IMPORTANT: Salesforce has announced that in Summer 2027, it will retire the SOAP API call, login(). This action impacts Higher Logic accounts that are integrated with Salesforce.
Impact of this action
The login() call in SOAP API versions 31.0 through 64.0 will no longer be supported or available.
This applies to the API-enabled editions of Salesforce (Professional, Enterprise, Performance, Unlimited, and Developer) in Salesforce Classic and Salesforce Lightning Experience.
Required action
According to Salesforce, before Summer 2027, customers and partners must modify or upgrade the above-listed applications to use external client applications for authentication.
- For customers with Higher Logic Thrive Community (OC) integrations with Salesforce, follow the steps below.
- For customers with Higher Logic Thrive Marketing Professional (Informz) and/or Higher Logic Thrive Marketing Enterprise (Real Magnet), instructions on how to update the integration are coming soon; you will be contacted by our Integrations Support team in the near future.
For customers with Higher Logic Thrive Community (OC) ONLY (i.e. no additional Informz or Real Magnet instance tied to your Thrive account), please follow the steps below.
Steps
The external client app authentication between Salesforce and Higher Logic will make use of the OAuth 2.0 Client Credentials Flow. Each customer must configure an External Client App in Salesforce and share the credentials with Higher Logic. Higher Logic will use these credentials to obtain access tokens from the customer’s Salesforce org via the org’s /token endpoint using their My Domain URL.
Prerequisites
- A dedicated integration user with a Salesforce Platform license assigned (or a Standard License if Campaigns will be integrated).
- An External Client App is available in Salesforce.
- Salesforce My Domain is configured and deployed.
NOTE: Client Credentials Flow with Salesforce External Client Apps requires Salesforce My Domain. Without My Domain, token requests to the external client app endpoint will fail.
Customer-side Salesforce Configuration
1) Create or verify security policies
- Select Profiles → Use the profile specified for the integration user.
- Plugin Policies → Permitted Users: The Permitted Users setting determines which Salesforce users are allowed to authorize and access the Client App.
- Admin approved users are pre-authorized: Recommended for tighter access control, particularly for server-to-server API integrations or when the Client App is used for both API access and SSO. Salesforce administrators explicitly control which users can access the application. The dedicated API user and any users who require SSO access must be pre-authorized
- All users may self-authorize: Appropriate when the Client App is primarily used for user-based SSO and all eligible Salesforce users should be allowed to authorize the application without requiring an administrator to pre-authorize each user. This provides easier user onboarding but less administrative control over who can authorize the application
- OAuth Flows and External Client App Enhancements → Enable Client Credentials Flow → Run As (Username): Select the dedicated Salesforce integration user.
2) External Client App settings
- OAuth Start URL: https://<customer-primary-higher-logic-domain>
- Callback URL: https://<customer-primary-higher-logic-domain>
- If the same app will also be used for SSO
- OAuth: https://<customer-primary-higher-logic-domain>/HigherLogic/Security/OAUTH/Authentication.aspx
- OIDC: https://<customer-primary-higher-logic-domain>/HigherLogic/Security/OIDC/Authentication.aspx
- Selected OAuth Scopes: api
- If the same app also handles SSO, include openid and any additional scopes required by the customer’s configuration.
- For OIDC, the id_token must include the user’s 18-digit Salesforce Contact.Id.
- For OAuth 2.0 SSO, the /services/oauth2/userinfo endpoint must return the user’s 18-digit Salesforce Contact.Id.
- Enable Client Credentials Flow: checked
- If the same app will be used for SSO, Authorization Code flow must also be enabled.
3) Salesforce My Domain requirement
Salesforce requires a My Domain URL for External Client App authentication. Ensure My Domain is configured and active in the org running the integration.
After enabling My Domain, confirm the token endpoint is reachable at https://<MyDomain>.my.salesforce.com/services/oauth2/token or the applicable Salesforce domain for the customer’s region or edition.
Reference: Salesforce Help
4) Provide credentials to Higher Logic
- Consumer Key (client_id)
- Consumer Secret (client_secret)
- Optionally, the 15-digit Salesforce OrganizationId if the customer specifically wants it included in SOAP endpoint construction
IMPORTANT: Treat the Consumer Secret as a password. Do not send it through plaintext email or unsecured chat. Use an approved secure transfer method.
Reference links
Salesforce is the authoritative source for information on this action. Higher Logic provides the following links for convenience.