Sitecore services client 403 Forbidden

Question

We have a remote instance http://dev-instance/sitecore/login.
I have followed all the steps in this article and got the token in postman for https://dev-instance/sitecore/api/ssc/auth/login

But when trying to get an item's info using, https://dev-instance/sitecore/api/ssc/item/{item-id}, it gives no result and shows 403 forbidden.

When I try to browse the same URL (logged into CMS in another tab), it says:

Access to dev.instance was denied
You don't have authorization to view this page.
HTTP ERROR 403

sitecore\servicesAPI user has read access to that item.

When I browse the URL in the remote system which has the instance, it returns the JSON data.

Is there some more configuration that needs to be done. or should the secret key used in connection string be of any specific format?

Using Sitecore 8.2 update 5

Answer 1

Below are different security policies for the Sitecore services. These were mentioned in "Sitecore.Services.Client.config". In order to make your services accessible remotely we would need to set Option #3 mentioned below. Option #2 is the default one.

1. Sitecore.Services.Infrastructure.Web.Http.Security.ServicesOffPolicy: Policy denies access to all Entity and Item Services.
2. Sitecore.Services.Infrastructure.Web.Http.Security.ServicesLocalOnlyPolicy: Policy denies access to all Entity and Item Services from requests originating from remote clients.

3. Sitecore.Services.Infrastructure.Web.Http.Security.ServicesOnPolicy: Policy allows access to all Entity and Item Services

More details can be found here