Salesforce offers multiple ways to authenticate API requests — but one question developers often ask is:

Can you use OAuth 2.0 with the Salesforce SOAP API?
Yes. Fully supported — and highly recommended.

This updated guide explains how OAuth 2.0 works with SOAP, how to implement it using External Client Apps (ECA) and the best practices for secure enterprise integrations.

Salesforce supports several authentication mechanisms:

• SOAP Login Call (legacy)

• OAuth 2.0 (recommended)

• SAML-based SSO

• JWT Assertion

• External Identity Providers

Among these, OAuth 2.0 is the most secure, scalable, and future-proof — and works for both SOAP and REST.

OAuth 2.0 is an industry-standard authorization framework that allows applications to authenticate without sharing passwords.

Key Features:

• Token-based access

• Strong, modern security

• User consent and granular permissions

• Works across mobile, web, and backend systems

Think of OAuth tokens like temporary, revocable access cards.
You never share your master key (password) — you share a safe, time-bound token.

Salesforce SOAP API is an XML-based, contract-driven API commonly used in:

• Enterprise systems

• Government systems

• Banking/financial integrations

• Legacy platforms

• Middleware tools

• Enforces strict schemas

• Predictable behavior

• Enterprise-friendly

• Long-term stability

With OAuth 2.0, SOAP becomes modern, secure, and scalable.

✔ YES — Completely supported.

Instead of using the legacy SOAP login() call, you authenticate via OAuth 2.0 and simply include the OAuth access token in your SOAP request header.

This modernizes SOAP integrations and eliminates passwords.

• Perform OAuth 2.0 authentication

• Salesforce issues an access token

• You pass that token in your SOAP SessionHeader

• Salesforce verifies the token and grants access

No username-password exchange.
No login() call.
Just secure OAuth tokens.

Salesforce supports several OAuth flows compatible with SOAP API:

1. Authorization Code Flow
   Best for interactive logins.

2. Username–Password Flow
   Simple but not secure — avoid for production.

3. JWT Bearer Token Flow (recommended)
   Ideal for server-to-server SOAP integrations.

To understand these flows deeper, see:
👉 Salesforce OAuth Flow Types

Go to:

Setup → App Manager → New External Client App

Configure:

• Enable OAuth

• Add Callback URL

• Select OAuth Scopes (API, Refresh Token)

Learn more:
👉 Salesforce External Client App

Use any OAuth flow:

• Authorization Code

• JWT Bearer

• Username–Password (not recommended)

You’ll receive:

• access_token

• instance_url

<soapenv:Header> <urn:SessionHeader> <urn:sessionId>YOUR_OAUTH_ACCESS_TOKEN</urn:sessionId> </urn:SessionHeader> </soapenv:Header>

Salesforce validates the token, scopes, and policies defined in the ECA.

If valid → Your SOAP call succeeds.

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:urn="urn:partner.soap.sforce.com"> <soapenv:Header> <urn:SessionHeader> <urn:sessionId>YOUR_OAUTH_ACCESS_TOKEN</urn:sessionId> </urn:SessionHeader> </soapenv:Header> <soapenv:Body> <urn:query> <urn:queryString>SELECT Id, Name FROM Account</urn:queryString> </urn:query> </soapenv:Body> </soapenv:Envelope>

• Prefer JWT Bearer Flow

• Use Refresh Tokens for automation

• Rotate Client Secrets

• Enforce ECA policies

• Never hardcode tokens

• Use Named Credentials

• Large enterprise ERP → Salesforce

• Banking/finance

• Government systems

• High-security industries

• Legacy middleware

SOAP provides structure; OAuth provides modern security.

• More setup compared to REST

• Token expiration

• SOAP libraries may need custom headers

So, can you use OAuth 2.0 with the Salesforce SOAP API?
✔ Absolutely YES — and you should.

OAuth modernizes authentication, eliminates password sharing, and strengthens enterprise security.

With the move to External Client Apps (ECA), OAuth is more powerful than ever.

Q1. Does Salesforce recommend OAuth 2.0 for SOAP?
Yes — OAuth is the preferred authentication method.

Q2. Can I still use the SOAP login() call?
Yes, but OAuth is more secure.

Q3. Which OAuth flow is best for server-to-server SOAP?
JWT Bearer Flow.

Q4. Can tokens be refreshed automatically?
Yes — using Refresh Tokens or JWT.

Q5. Do I need an External Client App (ECA)?
Yes — Connected Apps are being replaced.