> ## Content Index
> Fetch the complete content index at: https://www.bulkifiedthinking.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# SOAP API login() Retirement: I Think Everyone Has the Wrong Date
- URL: https://www.bulkifiedthinking.com/posts/soap-api-login-retirement-i-think-everyone-has-the-wrong-date/
- Published: 2026-08-27T03:40:25.000Z
- Updated: 2026-08-27T03:40:25.000Z
- Description: Everyone knows SOAP API login() retires in Summer '27. But a Winter '27 release update nobody is writing about may require the Use Any API Auth permission on every user. Yes, weeks from now, not next year.
- Author: Andrii Sukhetskyi
- Tags: #beaware, #posts, Architects, Developers, Salesforce Updates

As you might know, Salesforce is retiring the SOAP API `login()` method that **external systems** use to authenticate into your Salesforce organization.

It's a legacy method that some of your systems might still be using to get into Salesforce, and considering it's an extremely dumb and insecure way of doing it (just a plain username and password), it's indeed a good decision to get rid of it.

This enforcement is scheduled for **Summer '27** and will make API versions **31.0 through 64.0 unavailable**, returning an error saying:

![](https://storage.ghost.io/c/92/d5/92d55211-2cfe-45c9-b8c4-b7c7b1595cdb/content/images/2026/08/image-9.png)

The Lord of the Rings | You Shall Not Pass

And before you scroll away, **STOP**. Maybe your organization **will stop working already after Winter '27**.

The existing Salesforce documentation, as of the second I'm writing this post, is extremely confusing (as always) and might give us a hint that starting Winter '27, your users **must** have a specific permission to keep the SOAP API `login()` method working until Summer '27.

*YES, I KNOW, PLEASE BEAR WITH ME!*

### **Winter '26 Release Notes**

*This is an older release, from last year.*

Back in a day, Salesforce publishes a release note saying that all versions starting from 65.0 won't have the SOAP API `login()` method working at all.

Reference: [SOAP API | Salesforce Help](https://help.salesforce.com/s/articleView?id=release-notes.rn%5Fapi%5Fsoap.htm&release=258&type=5&ref=bulkifiedthinking.com)

So far it makes sense.

### Summer '26 Release Notes

The release right before Winter '27\. This summer. Salesforce introduced a new checkbox under User Interface named "**Enable SOAP API login() to users with the Use Any API Auth user permission**".

![](https://storage.ghost.io/c/92/d5/92d55211-2cfe-45c9-b8c4-b7c7b1595cdb/content/images/2026/08/image-11.png)

Setup | User Interface

Activate it, and the SOAP API `login()` method stops working for all users EXCEPT those who have the **Use Any API Auth** permission. That permission is also a new one, introduced in this very release.

Reference: [Restrict Login Access to SOAP API | Salesforce Help](https://help.salesforce.com/s/articleView?id=release-notes.rn%5Fapi%5Fsoap%5Flogin.htm&release=262&type=5&ref=bulkifiedthinking.com)

They allow us to do a round of testing.

### Winter '27 Release Notes

And then in the upcoming Winter '27 release notes, I quote: "To authenticate with the SOAP API login() operation, all users **must** have the Use Any API Auth user permission assigned to them".

If my interpretation is correct, **it means that all your SOAP API `login()` integrations will break not in Summer '27 as you all assume, but literally in a few weeks with Winter '27, unless you assign that permission.**

You might say I am overreacting, but why would you then publish this release page in the first place? Like, the checkbox is there, the permission is there, there is nothing new unless you now enforce having this permission attached. Just look at the reference.

Reference: [Assign Use Any API Auth Permission for SOAP login()](https://help.salesforce.com/s/articleView?id=release-notes.rn%5Fapi%5Fsoap%5Flogin.htm&release=264&type=5&ref=bulkifiedthinking.com)

### My detective conclusion

Winter '27 will break your SOAP API `login()` integrations and will give you a way to repair them quickly. The problem is, if it weren't for me, you would still be in for the downtime.

On that note, I recommend looking into this already today. To identify all SOAP API usage, you shall:

- Look into your inbox. Salesforce must have sent you an email a couple of months ago saying that they identified that your org has been accessed using SOAP API `login()`.
- Go to Login History and look for "Other Apex API", "Partner Product" or "SOAP API". If any of these are present, you can track back the user and then see which integration is using this older authentication method.

![](https://storage.ghost.io/c/92/d5/92d55211-2cfe-45c9-b8c4-b7c7b1595cdb/content/images/2026/08/image-10.png)

Setup | Login History

- Finally, verify that all your AppExchange packages are updated and not using those older authentication methods. This is really easy to overlook, as you usually don't think of it.

To help you communicate with other teams, share with them that their code most likely looks something like this:

```Java
ConnectorConfig config = new ConnectorConfig();

config.setUsername("integration@example.com");
config.setPassword("passwordSECURITY_TOKEN");
config.setAuthEndpoint("https://YourDomainName.my.salesforce.com/services/Soap/c/41.0/");
```

The idea behind such integrations is simple. If your external application is accessing Salesforce with a username and password only — that's bad. It's either SOAP API `login()` or OAuth username-password, both of which are on their way out as we speak.

I'll keep you updated once we get Winter '27 in our sandboxes and whether my detective masterpiece is truthful.