The client-IP is passed with the “cip” parameter (https://github.com/matomo-org/tracker-proxy/blob/master/proxy.php#L116). For Matomo to read and accept this parameter to overwrite the IP address from the server request, the provided auth_token must be from a super user, admin or at least a user with write access to a given site-ID. Just “read” access is not enough.