We have a connected app in the manage package, setup for Oauth Web Server flow. We have provided IP ranges using these steps https://help.salesforce.com/articleView?id=connected_app_edit_ip_ranges.htm&type=5 to restrict the access to connected app. However seems connection to connected app is still allowed outside of those IP ranges.

For example: I performed the OAuth Web Server Flow steps using Postman(which is outside of the given IP range), but still I could successfully connect and generate refresh token and access token.

I haven't found any descriptive documentation of this particular behavior. Can someone please provide insights on this?

Thanks in advance for the help.

Further Update:19/08/2020 While playing more around this, I tried below scenario:

  • Added IP range in the user profile
  • Removed IP trusted IP ranges for OAuth Web Server Flow
  • Set connected app policy to - Relax IP restrictions for activated devices

Tried a connection to connected app from different IP (then set in user profile).

Expected: Successful connection, based on criteria

The app doesn’t have a list of allowed IP-ranges, but it uses the web server authentication flow, and the user successfully completes identity verification if accessing Salesforce from a new browser or device.

given in the documentation https://help.salesforce.com/articleView?id=connected_app_continuous_ip.htm&type=5.

Actual: Received IP restricted error, and connection was not successful.

Can someone please clarify if my understanding is not correct regarding above scenario? Thanks in advance!

  • What's your IP relaxation policy set? Check this help.salesforce.com/… Aug 13, 2020 at 13:38
  • IP relaxation policy is set to: Enforce IP restrictions in my connected app. However I will try with Relax IP restrictions for activated devices and see how it behaves.
    – Amit
    Aug 13, 2020 at 14:40
  • It worked with IP relaxation policy is set to: Relax IP restrictions for activated devices. Now it throws below error if source IP is out of given range, { "error": "invalid_grant", "error_description": "ip restricted" }
    – Amit
    Aug 13, 2020 at 17:46

1 Answer 1


In your connected app navigate to manage apps and check for the IP restriction policy.

It should be set to "Relax IP restriction for Activated devices"

This is documented here

Relax IP restrictions for activated devices


  • Just out of curiosity - I am checking the Source IP listed in Login History to verify whether origin IP is within the range or not. Is that correct place to verify IP? Or there is other way to verify the IP from where the connection was requested?
    – Amit
    Aug 13, 2020 at 18:11
  • 1
    Yes that’s correct place to look into Aug 13, 2020 at 18:26
  • Hi Mohith: Can you please also look at the updated scenario in the original question and provide some insights on it as well?
    – Amit
    Aug 24, 2020 at 21:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .