We have a Salesforce Service Cloud Voice Integrated with Genesys Cloud. At the moment Genesys Cloud agents are unable to login to Omni Channel with 401 Unauthoriased and Genesys has suggested that "the rejection occurs strictly on the Salesforce presence endpoint (POST /sfdc/liveagent/rest/presence) when Omni-Channel attempts to set the agent's status to Available."
Hence Genesys Support has asked: In Salesforce Setup, search for Omni-Channel Settings, ensure Enable Enhanced Omni-Channel is turned ON, and test the login again.
However, when I check the Omni Channel Settings in the Setup page, I can't see the toggle for 'Enable Enhanced Omni-Channel'. If Enahnced Omni-Channel is not enabled for my Org, the Agent will not be able to login to Omni Channel.How do I proceed further?
#Salesforce
This is a Service Cloud Voice + Genesys Cloud CTI integration issue sticking to the Salesforce side of the diagnosis since that's where the fix will need to land.
First, a correction to Genesys's suggested fix: in your second screenshot, "Enhanced Omni-Channel Routing" is already toggled On (top right). So that isn't your problem Genesys support's suggested step doesn't apply here, and chasing it further will be a dead end.
What actually points to the real cause: the response body shows "signedToken": "UNAUTHORIZED" on a 400 Bad Request from the /sfdc/liveagent/rest/presence call, wrapped by a Spring WebClient error (that's coming from the GC-for-SCV middleware layer calling into Salesforce). That specific field - signedToken combined with the fact this broke immediately after your self-signed certificate renewal, points to a certificate/Connected App mismatch, not a feature toggle. The Genesys Cloud → Salesforce presence call is authenticated via a JWT signed by a certificate that Salesforce's Connected App has to trust. If the cert was regenerated on both ends independently, it's very possible the public certificate now registered in Salesforce's Connected App doesn't match the private
key Genesys is currently signing with (or vice versa) a very common miss when a cert is rotated on both sides at once rather than one side generating it and sharing the public half.A few caveats worth flagging directly:
- Identify the Connected App used by the integration In Salesforce Setup → App Manager, find the Connected App tied to the Genesys Cloud / GC for SCV integration (search 'Genesys' or check the Call Center / telephony integration config for which Connected App it references).
- Check its digital signature certificate Open that Connected App's OAuth policy settings and look at 'Use digital signatures.' Note the certificate currently uploaded there this is what Salesforce trusts to validate incoming signed tokens.
- Compare against what Genesys is signing with now In Genesys Cloud's Salesforce integration config, confirm which certificate/private key it's using to sign the JWT since the August 18 renewal. If this doesn't match the public cert in step 2, that's your 401/UNAUTHORIZED root cause.
- Re-upload the correct certificate If mismatched, export the current public certificate from whichever side generated the new one, and upload it to the Connected App's digital signature setting in Salesforce (or update Genesys's config to sign with the cert Salesforce actually trusts).
- Also check Certificate and Key Management Separately, in Setup → Certificate and Key Management, confirm the old expired cert isn't still referenced anywhere else in the org (e.g. an Auth Provider or External Client App tied to the same integration) a stale reference here can cause the same symptom even after fixing the Connected App.
- Re-test agent login after alignment Once certs are confirmed matching on both ends, have an agent attempt Omni-Channel login again and re-check the Network tab response for the presence call you should see a 200 instead of the signedToken UNAUTHORIZED response.
- I haven't verified any of this against your actual org config no MCP/org access in this session, so this is diagnosis from the evidence in your screenshots plus how Salesforce's Omni-Channel CTI presence API and Connected App JWT auth normally work. Treat the connected-app-name and exact settings as "go look here," not "this is confirmed."
- Genesys already ruled out their own side (200 OKs on their APIs), and your screenshot rules out the Enhanced Omni-Channel toggle (already on) that narrows this to a trust/verification failure on the Salesforce side specifically for the token Genesys is now signing, which is exactly what a mismatched cert after a dual-side rotation produces.
- If step 1–2 turn up something other than a Connected App (e.g. this integration uses a different auth mechanism like a Named Credential or an External Client App instead), tell me what you find and I'll adjust the presence-endpoint auth pattern varies slightly depending on how GC-for-SCV was originally packaged/installed in your org.
If you can pull the Connected App (or equivalent) config, share what's there and I'll help pinpoint the exact mismatch.
I hope you find the above information helpful. If it does, please mark it as Best Answer to help others too.
