I am trying to log in in mulesoft
With the User and I am reciving below Error in anypoint studio :
org.mule.runtime.api.connection.ConnectionException: Failed establishing connection with salesforce
org.mule.runtime.api.connection.ConnectionException: Failed establishing connection with salesforce
Caused by: Invalid status code: 400, response body: {"error":"invalid_grant","error_description":"authentication failure"}
In Salesforce log history :
Username-Password Flow Disabled
for Basic connection type is Working fine
Outh User Name password it throwing above Erros
#MuleSoft
Hi Intkhab — this isn't a credential problem, it's the flow itself being turned off. Salesforce has disabled the OAuth 2.0 Username-Password flow by default (blocked in new orgs, being switched off in existing ones), and it's fully retired in Winter '27 — after which grant_type=password stops returning tokens. That's exactly your "Username-Password Flow Disabled" log entry plus the invalid_grant / authentication failure, even though the username, password, and token are correct.
Why your "Basic Authentication" connection still works: that MuleSoft connection type uses the SOAP login (username + password + security token), which is a different mechanism from the OAuth username-password flow — so it's unaffected. You can keep using Basic Auth as an immediate unblock today if you need one.
The proper fix is to move the Salesforce connector to a server-to-server OAuth flow:
- OAuth 2.0 JWT Bearer (recommended for MuleSoft to Salesforce): create a Connected App / External Client App with "Use digital signatures" (upload a certificate), pre-authorize the app for the integration user's profile or permission set, then in the connector switch the connection to OAuth JWT Bearer and supply the consumer key, the username, and the private key/keystore. No password stored.
- OAuth Client Credentials is the other supported option — a connected app with client credentials enabled and a Run-As integration user.
In the Anypoint Salesforce connector you change the connection type from "Username Password" to "OAuth JWT Bearer" (or Client Credentials) and remove the stored password.
If you specifically need the old flow back short-term, an admin can check Setup - Identity - OAuth and OpenID Connect Settings for "Allow OAuth Username-Password Flows" — but that toggle is going away with the Winter '27 retirement, so treat it as a stopgap, not a fix. JWT Bearer is the durable path.
Ref: OAuth 2.0 JWT Bearer Flow for Server-to-Server Integration:
https://help.salesforce.com/s/articleView?id=sf.remoteaccess_oauth_jwt_flow.htm&type=5
