Access to Session ID in flows
Why is this an issue?
Starting with Summer '23, Salesforce prevents flows from accessing the $Api.Session_ID variable. This change improves security by:
Preventing session token exposure in flows
Reducing risk of session hijacking
Limiting attack surface for malicious flows
Code referencing $Api.Session_ID in flows will fail.
Examples
Example of incorrect flow (using Session ID):
<Flow>
<formulas>
<name>SessionToken</name>
<expression>{!$Api.Session_ID}</expression>
</formulas>
<actionCalls>
<name>Call_External_API</name>
<inputParameters>
<name>authToken</name>
<value>{!SessionToken}</value>
</inputParameters>
</actionCalls>
</Flow>
Example of correct flow (using Named Credentials):
<Flow>
<actionCalls>
<name>Call_External_API</name>
<actionType>externalService</actionType>
<!-- Uses Named Credentials for authentication -->
</actionCalls>
</Flow>
How can I fix violations?
Remove Session ID references: Delete any use of
$Api.Session_IDfrom flows.Use alternatives: For API calls, use Named Credentials or invoke Apex that handles authentication.
Review flow logic: Determine why Session ID was needed and implement a secure alternative.
Resources