JWT Login failing for a Newly Created Sandbox [New Connected App Option is disabled in this]

[gitmevg]

Summary

We are not able to Authenticate a CLI to Connect to a Sandbox using JWT, the issue is happening when we try to Connect Jenkins to a Sandbox. When we try to replicate the same Sandbox from Local, we are able to replicate the issue

Steps To Reproduce

-> Create Self Signed Certificates with Documentation as under Link
-> Create an External Client App
-> Try Connecting using below Command:
sf org login jwt --client-id --jwt-key-file /path_to_file/server.key --username <Org_Username_With_SysAdmin> --alias <Org_Alias> -r https://test.salesforce.com

Expected result

We should be able to Connect to the Org with the Successfully Connected Message

Actual result

There is an Intermittent Issue, where we randomly get any of below

1. Org Gets Successfully Connected
2. Command Execution fails with following:
   Error (JwtGrantError): We encountered a JSON web token error, which is likely not an issue with Salesforce CLI. Here’s the error: JwtAuthError::Error authenticating with JWT.
   Errors encountered:
   External client app is not installed in this org
   External client app is not installed in this org
   audience is invalid [audience=https://login.salesforce.com login=https://test.salesforce.com/]
   For above we have checked, In sfdx-projects.json, we have test.salesforce.com
3. Fails without Audience Error:
   Error (JwtGrantError): We encountered a JSON web token error, which is likely not an issue with Salesforce CLI. Here’s the error: JwtAuthError::Error authenticating with JWT.
   Errors encountered:
   External client app is not installed in this org
   External client app is not installed in this org
   External client app is not installed in this org

Additional information

System Information

{
"architecture": "win32-x64",
"cliVersion": "@salesforce/cli/2.117.7",
"nodeVersion": "node-v22.16.0",
"osVersion": "Windows_NT 10.0.26100",
"rootPath": "C:\Users\vgulati\AppData\Roaming\npm\node_modules\@salesforce\cli",
"shell": "C:\custom\apps\Git\usr\bin\bash.exe",
"pluginVersions": [
"@copado/copado-cli 3.7.0 (user) published 194 days ago (Wed Jul 02 2025) (latest is 3.8.0)",
"@jterrats/profiler 2.0.5 (user) published 48 days ago (Wed Nov 26 2025) (latest is 3.0.0)",
"@oclif/plugin-autocomplete 3.2.39 (core)",
"@oclif/plugin-commands 4.1.38 (core)",
"@oclif/plugin-help 6.2.36 (core)",
"@oclif/plugin-not-found 3.2.73 (core)",
"@oclif/plugin-plugins 5.4.54 (core)",
"@oclif/plugin-search 1.2.36 (core)",
"@oclif/plugin-update 4.7.16 (core)",
"@oclif/plugin-version 2.2.36 (core)",
"@oclif/plugin-warn-if-update-available 3.1.53 (core)",
"@oclif/plugin-which 3.2.42 (core)",
"@salesforce/cli 2.117.7 (core)",
"agent 1.26.0 (core)",
"apex 3.9.5 (core)",
"api 1.3.6 (core)",
"auth 3.9.26 (core)",
"code-analyzer 5.4.0 (user) published 139 days ago (Tue Aug 26 2025) (latest is 5.8.0)",
"data 4.0.66 (core)",
"deploy-retrieve 3.24.5 (core)",
"info 3.4.100 (core)",
"limits 3.3.74 (core)",
"marketplace 1.3.8 (core)",
"org 5.9.53 (core)",
"packaging 2.13.6 (user) published 233 days ago (Sat May 24 2025) (latest is 2.24.5)",
"schema 3.3.90 (core)",
"settings 2.4.54 (core)",
"sobject 1.4.81 (core)",
"telemetry 3.6.71 (core)",
"templates 56.4.0 (core)",
"trust 3.7.113 (core)",
"user 3.6.44 (core)",
"sfdmu 4.38.0 (user) published 379 days ago (Sun Dec 29 2024)",
"sfdx-git-delta 6.12.0 (user) published 227 days ago (Fri May 30 2025) (latest is 6.25.0)",
"sfdx-hardis 5.38.0 (user) published 230 days ago (Tue May 27 2025) (latest is 6.21.1)",
"sfdx-mohanc-plugins 0.0.364 (user) published 679 days ago (Mon Mar 04 2024)",
"sfdx-plugin-source-read 1.5.6 (user) published 120 days ago (Sun Sep 14 2025)",
"sfpowerkit 6.1.2 (link) C:\projects\vscode\sfpowerkit",
"texei-sfdx-plugin 2.8.3 (user) published 308 days ago (Mon Mar 10 2025) (latest is 2.8.5)"
]
}

PASTE_VERSION_OUTPUT_HERE

{
"architecture": "win32-x64",
"cliVersion": "@salesforce/cli/2.117.7",
"nodeVersion": "node-v22.16.0"
}

[github-actions]

Thank you for filing this issue. We appreciate your feedback and will review the issue as soon as possible. Remember, however, that GitHub isn't a mechanism for receiving support under any agreement or SLA. If you require immediate assistance, contact Salesforce Customer Support.

[himanshu-devOps]

Additionally, on occasions when it is successfully validating, it is not giving it as a Connected Org in output of "sf org list" command

[gauravjangid04]

Hi @gitmevg try to create a connected app instead of external client app. I also encountered the same issue and this fixed for me.

Follow this documentation to enable the creation of new connected apps.

[gitmevg]

hi @gauravjangid04 ,

Post Spring 26, doesn't allow creation of Connected Apps. We have to reach out to Salesforce Support for that [to get it enabled].

Any updates on this please ?

[gauravjangid04]

Yes agreed! this is by default disabled but you can enable on your own from the external client app settings. here's a snapshot of the same

Sprint 26 release notes

[gitmevg]

hello @gauravjangid04 ,

Behavior has changed Spring'26 onwards - link ref

[gitmevg]

Anything here ?

[cristiand391]

Error (JwtGrantError): We encountered a JSON web token error, which is likely not an issue with Salesforce CLI. Here’s the error: JwtAuthError::Error authenticating with JWT.
Errors encountered:
External client app is not installed in this org

questions:

1. is the ECA created in the sandbox or in the prod org?
2. have you tried passing -r/--instance-url the MyDomain URL instead of test.salesforce.com?