Articles on: Browser Extension

Access Authorization Troubleshooting: Salesforce OAuth error

Symptom


After trying to login to Salesforce in the PipeLaunch Browser Extension, Salesforce returns the following OAuth error: OAUTH_APPROVAL_ERROR_GENERIC



This is an org level setting, so it needs a Salesforce administrator to fix. It usually affects every user who has API access enabled, since users without API access fail earlier with a different error.


Start here


PipeLaunch static egress IP: 63.185.156.151


The extension does not talk to Salesforce from the user's browser. Tokens are exchanged and refreshed from our backend, always from the address above. In a production org that address has to be trusted, otherwise Salesforce rejects the authorization with this exact error.


There are two ways to trust it, covered in Step 1. Sandboxes usually work without either, because they rarely have login IP restrictions in place.


Prerequisite: the app must be installed


Since September 2025 Salesforce blocks users from authorizing a connected app that an admin has not installed. Background is in this Salesforce help article.


In Salesforce Setup, search for Connected Apps OAuth Usage and locate PipeLaunch Browser Extension. The App Actions column shows a Load Actions button. Click it to reveal the available actions.




Then click Install.




If the app is already installed, the actions show Block, Uninstall and Manage App Policies instead. Nothing to do here, continue below.


Step 1: Trust the PipeLaunch egress IP


Pick whichever option fits your security policy. Option A is faster, Option B keeps your login IP restrictions intact.


Option A: Relax IP restrictions for this app only


  1. In the same row, click Manage App Policies, then Edit Policies.
  2. Under OAuth Policies, set IP Relaxation to Relax IP restrictions.
  3. Save.



This affects only the PipeLaunch connected app. The rest of your org keeps its IP restrictions.


Option B: Keep IP restrictions and allowlist our IP


Leave IP Relaxation on Enforce IP restrictions, then add our address to the Profiles that use the extension:


  1. Go to Salesforce Setup, type Profiles in the Quick Find box and select Profiles.
  2. Open the Profile of an affected user, then click Login IP Ranges.
  3. Add a range with 63.185.156.151 as both the start and the end address.
  4. Repeat for every Profile that uses the extension.

Best practice is to add it as that single exact address rather than a wider block. Salesforce's own guidance for these allowlists is to avoid broad ranges.


A middle ground also exists: Enforce IP restrictions, but relax for refresh tokens keeps your ranges in force for user logins while letting the extension renew its token. Some orgs still hit the error on the very first connection with this setting, so if it fails, use Option A or complete Option B.


Note: Network Access → Trusted IP Ranges is not a substitute for either option. Trusted IP Ranges only control when Salesforce asks for identity verification, they do not lift Profile Login IP Ranges.
Reference: Manage OAuth Access Policies for a Connected App



Still blocked?


Check Login History. Open Setup → Login History and filter for the affected user. The source IP and status tell you whether the block came from an IP rule or from the app policies.


Enforce login IP ranges on every request. If this org wide setting is enabled and the app is set to Relax IP restrictions, Salesforce can still block access. See Connected App IP Relaxation and Continuous IP Enforcement.


Related: If your question is about the IP that PipeLaunch itself connects from (for example "login from Germany" alerts, or allowlisting our backend), that is a different address from the user login IP covered above. See Why am I seeing "login from Germany" security alerts in Salesforce?

Updated on: 25/08/2026