scope decision so this fix can land quickly for JWT users.

Related Linear tickets, Github issues, and Community forum posts

fixes #28990

Review / Merge checklist

I have seen this code, I have run this code, and I take responsibility for this code.
PR title and summary are descriptive.
Docs updated or follow-up ticket created.
Tests included.
PR Labeled with `Backport to Beta`, `Backport to Stable`, or `Backport to v1` (if urgent).

Changed files

packages/nodes-base/credentials/SalesforceJwtApi.credentials.ts (modified, +22/-5)
packages/nodes-base/credentials/test/SalesforceJwtApi.credentials.test.ts (added, +211/-0)
packages/nodes-base/nodes/Salesforce/GenericFunctions.ts (modified, +3/-4)
packages/nodes-base/nodes/Salesforce/__test__/GenericFunctions.test.ts (modified, +36/-0)

Code Example

Bad request - please check your parameters

---

{
  "error": "app_not_found",
  "error_description": "External client app is not installed in this org"
}

---

const authUrl =
    credentials.environment === 'sandbox'
    ? 'https://test.salesforce.com'
    : 'https://login.salesforce.com';

RAW_BUFFERClick to expand / collapse

Bug Description

The Salesforce JWT credential hardcodes test.salesforce.com as both the JWT aud claim and the token endpoint URL when Environment Type is set to "Sandbox". Since Salesforce Spring '26 enforced the end of legacy hostname redirections (January 2026), External Client Apps no longer accept test.salesforce.com as a valid audience. The My Domain URL must be used instead.

There is no field in the credential to override this URL.

Error message

n8n shows:

Bad request - please check your parameters

The actual Salesforce response (obtained by calling the token endpoint directly):

{
  "error": "app_not_found",
  "error_description": "External client app is not installed in this org"
}

Root cause

The hardcoded URL in the credential source ([reference commit](https://github.com/n8n-io/n8n/commit/6b2d31ca2b40869e1b16982db0a202a7b4e41eba)):

const authUrl =
    credentials.environment === 'sandbox'
    ? 'https://test.salesforce.com'
    : 'https://login.salesforce.com';

Verification

Tested by calling Salesforce's token endpoint directly with a Python script. Identical setup, only the audience/endpoint URL differs:

aud: "https://test.salesforce.com" → FAILS with app_not_found
aud: "https://[company]--[sandbox].sandbox.my.salesforce.com" → SUCCESS, token returned
aud: "https://login.salesforce.com" (production) → SUCCESS (for now)
aud: "https://[company].my.salesforce.com" (production) → SUCCESS

Impact

Affects all n8n users connecting to Salesforce Sandboxes via JWT using External Client Apps.
Salesforce has deprecated Connected Apps; new orgs can no longer create them by default.
Production environments will likely be affected once Salesforce enforces My Domain there as well.

Related issues

#12416 — Salesforce MyDomain OAuth2 bug
#15475 — Sandbox authentication not working
#15864 — Sandbox URL incorrect
#18913 — Unable to log in to Salesforce sandbox

To Reproduce

Create an External Client App in a Salesforce Sandbox (Spring '26) with JWT Bearer Flow enabled.
Upload a self-signed certificate, configure OAuth scopes, pre-authorize a user via Permission Set.
In n8n, create a Salesforce JWT credential with Environment Type = Sandbox.
Enter the Consumer Key, Username, and Private Key.
Click Test.
Result: Bad request - please check your parameters.

Expected behavior

The credential should successfully authenticate against the Salesforce Sandbox. n8n should either:

Add an optional Custom Domain URL field to the Salesforce JWT credential, used instead of the hardcoded login.salesforce.com / test.salesforce.com for both the JWT aud claim and the token endpoint.
Or auto-detect the My Domain URL from the Salesforce org.

