The “Unauthorized” error (often returned as INVALID_SESSION_ID, OAUTH_APP_BLOCKED, or 401 Unauthorized) in Zapier-to-Salesforce connections occurs when Salesforce invalidates the OAuth 2.0 access or refresh token held by Zapier. This happens when the connected Salesforce user changes their password, hits session timeout limits, has their security profile updated, or when connected app policies block Zapier’s access at the organization level.
Fast-Fix: The 45-Second Solution
Go to Zapier > Apps, select your Salesforce connection, and click Reconnect. Re-enter your Salesforce credentials and grant permissions. If the connection fails immediately, log into Salesforce, navigate to Setup > Connected Apps OAuth Usage, find Zapier, and ensure it is not set to Blocked. If blocked, click Unblock and attempt the Zapier reconnection step again.
Quick Logic Snapshot
- Severity: Operational (halts automated Zapier workflows and delays data synchronization)
- Impact: Team-Wide or Organization-Wide (affects all Zaps routed through the broken integration user)
- Primary Cause: Invalidated OAuth refresh token due to password resets, MFA enforcement, or manual session revocation
- Secondary Cause: Salesforce Connected App administrative policy set to “Admin approved users are pre-authorized” without assigning the user’s profile
- Rare Cause: IP address restriction policies blocking Zapier’s dynamic IP range during background OAuth renewals
Low Risk vs. High Risk Scenarios
- Low Risk (Single User Account Reconnect): An individual team member’s personal Salesforce account connection in Zapier expires after a routine password change. Only their personal Zaps pause, and re-authenticating fixes the pipeline instantly.
- Moderate Risk (Dedicated Integration User Token Drop): A dedicated “Zapier Sync User” account in Salesforce has its profile or password updated. All corporate Zaps handling lead routing, deal updates, or task creation stall until the master connection is re-authenticated.
- High Risk (Org-Level Connected App Lockout): A Salesforce administrator alters security policies under Connected App Settings or restricts API access across the org. Every Zapier-to-Salesforce connection drops simultaneously, leading to massive task backlogs and potential data loss if Zapier’s task replay buffer overflows.
What This Means (The Protocol Layer)
When you connect Zapier to Salesforce, Zapier uses an OAuth 2.0 protocol handshake to gain access without storing your raw password.
[ Zapier Sync Engine ] ─── (Access Token) ───► [ Salesforce REST API ]
│
▼
[ Token Valid & Active? ]
│ │
YES NO
│ │
▼ ▼
[ Request Processed ] [ 401 Unauthorized ]
│
▼
[ Zap Execution Paused ]
The system relies on two key tokens:
- Access Token: A short-lived credential used to execute REST API calls.
- Refresh Token: A long-lived credential used in the background to request a new Access Token when the previous one expires.
When Zapier sends a request, Salesforce checks the Access Token against its active session registry. If the user changed their password, if a Salesforce admin revoked the token under OAuth Tokens, or if the Refresh Token expired according to session timeout rules, Salesforce rejects the API request with an INVALID_SESSION_ID or 401 Unauthorized response. Zapier immediately halts the affected Zap to prevent automated retry spam.
If API access issues are caused by strict IP restrictions blocking remote servers, see “IP Whitelisting” blocking Remote CRM Access.
Probability Breakdown
| Cause Category | Probability | Root Mechanism |
|---|---|---|
| Password Reset / Security Token Revocation | 50% | Changing the integration account password invalidates active OAuth refresh tokens. |
| Connected App Permission Restrictions | 25% | Salesforce admin restricted Connected App access to specific Profiles/Permission Sets. |
| Session Timeout / Max Token Limit | 15% | Exceeding Salesforce’s 32-token limit per user across multiple apps revokes the oldest token. |
| Profile API Access Revoked | 10% | The Salesforce profile assigned to the user had the “API Enabled” permission toggled off. |
Logic Escalators
- Enforcing Multi-Factor Authentication (MFA): Enabling strict MFA rules without configuring exemptions for dedicated integration accounts can prevent background refresh tokens from auto-renewing.
- Sandbox vs. Production Environments: Connecting a Zapier Zap to a Sandbox instance that was recently refreshed will break the connection, as the Sandbox refresh overwrites user credentials and OAuth tokens. For sandbox data and configuration sync issues, see Troubleshooting: “Sandbox to Production” migration missing Custom Fields.
