Salesforce access review failed: connected app OAuth error during data pull

TL;DR

Repair the connected app configuration in Salesforce before touching the review tool, because the error is issued by Salesforce during authorization. Check the connected app exists in the org the tool targets, that its OAuth scopes include API access, that its permitted users policy did not change to admin approved only without the integration user being pre-authorized, and that the integration user is active with the right profile. Re-authorize the connection from the tool and test with a small query before rerunning the full pull.

Salesforce access review failed: connected app OAuth error during data pull

Use this when

• A Salesforce review extract fails authorization or token errors.
• The integration broke after an org refresh, a connected app change or a user deactivation.
• Other Salesforce integrations using different apps still work.

Not for this skill when

• End users cannot sign in to Salesforce. That is a separate SSO configuration.
• The pull succeeds but returns incomplete data. That is a query or sharing problem after authorization.

Steps

1. Record the exact OAuth error from the review tool log and the org and connected app names it targets, avoiding the habit of retrying until the message changes. Verify: error, org and app are recorded from the log.
2. In the target org, open the connected app and check it is installed and not blocked, its OAuth scopes include full or API access as the tool requires, and its callback and settings were not altered by a recent change. Verify: the app state and scopes are confirmed or a change is found.
3. Check the connected app user policy: if it is set to admin approved users are pre-authorized, confirm the integration user is in the authorized profiles or permission sets list. Verify: the integration user is authorized under the current policy.
4. Open the integration user record and confirm it is active, not locked, holds an API enabled profile or permission set, and its password or security posture was not changed by a recent policy push. Verify: the user state fully supports API authorization.
5. Re-run the authorization flow from the review tool so a fresh token is issued under the corrected configuration, keeping credential values inside the vault or tool store and out of tickets. Verify: the tool authorizes successfully and stores a working connection.
6. Run a small test query, such as counting users or profiles, and compare it with the org expected count before starting the full extract. Verify: the test query returns a plausible count.
7. Run the full review pull, confirm the record counts per object match the plan, and note the connected app settings in the evidence so the next breakage diffs quickly. Verify: the full pull completes with reconciled counts.

Why it happens

Salesforce connected apps concentrate several settings that each produce authorization failure when they drift: app blocked during a security cleanup, scopes trimmed, the pre-authorized policy changed, or the integration user caught by a password or lockout event. Sandbox refreshes add another path by overwriting the app the tool expects. Checking the four settings in the org, in order, finds the drift without guesswork, and a counted test query proves the repair before the review commits hours to a full extract.

Variants and edge cases

Salesforce connected app oauth error invalid grant on extract

The grant phrasing. Invalid grant often means the user or authorization was revoked; recheck authorization rather than re-entering credentials repeatedly.

review tool cannot connect to Salesforce after sandbox refresh

The refresh phrasing. Refresh copies production over the app or replaces the org; recreate or repair the app in the refreshed org.

integration user not authorized for connected app

The policy phrasing. Pre-authorized mode needs the profile or permission set listed explicitly on the app.

Edge cases to check before closing the review cycle:

• IP restrictions on the connected app or profile can reject the review tool host after a network change. Check the source address the tool connects from.
• Session and token policies that require specific authentication levels can block headless flows. Align the app policy with the tool supported flow.
• Never debug by widening the app to all users self-authorized. Fix the named policy for the integration user only.

Compatibility: Salesforce connected apps and OAuth policies, integration users, Salesforce editions with API access for review extraction.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_rKFey9buh0WB9sGaKYUJmA