What happens when a Salesforce OAuth access token is issued from an allowed IP, but a subsequent API request comes from a different IP?

In this hands-on experiment, I use Salesforce OAuth Authorization Code Flow and a Node.js application to test this scenario.

I first authenticate from an allowed IP, obtain an access token, and then switch to a different network and make a Salesforce REST API call using the same token.

I also test the behavior with “Enforce login IP ranges on every request” enabled.

Does Salesforce block the API call? Watch the video to find out.