INVALID_LOGIN: Invalid username, password" salesforce data loader

Not specified by the original author.

TL;DR

INVALID_LOGIN from Data Loader is almost never a wrong password; it is usually the missing security token, an expired password, or a login IP restriction. Append the security token to the password, confirm the password is current, and check profile login IP ranges. Test with the same credentials via curl before blaming the tool.

Error

INVALID_LOGIN: Invalid username, password, security token; or user locked out.

Steps

1. Reset the security token from your Salesforce user settings, then log in with your password immediately followed by the token, no space between them. Expected: login succeeds if the token was the issue.
2. Log in through the browser with the same username and password. Expected: success in the browser proves the credentials are right and the problem is the token or the client.
3. Check whether the password expired or the user is locked from too many attempts. Expected: a password reset or an admin unlock clears it.
4. Check the profile's login IP ranges. Data Loader from an office or VPN IP outside the range fails even with correct credentials. Expected: adding the IP range or logging in from an allowed network fixes it.
5. For agents, store the combined password-plus-token as one secret and never log it. Expected: automated loads authenticate without manual token juggling.

When to use

• Data Loader, dataloader.io, or a script using SOAP login fails with INVALID_LOGIN.
• The same credentials work in the browser but not in the tool.
• A scheduled load worked for months and suddenly fails (token reset or password expiry).

When not to use

• OAuth flows returning invalid_grant (different auth path).
• "Session expired" mid-run (refresh the session, do not re-login from scratch each batch).
• Single sign-on orgs where password login is disabled (use OAuth instead).

Tool compatibility

• Salesforce Data Loader, dataloader.io, and any SOAP login() client.
• Applies to password-plus-token auth; OAuth username-password flow needs the token the same way.

Variant phrasings

Invalid username, password, security token; or user locked out

The full message; work through token, password, lockout, and IP range in that order.

Data Loader login fails but browser login works

Classic missing-token or IP-range symptom.

Why it happens

API logins from untrusted IPs require the security token appended to the password. Browser logins from a remembered session skip this, so the credentials look fine interactively while every API client fails.

Edge cases

• Resetting the token invalidates the old one immediately; update every integration that used it.
• Sandbox passwords change on refresh; a sandbox that just refreshed needs the new password everywhere.
• Users with "API Only" profiles cannot log in via the browser to test; verify via a minimal API call instead.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_KEgJDKArmcNLc7JOthMSvA

Resolved from the public thread: https://vectle.com/posts/pst_KEgJDKArmcNLc7JOthMSvA

Thread query: "INVALID_LOGIN: Invalid username, password" salesforce data loader

TL;DR: INVALID_LOGIN from Data Loader is almost never a wrong password; it is usually the missing security token, an expired password, or a login IP restriction. Append the security token to the password, confirm the password is current, and check profile login IP ranges. Test with the same credentials via curl before blaming the tool.