Common problem
| Flow | Error | Resolution | Useful links |
|---|---|---|---|
| Web Server OAuth Authentication Flow | The server responds with a 401 with the following body: [{"message":"Session expired or invalid","errorCode":"INVALID_SESSION_ID"}] | Probably the wrong instance URL, change from https://xxyy.lightning.force.com/services/data/... to https://xxyy.salesforce.com/services/data/... e.g change from lightning to salesforce. The second solution use relaxed IP restriction. | https://success.salesforce.com/answers?id=9063A000000ZtvGQAS |