added wand for custom cron, fixed slack inconsistency

apps/docs/content/docs/en/tools/google_books.mdx

@@ -7,7 +7,7 @@ import { BlockInfoCard } from "@/components/ui/block-info-card"
 
 <BlockInfoCard 
   type="google_books"
-  color="#FFFFFF"
+  color="#E0E0E0"
 />
 
 ## Usage Instructions

apps/docs/content/docs/en/tools/s3.mdx

@@ -71,6 +71,7 @@ Retrieve an object from an AWS S3 bucket
 | --------- | ---- | -------- | ----------- |
 | `accessKeyId` | string | Yes | Your AWS Access Key ID |
 | `secretAccessKey` | string | Yes | Your AWS Secret Access Key |
+| `region` | string | No | Optional region override when URL does not include region \(e.g., us-east-1, eu-west-1\) |
 | `s3Uri` | string | Yes | S3 Object URL \(e.g., https://bucket.s3.region.amazonaws.com/path/to/file\) |
 
 #### Output

apps/docs/content/docs/en/tools/slack.mdx

@@ -79,7 +79,7 @@ Send messages to Slack channels or direct messages. Supports Slack mrkdwn format
 | `channel` | string | No | Slack channel ID \(e.g., C1234567890\) |
 | `dmUserId` | string | No | Slack user ID for direct messages \(e.g., U1234567890\) |
 | `text` | string | Yes | Message text to send \(supports Slack mrkdwn formatting\) |
-| `thread_ts` | string | No | Thread timestamp to reply to \(creates thread reply\) |
+| `threadTs` | string | No | Thread timestamp to reply to \(creates thread reply\) |
 | `files` | file[] | No | Files to attach to the message |
 
 #### Output

apps/sim/app/api/auth/accounts/route.ts

@@ -1,7 +1,7 @@
 import { db } from '@sim/db'
 import { account } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
-import { and, desc, eq } from 'drizzle-orm'
+import { and, eq } from 'drizzle-orm'
 import { type NextRequest, NextResponse } from 'next/server'
 import { getSession } from '@/lib/auth'
 
@@ -31,13 +31,15 @@ export async function GET(request: NextRequest) {
       })
       .from(account)
       .where(and(...whereConditions))
-      .orderBy(desc(account.updatedAt))
+
+    // Use the user's email as the display name (consistent with credential selector)
+    const userEmail = session.user.email
 
     const accountsWithDisplayName = accounts.map((acc) => ({
       id: acc.id,
       accountId: acc.accountId,
       providerId: acc.providerId,
-      displayName: acc.accountId || acc.providerId,
+      displayName: userEmail || acc.providerId,
     }))
 
     return NextResponse.json({ accounts: accountsWithDisplayName })

apps/sim/app/api/auth/oauth/credentials/route.ts

@@ -1,5 +1,5 @@
 import { db } from '@sim/db'
-import { account, credential, credentialMember, user } from '@sim/db/schema'
+import { account, user } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
 import { and, eq } from 'drizzle-orm'
 import { jwtDecode } from 'jwt-decode'
@@ -7,10 +7,8 @@ import { type NextRequest, NextResponse } from 'next/server'
 import { z } from 'zod'
 import { checkSessionOrInternalAuth } from '@/lib/auth/hybrid'
 import { generateRequestId } from '@/lib/core/utils/request'
-import { syncWorkspaceOAuthCredentialsForUser } from '@/lib/credentials/oauth'
 import { evaluateScopeCoverage, type OAuthProvider, parseProvider } from '@/lib/oauth'
 import { authorizeWorkflowByWorkspacePermission } from '@/lib/workflows/utils'
-import { checkWorkspaceAccess } from '@/lib/workspaces/permissions/utils'
 
 export const dynamic = 'force-dynamic'
 
