IMPORTANT: Salesforce has announced that in Summer 2027, it will retire the SOAP API call, login(). This action impacts Higher Logic accounts that are integrated with Salesforce.

Impact of this action

The login() call in SOAP API versions 31.0 through 64.0 will no longer be supported or available.

This applies to the API-enabled editions of Salesforce (Professional, Enterprise, Performance, Unlimited, and Developer) in Salesforce Classic and Salesforce Lightning Experience.

Required action

According to Salesforce, before Summer 2027, customers and partners must modify or upgrade the above-listed applications to use external client applications for authentication.

For customers with Higher Logic Thrive Community (OC) integrations with Salesforce, follow the steps below.
For customers with Higher Logic Thrive Marketing Professional (Informz) and/or Higher Logic Thrive Marketing Enterprise (Real Magnet), instructions on how to update the integration are coming soon; you will be contacted by our Integrations Support team in the near future.

For customers with Higher Logic Thrive Community (OC) ONLY (i.e. no additional Informz or Real Magnet instance tied to your Thrive account), please follow the steps below.

Steps

The external client app authentication between Salesforce and Higher Logic will make use of the OAuth 2.0 Client Credentials Flow. Each customer must configure an External Client App in Salesforce and share the credentials with Higher Logic. Higher Logic will use these credentials to obtain access tokens from the customer’s Salesforce org via the org’s /token endpoint using their My Domain URL.

Prerequisites

Salesforce “My Domain URL” configured and deployed

Client Credentials Flow with Salesforce’s External Client app requires Salesforce My Domain Name. Without it, token requests to External Client App endpoints will fail.

Customer-side (Salesforce) Configuration

1) Create/Verify Security Policies

Use or create a profile with permission to make API calls.
Configure the External Client App for OAuth 2.0 Client Credentials Flow (integration user policy).
Note: In some orgs, enable the flow under the External Client App’s Settings before it appears in Policies.
Plugin Policy: Optionally allow “Admin approved users are pre-authorized” (per customer decision and security posture).

2) External Client App Settings (OAuth)

OAuth Start URL: https://<customer-primary-higher-logic-domain>
Callback URL: https://<customer-primary-higher-logic-domain>. If the same External Client App will also be used for SSO, use the appropriate HL authentication endpoint:
- OAuth: https://<customer-primary-higher-logic-domain>/HigherLogic/Security/OAUTH/Authentication.aspx
- OIDC: https://<customer-primary-higher-logic-domain>/HigherLogic/Security/OIDC/Authentication.aspx
- The “<customer-primary-higher-logic-domain>” is discoverable in Admin à Pages à Sites à Domain Settings
  - In the “Domains” list, the primary domain will be the one with “(Tenant Primary Domain)” next to it in the list
Selected OAuth Scopes:
- api (Manage user data via APIs).
- If the same External Client App handles SSO, include openid (access unique user identifiers) and any additional scopes required by the customer’s configuration.
  - For OIDC, the id_token must include the user’s 18-digit SalesForce Contact.Id.
  - For OAuth 2.0, the /services/oauth2/userinfo endpoint must return the user’s 18-digit SalesForce Contact.Id.
Enable Client Credentials Flow: Checked — also verify the authorization flow settings if this External Client App will be used for SSO (OAuth/OIDC).

3) Salesforce’s My Domain URL requirement

Salesforce requires a My Domain URL for External Client App authentication. Ensure My Domain is configured and active in the org running the integration.

Reference: Salesforce Help

After enabling My Domain Name, confirm the token endpoint is reachable at: https://<MyDomain>.my.salesforce.com/services/oauth2/token (or the applicable Salesforce domain for your region/edition).

4) Provide Credentials to Higher Logic

Consumer Key (client_id)
Consumer Secret (client_secret)

IMPORTANT: Share these values securely. Treat the Consumer Secret as a password. Do not send via email in plaintext. These values should ONLY be shared with a member of the Higher Logic Integrations Support team via a ZenDesk ticket that makes use of the secure link/“SendSafely” link in the ZenDesk ticket. Alternately, you can make use of a secure channel approved by your organization.

Reference links

Salesforce is the authoritative source for information on this action. Higher Logic provides the following links for convenience.

Salesforce SOAP API Call Retirement: login()