As you might know, Salesforce is retiring the SOAP API login() method that external systems use to authenticate into your Salesforce organization.

It's a legacy method that some of your systems might still be using to get into Salesforce, and considering it's an extremely dumb and insecure way of doing it (just a plain username and password), it's indeed a good decision to get rid of it.

This enforcement is scheduled for Summer '27 and will make API versions 31.0 through 64.0 unavailable, returning an error saying:

The Lord of the Rings | You Shall Not Pass

And before you scroll away, STOP. Maybe your organization will stop working already after Winter '27.

The existing Salesforce documentation, as of the second I'm writing this post, is extremely confusing (as always) and might give us a hint that starting Winter '27, your users must have a specific permission to keep the SOAP API login() method working until Summer '27.

YES, I KNOW, PLEASE BEAR WITH ME!

Winter '26 Release Notes

This is an older release, from last year.

Back in a day, Salesforce publishes a release note saying that all versions starting from 65.0 won't have the SOAP API login() method working at all.

Reference: SOAP API | Salesforce Help

So far it makes sense.

Summer '26 Release Notes

The release right before Winter '27. This summer. Salesforce introduced a new checkbox under User Interface named "Enable SOAP API login() to users with the Use Any API Auth user permission".

Setup | User Interface

Activate it, and the SOAP API login() method stops working for all users EXCEPT those who have the Use Any API Auth permission. That permission is also a new one, introduced in this very release.

Reference: Restrict Login Access to SOAP API | Salesforce Help

They allow us to do a round of testing.

Winter '27 Release Notes

And then in the upcoming Winter '27 release notes, I quote: "To authenticate with the SOAP API login() operation, all users must have the Use Any API Auth user permission assigned to them".

If my interpretation is correct, it means that all your SOAP API login() integrations will break not in Summer '27 as you all assume, but literally in a few weeks with Winter '27, unless you assign that permission.

You might say I am overreacting, but why would you then publish this release page in the first place? Like, the checkbox is there, the permission is there, there is nothing new unless you now enforce having this permission attached. Just look at the reference.

Reference: Assign Use Any API Auth Permission for SOAP login()

My detective conclusion

Winter '27 will break your SOAP API login() integrations and will give you a way to repair them quickly. The problem is, if it weren't for me, you would still be in for the downtime.

On that note, I recommend looking into this already today. To identify all SOAP API usage, you shall:

  • Look into your inbox. Salesforce must have sent you an email a couple of months ago saying that they identified that your org has been accessed using SOAP API login().
  • Go to Login History and look for "Other Apex API", "Partner Product" or "SOAP API". If any of these are present, you can track back the user and then see which integration is using this older authentication method.
Setup | Login History
  • Finally, verify that all your AppExchange packages are updated and not using those older authentication methods. This is really easy to overlook, as you usually don't think of it.

To help you communicate with other teams, share with them that their code most likely looks something like this:

ConnectorConfig config = new ConnectorConfig();

config.setUsername("integration@example.com");
config.setPassword("passwordSECURITY_TOKEN");
config.setAuthEndpoint("https://YourDomainName.my.salesforce.com/services/Soap/c/41.0/");

The idea behind such integrations is simple. If your external application is accessing Salesforce with a username and password only — that's bad. It's either SOAP API login() or OAuth username-password, both of which are on their way out as we speak.

I'll keep you updated once we get Winter '27 in our sandboxes and whether my detective masterpiece is truthful.

Architects Developers Salesforce Updates