I have long encountered a similar problem.
In my case, I did not immediately understand that I needed to use the .htaccess credentials when creating the SoapClient instance, but pass the SOAP API credentials for the login method.
I was passing SOAP API credentials around the world and getting a similar error like you.
Here's what worked for me (version 1.3.x, although it works for me today):
$cProxy = new SoapClient( URL . 'index.php/api/soap/?wsdl', array( 'login' => HTACCESS_USER, 'password' => HTACCESS_PASS ) ); $rSessionId = $cProxy->login( SOAP_USER, SOAP_PASS );
Just to play save, you don't fall into the trap of typos: you pass $GLOABLS["magento_api_password"] as the second parameter to the login method, which should be $GLOBALS["magento_api_password"] .
Finally, you pass the third argument to the login method, which, it seems to me, is deprecated since afaik, by its definition, has only two parameters:
<message name="login"> <part name="username" type="xsd:string" /> <part name="apiKey" type="xsd:string" /> </message>
source share