Short version: It seems that the access_token retrieved via OAuth is restricted to use only by the IP address that requested it. Is there a way to remove this restriction?

Long version: I am attempting to run a website on a server outside of Salesforce and access an Apex REST API on a Salesforce instance.

Because Salesforce does not support the OPTIONS HTTP call, I'm trying to get around cross domain (CORS) issues using an PHP-based proxy on the server hosting the website.

What I'm finding is that while the access_token is passed through and access works fine when I run the proxy on localhost (which is where I requested the token from), when I upload it to the webserver I get a 401 return and a message indicating that that the token is invalid. To verify that it was IP related, I changed my IP (by tethering to my phone) and then found that the version on my localhost failed as well.

Based on the existence of this similar proxy, I think that this must be possible, but I can't figure out where.

I'm not sure if it matters, but these are portal users, authenticating via a connected app. I've tried setting the "Relax IP Restrictions" setting in the connected app, but this didn't work and seems to be for something different. I've looked all over through the Site, but didn't see any way of doing this.

So my question is: is there any way to set Salesforce to NOT restrict an OAuth access_token to the IP on which it was registered?

If not, then it would seem that there is no way to develop an external website that uses a REST API hosted on Salesforce.

1 Answer 1


The most likely cause is that you have 'Lock sessions to the IP address from which they originated' enabled in 'Session Settings' - uncheck that if it is checked and give it a try.

enter image description here

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .