Error "C-1016: We encountered a problem while attempting to configure and approve the Connected App" when Creating Scratch Org in Salesforce CLI

Summary: Scratch org creation via Salesforce CLI fails with error code C-1016 when the Dev Hub org cannot internally create or approve Connected Apps. This occurs after Spring '26 disabled traditional Connected App creation by default, affecting orgs that authenticate using JWT with an External Client App.

Scope: This article covers scratch org creation failures with error C-1016 specifically caused by the Dev Hub org's inability to internally create/approve Connected Apps after Spring '26 disabled traditional Connected App creation. It does NOT cover C-1016 errors caused by Connected App misconfiguration, scratch org definition file conflicts, scratch org limit exceeded errors, or feature provisioning timing issues.

Description

When creating a scratch org using Salesforce CLI (`sf org create scratch`) after authenticating to a Dev Hub via JWT, the operation fails with error code C-1016. This typically occurs when the Dev Hub org has traditional Connected App creation disabled — a default behavior introduced in Spring '26. The scratch org creation process requires the ability to internally configure and approve a Connected App for the new org, and this step fails when the permission is not present.

This issue commonly surfaces in CI/CD pipelines (such as Bitbucket Pipelines, GitHub Actions, or Jenkins) where JWT-based authentication with an External Client App replaced a previously deleted traditional Connected App.

Symptoms

- JWT authentication to the Dev Hub succeeds without error.
- Running `sf org create scratch` returns the following error:
`RemoteOrgSignupFailed: We encountered a problem while attempting to configure and approve the Connected App for your org. Verify the Connected App configuration with your Salesforce admin.`
- The error code is `C-1016`.
- The issue blocks all scratch org creation from the affected Dev Hub, including CI/CD pipeline builds.
- The Dev Hub org uses an External Client App for JWT authentication (rather than a traditional Connected App).
- The issue may have started after Spring '26 or after a previously working traditional Connected App was deleted.

Cause

Starting with Spring '26, Salesforce disabled traditional Connected App creation by default in many orgs. When Salesforce CLI creates a scratch org, the platform internally attempts to configure and approve a Connected App within the new scratch org. If the Dev Hub org lacks the backend permission to create Connected Apps, this internal step fails and returns error C-1016.

This is distinct from a misconfigured Connected App or External Client App on the authentication side — JWT authentication succeeds, but the downstream scratch org provisioning step fails because the org-level Connected App creation capability is blocked.

Resolution

To resolve this issue, contact Salesforce Support and request that the backend permission for Connected App creation be re-enabled on the Dev Hub org.

1. Open a case with Salesforce Support.
2. Provide the Dev Hub Org ID and confirm that you are a System Administrator of the org.
3. Request that Connected App creation be re-enabled. Support can approve this for a maximum of 90 days per request.
4. After the request is approved and actioned (typically within 24 hours), retry scratch org creation.
5. If the permission expires after 90 days and you still require it, open a new support case to request an extension.

After the permission is enabled:
- Run `sf org create scratch` again to verify scratch org creation succeeds.
- If you need to create a new traditional Connected App for JWT authentication (for example, if the original was deleted), do so while the permission is active. Note that consumer key and secret values are displayed only once during Connected App creation — record them immediately.

Caveats: This resolution requires Salesforce Support intervention; there is no self-service option to re-enable this permission. The 90-day window is the maximum per request.

Known Limitations

- The backend permission to create Connected Apps can only be enabled for a maximum of 90 days per support request.
- There is no self-service mechanism to re-enable traditional Connected App creation after Spring '26 disabled it.
- External Client Apps used for JWT authentication do not bypass the requirement for the platform to internally create a Connected App during scratch org provisioning.
- Consumer keys for newly created Connected Apps are displayed only once — if lost, the Connected App must be recreated (while the permission is still active).