u/sir_meowmixalot

Has anyone run into this with Salesforce Service Cloud Voice + Amazon Connect when using InvokeSalesforceRestApiFunction from a contact flow?

I’m building a new SCV / Amazon Connect contact center in a sandbox. The normal SCV telephony Lambda flow is mostly working: VoiceCall records are created and executeOmniFlow is being called. However, the separate Salesforce REST API Lambda was failing when trying to query or update the VoiceCall record.

The Lambda is:

InvokeSalesforceRestApiFunction

It was being called from Amazon Connect to update custom VoiceCall fields like brand, region, and language during IVR routing.

Originally, even a simple test like:

SELECT Id FROM VoiceCall WHERE Id = '<VoiceCallId>' LIMIT 1

returned:

{"success":false,"status":500}

After inspecting the Lambda package, the failure was coming from sfRestApi.js -> sendRequest() / JWT auth. The AWS secret had placeholder-looking values for the REST API auth:

• REST API private key was not a PEM key
• Consumer key looked like a placeholder
• Subject looked like a placeholder

I created a new External Client App in Salesforce for REST API JWT auth, enabled OAuth, enabled JWT Bearer Flow, uploaded a public certificate, and updated AWS Secrets Manager with the matching private key, real Consumer Key, and a real Salesforce username as the subject.

Now the error has changed to:

invalid_grant: user hasn't approved this consumer

I changed the External Client App policy from “All users can self-authorize” to “Admin approved users are pre-authorized” and am working through profile / permission set authorization now.

Questions:

1. For Service Cloud Voice, is it expected that the Salesforce-created External Client App is only for the managed Voice connection, and that a separate External Client App / Connected App is needed for InvokeSalesforceRestApiFunction REST API calls?
2. For the JWT subject, should I use a dedicated API/integration user, the Platform Integration User, or the user that owns/created the contact center?
3. For invalid_grant: user hasn’t approved this consumer, is the correct fix to pre-authorize the External Client App through a profile/permission set assigned to the subject user?
4. Has anyone seen VoiceCall custom fields populate 10–15 minutes later through sfdc-* contact attribute sync, while the immediate REST Lambda update fails? I’m trying to confirm that these are two separate update paths.

Any guidance from someone who has set up SCV + Amazon Connect + InvokeSalesforceRestApiFunction with JWT auth would be appreciated.