We have a connected app in the manage package, setup for Oauth Web Server flow. We have provided IP ranges using these steps https://help.salesforce.com/articleView?id=connected_app_edit_ip_ranges.htm&type=5 to restrict the access to connected app. However seems connection to connected app is still allowed outside of those IP ranges.

For example: I performed the OAuth Web Server Flow steps using Postman(which is outside of the given IP range), but still I could successfully connect and generate refresh token and access token.

I haven't found any descriptive documentation of this particular behavior. Can someone please provide insights on this?

Thanks in advance for the help.

Further Update:19/08/2020 While playing more around this, I tried below scenario:

  • Added IP range in the user profile
  • Removed IP trusted IP ranges for OAuth Web Server Flow
  • Set connected app policy to - Relax IP restrictions for activated devices

Tried a connection to connected app from different IP (then set in user profile).

Expected: Successful connection, based on criteria

The app doesn’t have a list of allowed IP-ranges, but it uses the web server authentication flow, and the user successfully completes identity verification if accessing Salesforce from a new browser or device.

given in the documentation https://help.salesforce.com/articleView?id=connected_app_continuous_ip.htm&type=5.

Actual: Received IP restricted error, and connection was not successful.

Can someone please clarify if my understanding is not correct regarding above scenario? Thanks in advance!

  • What's your IP relaxation policy set? Check this help.salesforce.com/… – Mohith Shrivastava Aug 13 '20 at 13:38
  • IP relaxation policy is set to: Enforce IP restrictions in my connected app. However I will try with Relax IP restrictions for activated devices and see how it behaves. – Amit Aug 13 '20 at 14:40
  • It worked with IP relaxation policy is set to: Relax IP restrictions for activated devices. Now it throws below error if source IP is out of given range, { "error": "invalid_grant", "error_description": "ip restricted" } – Amit Aug 13 '20 at 17:46

In your connected app navigate to manage apps and check for the IP restriction policy.

It should be set to "Relax IP restriction for Activated devices"

This is documented here

Relax IP restrictions for activated devices


  • Just out of curiosity - I am checking the Source IP listed in Login History to verify whether origin IP is within the range or not. Is that correct place to verify IP? Or there is other way to verify the IP from where the connection was requested? – Amit Aug 13 '20 at 18:11
  • 1
    Yes that’s correct place to look into – Mohith Shrivastava Aug 13 '20 at 18:26
  • Hi Mohith: Can you please also look at the updated scenario in the original question and provide some insights on it as well? – Amit Aug 24 '20 at 21:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.