Debug Info

Debug info

core

n8nVersion: 2.14.2
platform: docker (self-hosted)
nodeJsVersion: 24.13.1
nodeEnv: production
database: postgres
executionMode: scaling (single-main)
concurrency: -1
license: enterprise (production)
consumerId: 8c680e1a-5743-4a37-a177-29ef874664ae

storage

success: all
error: all
progress: true
manual: true
binaryMode: database

pruning

enabled: true
maxAge: 744 hours
maxCount: 100000 executions

client

userAgent: mozilla/5.0 (windows nt 10.0; win64; x64) applewebkit/537.36 (khtml, like gecko) chrome/147.0.0.0 safari/537.36
isTouchDevice: false

security

secureCookie: false

Generated at: 2026-04-23T12:31:10.843Z

Operating System

Alpine Linux (AWS ECS Fargate)

n8n Version

2.14.2

Node.js Version

24.13.1

Database

SQLite (default)

Execution mode

main (default)

Hosting

self hosted

extent analysis

TL;DR

To fix the issue, update the Salesforce JWT credential to use the My Domain URL instead of the hardcoded test.salesforce.com for Sandbox environments.

Guidance

Identify the My Domain URL for the Salesforce Sandbox org, which should be in the format https://[company]--[sandbox].sandbox.my.salesforce.com.
Update the authUrl in the credential source to use the My Domain URL for Sandbox environments.
Consider adding an optional Custom Domain URL field to the Salesforce JWT credential to allow users to specify their own My Domain URL.
Test the updated credential by calling the Salesforce token endpoint directly with the updated aud claim and token endpoint URL.

Example

const authUrl =
    credentials.environment === 'sandbox'
    ? 'https://[company]--[sandbox].sandbox.my.salesforce.com'
    : 'https://login.salesforce.com';

Replace [company]--[sandbox] with the actual My Domain URL for the Salesforce Sandbox org.

Notes

The fix requires updating the hardcoded URL in the credential source to use the My Domain URL for Sandbox environments. This change should be made to ensure compatibility with Salesforce's External Client Apps and the end of legacy hostname redirections.

Recommendation

Apply the workaround by updating the authUrl in the credential source to use the My Domain URL for Sandbox environments. This will allow n8n users to successfully authenticate against Salesforce Sandboxes using External Client Apps.

Vote matrix · Quick signals

Works

Did the solution work? Tap to confirm.

Easy Fix

Was it a quick fix?

Time Saver

Did it save you time?

Blocking

Was it severely blocking?

Common Issue

Are others likely hitting this too?

Flaky / Intermittent

Is it intermittent?

Verified / Reproducible

Can you reproduce it reliably?

FAQ

Expected behavior

The credential should successfully authenticate against the Salesforce Sandbox. n8n should either:

Add an optional Custom Domain URL field to the Salesforce JWT credential, used instead of the hardcoded login.salesforce.com / test.salesforce.com for both the JWT aud claim and the token endpoint.
Or auto-detect the My Domain URL from the Salesforce org.

#latency issue #model loading #dependency error #configuration error #environment variable

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

n8n - ✅(Solved) Fix Salesforce JWT credential: test.salesforce.com rejected as JWT audience since Salesforce Spring '26 version [1 pull requests, 3 comments, 4 participants]

Recommended Tools

GitHub issue graph ai analysis

Error Message

Root Cause

Fix Action

Fixed

PR fix notes

PR #29016: fix(Salesforce Node): Allow overriding JWT audience with My Domain URL

Description (problem / solution / changelog)

Summary

How to test

Verification

Scope

Related Linear tickets, Github issues, and Community forum posts

Review / Merge checklist

Changed files

Code Example

Bug Description

Bug Description

Error message

Root cause

Verification

Impact

Related issues

To Reproduce

Expected behavior

Debug Info

Debug info

core

storage

pruning

client

security

Operating System

n8n Version

Node.js Version

Database

Execution mode

Hosting

extent analysis

TL;DR

Guidance

Example

Notes

Recommendation

FAQ

Expected behavior

Still need to ship something?

RELATED_DISCOVERY

TRENDING