- IP Relaxation Settings: Setting “Lock sessions to the IP address from which they originated” in Salesforce Session Settings will cause Zapier connections to fail because Zapier calls originate from variable cloud IP blocks.
If Ignored: 1 Hour → 1 Day → 1 Week
- 1 Hour: Zaps entering the execution queue fail and accumulate as “Errored” or “Delayed” tasks in the Zapier Task History.
- 1 Day: Automated sync pipelines halt completely; sales and marketing teams notice missing lead transfers, deal stage sync gaps, and unassigned records.
- 1 Week: Zapier’s automatic retry windows expire, dropping queued tasks permanently unless manually replayed after connection restoration.
Confused With / False Positives
- 403 Forbidden Errors: The connection is authenticated, but the specific user lacks field-level or object-level read/write permissions for the record being accessed. For API authorization failures caused by endpoint permissions, see “403 Forbidden” when calling CRM API via Postman.
- API Governor Limit Reached: Salesforce rejects requests with
REQUEST_LIMIT_EXCEEDEDbecause the org exhausted its 24-hour REST API allocation. The connection itself remains valid. - Field Integrity Exception: Data payload fails validation rules or required field checks in Salesforce, returning a data processing error rather than an authentication error.
What To Do Right Now
- Test and Reconnect in Zapier:
- Navigate to Zapier > My Apps.
- Find the affected Salesforce connection and click Test.
- If it returns “Unauthorized,” click Reconnect and authorize using the appropriate Salesforce user account.
- Verify Salesforce Connected App Policies:
- In Salesforce, go to Setup > App Manager.
- Find Zapier (or your Custom Connected App), click the dropdown, and select Manage.
- Under OAuth Policies, check Permitted Users. If set to “Admin approved users are pre-authorized”, navigate to Profiles / Permission Sets below and ensure your integration user’s profile is explicitly listed.
- Check User Profile API Permissions:
- Go to Setup > Users, select the integration user, and click on their Profile.
- Search for API Enabled and ensure the checkbox is checked.
Immediate Intervention Flags
- Org-Wide Integration Failure: Every active Zap connected to Salesforce throws “Unauthorized” simultaneously (indicates a Connected App policy change or global session revocation by a SysAdmin).
- Repeated Re-authentication Drops: Reconnecting the account fixes the issue for only 15–30 minutes before returning to an “Unauthorized” state (indicates a session timeout setting or IP locking policy conflict).
- API User Deactivation: The Salesforce integration account was deactivated or marked inactive in Setup.
What a SysAdmin Will Check
1. Inspect OAuth Usage Logs:
- Setup > Connected Apps OAuth Usage
- Check 'Zapier' user count, blocked status, and revoked token history.
2. Verify Session Settings:
- Setup > Session Settings
- Confirm 'Lock sessions to the IP address from which they originated' is UNCHECKED for API users.
- Verify 'Enforce SSL/TLS' and session timeout policies match API lifetime expectations.
3. Inspect Login History:
- Setup > Users > [Integration User] > Login History
- Look for Status entries showing 'Failed: Connected App Access Restricted' or 'Invalid Password'.
Administrative Scope
- Scope: Minor (Individual user re-authentication) to Major (Org-wide Connected App policy and profile updates).
- Permissions Required: Salesforce System Administrator (to modify Connected App policies and profile permissions); Zapier Workspace Admin / Account Owner (to update app connections).
- Restoration Drivers: Re-authenticating the OAuth connection or fixing Connected App policies restores access immediately. Errored tasks in Zapier can then be safely replayed from the Task History dashboard.
Related Logical Handshakes
- If your Zapier connection drops because of rotating API secrets or integration credentials, see Troubleshooting: “API Secret” rotation breaking Production Scenarios.
- If data payload transfers are failing due to backlog delays after authentication is restored, refer to Troubleshooting: CRM “Sync Queue” Backlog – Resolving 4-hour delays.
Operations Summary
A Zapier-to-Salesforce “Unauthorized” error is an authentication session failure caused by invalidated OAuth tokens or restrictive Connected App security policies. Re-authenticating the account in Zapier restores access in most cases. If the error recurs immediately, a Salesforce SysAdmin must adjust the Connected App policies, ensure the “API Enabled” permission is checked on the user profile, and verify that IP session locking is disabled for API integrations. Once resolved, failed tasks can be replayed from the Zapier Task History.