If a user sees an OAuth error like error=invalid_client with the message app must be installed into org, Salesforce is blocking the login because the connected app is not yet approved inside that Salesforce org.
Admins can confirm this in Setup → Connected Apps OAuth Usage. When the app appears with a denied attempt and an Install action, Salesforce is asking for an org-level approval before users can continue.
After the app is installed, users in that org can retry the Salesforce login from the Portifylead Chrome extension.
What this means:
- The app is trusted, but not yet approved in that Salesforce org.
- This is an org policy restriction, not a bad password or callback URL issue.
- Some orgs work immediately because the app was already installed or previously approved there.
How to fix it:
- In Salesforce, go to Setup.
- Search for Connected Apps OAuth Usage.
- Find LinkedIn Lead Button in the list.
- Click Install.
- Retry the Salesforce sign-in from the extension.
If the app is already installed and the user still cannot connect, the next checks are the app's permitted-users policy, assigned access, and any org-level IP or MFA restrictions.