A few days ago, I published my theory that the retirement of the SOAP API login() method would start affecting existing integrations in the upcoming Winter ’27 release, not just Summer ’27 as most people were assuming.

You called me crazy. You said nobody was telling us that.

Well... Today, I confirmed it.

Existing integrations using SOAP API login() can no longer authenticate in Winter ’27 unless the user has a new permission called Use Any API Auth.

You can find it in a permission set by navigating to:

Permission Sets → System Permissions → Use Any API Auth

Any user trying to authenticate using SOAP API login() without this permission will be rejected with the following error:

INSUFFICIENT_ACCESS: SOAP API login() requires the Use Any API Auth user permission

How to Find Who Is Still Using SOAP API login()

Before assigning the permission to anyone, you first need to identify which integrations are still using login().

Go to: Setup → Login History

You can review the records there or download the login history as a CSV file.

Look for entries where:

  • Login Type is Other Apex API or Partner Product
  • Login Subtype is SOAP API
  • API Type is SOAP Enterprise, SOAP Partner or SOAP Tooling

Those entries represent applications authenticating through SOAP API login(). The Username tells you which Salesforce user is being used by the integration.

And don't be surprised if the Application field says N/A. That's expected. SOAP API login() isn't tied to a Connected App or External Client App, which is kind of the whole problem here.

If you need to investigate further, you can use the API Total Usage EventLogFile.

Look for events where:

  • API_FAMILY = SOAP
  • API_RESOURCE = login

The USER_NAME identifies the user, while CLIENT_NAME can help identify the actual application.

What You Should Do Before Winter ’27

Review your Login History and identify every user still authenticating through SOAP API login().

If you can't migrate those integrations just yet, create a dedicated permission set containing Use Any API Auth and assign it only to the users that actually need it.

That will keep those integrations alive through Winter ’27.

But don't get too comfortable with it. In Summer ’27, SOAP API login() in API versions 31.0 through 64.0 will be retired once and for all. At that point, there will be no permission you can assign and no checkbox you can enable to keep it alive a little longer.

Winter '27