> ## Knowledge Base Index > Fetch the complete knowledge base index at: https://help.pipelaunch.com/sitemap.xml > Use this file to discover available pages before exploring further. > Pure-Markdown content can be obtained by appending a '.md' suffix to the content URLs listed in the sitemap (without the trailing slash). # Access Authorization Troubleshooting: Salesforce OAuth error ## Symptom After trying to login to Salesforce in the PipeLaunch Browser Extension, Salesforce returns the following OAuth error: `OAUTH_APPROVAL_ERROR_GENERIC` ![](https://storage.crisp.chat/users/helpdesk/website/348acba567d60c00/image_1af26st.png) This is an org level setting, so it needs a Salesforce administrator to fix. It usually affects every user who has [API access](https://help.salesforce.com/s/articleView?id=sf.security_api_access_control_about.htm&type=5) enabled, since users without API access fail earlier with a different error. ## Start here **PipeLaunch static egress IP:** `63.185.156.151` The extension does not talk to Salesforce from the user's browser. Tokens are exchanged and refreshed from our backend, always from the address above. In a production org that address has to be trusted, otherwise Salesforce rejects the authorization with this exact error. There are two ways to trust it, covered in Step 1. Sandboxes usually work without either, because they rarely have login IP restrictions in place. ## Prerequisite: the app must be installed Since September 2025 Salesforce blocks users from authorizing a connected app that an admin has not installed. Background is in this [Salesforce help article](https://help.salesforce.com/s/articleView?id=005132365&type=1). In **Salesforce Setup**, search for **Connected Apps OAuth Usage** and locate **PipeLaunch Browser Extension**. The **App Actions** column shows a **Load Actions** button. Click it to reveal the available actions. ![](https://storage.crisp.chat/users/helpdesk/website/-/3/4/8/a/348acba567d60c00/image_9qt820.png) Then click **Install**. If the app is already installed, the actions show **Block**, **Uninstall** and **Manage App Policies** instead. Nothing to do here, continue below. ![](https://storage.crisp.chat/users/helpdesk/website/-/3/4/8/a/348acba567d60c00/image_1njrg2y.png) --- ## Step 1: Trust the PipeLaunch egress IP Pick whichever option fits your security policy. Option A is faster, Option B keeps your login IP restrictions intact. ### Option A: Relax IP restrictions for this app only 1. In the same row, click **Manage App Policies**, then **Edit Policies**. 2. Under **OAuth Policies**, set **IP Relaxation** to *Relax IP restrictions*. 3. Save. ![](https://storage.crisp.chat/users/helpdesk/website/-/3/4/8/a/348acba567d60c00/image_yji7j6.png) This affects only the PipeLaunch connected app. The rest of your org keeps its IP restrictions. ### Option B: Keep IP restrictions and allowlist our IP Leave **IP Relaxation** on *Enforce IP restrictions*, then add our address to the Profiles that use the extension: 1. Go to **Salesforce Setup**, type **Profiles** in the Quick Find box and select **Profiles**. 2. Open the Profile of an affected user, then click **Login IP Ranges**. 3. Add a range with `63.185.156.151` as both the start and the end address. 4. Repeat for every Profile that uses the extension. Best practice is to add it as that single exact address rather than a wider block. Salesforce's own guidance for these allowlists is to avoid broad ranges. A middle ground also exists: *Enforce IP restrictions, but relax for refresh tokens* keeps your ranges in force for user logins while letting the extension renew its token. Some orgs still hit the error on the very first connection with this setting, so if it fails, use Option A or complete Option B. **Note:** **Network Access → Trusted IP Ranges** is not a substitute for either option. Trusted IP Ranges only control when Salesforce asks for identity verification, they do not lift Profile Login IP Ranges. Reference: [Manage OAuth Access Policies for a Connected App](https://help.salesforce.com/s/articleView?language=en_US&id=sf.connected_app_manage_oauth.htm&type=5) --- ## Still blocked? | **Check Login History.** Open **Setup → Login History** and filter for the affected user. The source IP and status tell you whether the block came from an IP rule or from the app policies. | **Enforce login IP ranges on every request.** If this org wide setting is enabled and the app is set to *Relax IP restrictions*, Salesforce can still block access. See [Connected App IP Relaxation and Continuous IP Enforcement](https://help.salesforce.com/s/articleView?language=en_US&id=sf.connected_app_continuous_ip.htm&type=5). || **Related:** If your question is about the IP that PipeLaunch *itself* connects from (for example "login from Germany" alerts, or allowlisting our backend), that is a different address from the user login IP covered above. See [Why am I seeing "login from Germany" security alerts in Salesforce?](https://help.pipelaunch.com/en/article/why-am-i-seeing-login-from-germany-security-alerts-in-salesforce-1l5zo2t/)