def is_invalid_jwt_grant(resp):
    """
    Detect invalid OAuth 2.0 JWT token response returned from Salesforce (e.g. expired token)

    Reference:
        https://help.salesforce.com/articleView?id=remoteaccess_oauth_flow_errors.htm&type=5
    """
    if resp.status_code == 400 \
            and resp.headers.get('content-type') == 'application/json' \
            and resp.json().get('error') == 'invalid_grant':
        return True
    return False