SOAP API login() retirement in versions 31.0–64.0 (Summer '27) — how to inventory and migrate integrations to OAuth

Prerequisites:

• Salesforce admin access
• Login History access (Setup → Login History)
• Development or admin access to the affected integration applications

Tasks:

• Identify integrations using SOAP login() in retired API versions
• Plan the migration to OAuth 2.0 (Client Credentials or JWT Bearer)
• Implement and test the migration before Summer '27

Steps:
Step 1 — Identify affected integrations using Login History:

1. Go to Setup → Login History.
2. Filter by Login Type = API and API Version in the range 31.0–64.0.
3. Review the Username, Application, and Source IP columns to identify which integration users and applications are making SOAP login() calls.
4. Download the Login History report for a representative time window (e.g., the past 30 days) to share with your integration owners or developers.

Step 2 — Determine the OAuth migration path:
For unattended server-to-server integrations (no human user in the loop), choose one of:

• OAuth 2.0 Client Credentials Flow — The simplest SOAP login() replacement. The integration authenticates with a consumer key and secret tied to a "run-as" user. Recommended for most custom code and ETL integrations.
• OAuth 2.0 JWT Bearer Flow — Uses a signed certificate instead of a client secret. More secure for sensitive integrations; no secret to rotate.

Both flows return an OAuth access token that replaces the SOAP session ID in subsequent API calls. The underlying SOAP calls themselves do not need to change — only the authentication step changes.
Step 3 — Create an External Client App:

1. Go to Setup → External Client Apps and create a new app.
2. Select OAuth Settings and configure the appropriate OAuth flow.
3. Assign the app to the integration user.
4. Update the integration client to use the OAuth token endpoint and token exchange instead of SOAP login().

Step 4 — Validate and cut over before Summer '27:
Summer '26 introduces an optional "Use API Auth" user permission that lets you opt into the new behavior early for controlled testing. Use this to validate your migrated integrations before the mandatory cutover.