Short version: It seems that the access_token retrieved via OAuth is restricted to use only by the IP address that requested it. Is there a way to remove this restriction?
Long version: I am attempting to run a website on a server outside of Salesforce and access an Apex REST API on a Salesforce instance.
Because Salesforce does not support the OPTIONS HTTP call, I'm trying to get around cross domain (CORS) issues using an PHP-based proxy on the server hosting the website.
What I'm finding is that while the access_token is passed through and access works fine when I run the proxy on localhost (which is where I requested the token from), when I upload it to the webserver I get a 401 return and a message indicating that that the token is invalid. To verify that it was IP related, I changed my IP (by tethering to my phone) and then found that the version on my localhost failed as well.
Based on the existence of this similar proxy, I think that this must be possible, but I can't figure out where.
I'm not sure if it matters, but these are portal users, authenticating via a connected app. I've tried setting the "Relax IP Restrictions" setting in the connected app, but this didn't work and seems to be for something different. I've looked all over through the Site, but didn't see any way of doing this.
So my question is: is there any way to set Salesforce to NOT restrict an OAuth access_token to the IP on which it was registered?
If not, then it would seem that there is no way to develop an external website that uses a REST API hosted on Salesforce.