FAQ

What changes for SOAP login() on 2026-12-01?

SOAP login() will only succeed when the user has the Use Any API Auth permission. Integrations that relied on older login behavior without that permission fail after the date.

How do Login History and API Total Usage help find callers?

They surface who is still performing SOAP logins and which APIs are being used. Combined with code grep and vendor asks, they feed residue rows on this board.

What is Use Any API Auth and who needs it?

It is the permission Salesforce requires for SOAP login() after Dec 1. Integration users that continue SOAP login need it—or you migrate them off SOAP login entirely.

Should we migrate to External Client App + OAuth or only assign the permission?

Granting the permission can be a short bridge; preferred long-term path in inventory guidance is External Client App with OAuth (client credentials or JWT Bearer) so password-style SOAP login is retired.

How do broad IP and 6-month unused rules interact with this work?

They are adjacent platform security updates: broad IP ranges need security tokens on a separate timeline, and unused logins can be disabled after six months. Inventory owners should track all three so fixing SOAP login does not ignore IP/token gaps.

Does this board call Salesforce APIs or store org credentials?

No. You paste or type local notes only. We never connect to your orgs or ask for credentials.

Is this official Salesforce documentation?

No. Unofficial local helper. Not affiliated with Salesforce.

Do you store my inventory rows?

No. Rows exist only in the browser session until you copy Markdown out.