@@ -20,7 +18,6 @@ const credentialsQuerySchema = z
   .object({
     provider: z.string().nullish(),
     workflowId: z.string().uuid('Workflow ID must be a valid UUID').nullish(),
-    workspaceId: z.string().uuid('Workspace ID must be a valid UUID').nullish(),
     credentialId: z
       .string()
       .min(1, 'Credential ID must not be empty')
@@ -38,79 +35,6 @@ interface GoogleIdToken {
   name?: string
 }
 
-function toCredentialResponse(
-  id: string,
-  displayName: string,
-  providerId: string,
-  updatedAt: Date,
-  scope: string | null
-) {
-  const storedScope = scope?.trim()
-  const grantedScopes = storedScope ? storedScope.split(/[\s,]+/).filter(Boolean) : []
-  const scopeEvaluation = evaluateScopeCoverage(providerId, grantedScopes)
-  const [_, featureType = 'default'] = providerId.split('-')
-
-  return {
-    id,
-    name: displayName,
-    provider: providerId,
-    lastUsed: updatedAt.toISOString(),
-    isDefault: featureType === 'default',
-    scopes: scopeEvaluation.grantedScopes,
-    canonicalScopes: scopeEvaluation.canonicalScopes,
-    missingScopes: scopeEvaluation.missingScopes,
-    extraScopes: scopeEvaluation.extraScopes,
-    requiresReauthorization: scopeEvaluation.requiresReauthorization,
-  }
-}
-
-async function getFallbackDisplayName(
-  requestId: string,
-  providerParam: string | null | undefined,
-  accountRow: {
-    idToken: string | null
-    accountId: string
-    userId: string
-  }
-) {
-  const providerForParse = (providerParam || 'google') as OAuthProvider
-  const { baseProvider } = parseProvider(providerForParse)
-
-  if (accountRow.idToken) {
-    try {
-      const decoded = jwtDecode<GoogleIdToken>(accountRow.idToken)
-      if (decoded.email) return decoded.email
-      if (decoded.name) return decoded.name
-    } catch (_error) {
-      logger.warn(`[${requestId}] Error decoding ID token`, {
-        accountId: accountRow.accountId,
-      })
-    }
-  }
-
-  if (baseProvider === 'github') {
-    return `${accountRow.accountId} (GitHub)`
-  }
-
-  try {
-    const userRecord = await db
-      .select({ email: user.email })
-      .from(user)
-      .where(eq(user.id, accountRow.userId))
-      .limit(1)
-
-    if (userRecord.length > 0) {
-      return userRecord[0].email
-    }
-  } catch (_error) {
-    logger.warn(`[${requestId}] Error fetching user email`, {
-      userId: accountRow.userId,
-    })
-  }
-
-  return `${accountRow.accountId} (${baseProvider})`
-}
-
 /**
  * Get credentials for a specific provider
  */
@@ -122,7 +46,6 @@ export async function GET(request: NextRequest) {
     const rawQuery = {
       provider: searchParams.get('provider'),
       workflowId: searchParams.get('workflowId'),
-      workspaceId: searchParams.get('workspaceId'),
       credentialId: searchParams.get('credentialId'),
     }
 
@@ -155,7 +78,7 @@ export async function GET(request: NextRequest) {
       )
     }
 
-    const { provider: providerParam, workflowId, workspaceId, credentialId } = parseResult.data
+    const { provider: providerParam, workflowId, credentialId } = parseResult.data
 
     // Authenticate requester (supports session and internal JWT)
     const authResult = await checkSessionOrInternalAuth(request)
@@ -165,7 +88,7 @@ export async function GET(request: NextRequest) {
     }
     const requesterUserId = authResult.userId
 
-    let effectiveWorkspaceId = workspaceId ?? undefined
+    const effectiveUserId = requesterUserId
     if (workflowId) {
       const workflowAuthorization = await authorizeWorkflowByWorkspacePermission({
         workflowId,
@@ -183,145 +106,101 @@ export async function GET(request: NextRequest) {
           { status: workflowAuthorization.status }
         )
       }
-      effectiveWorkspaceId = workflowAuthorization.workflow?.workspaceId || undefined
     }
 
-    if (effectiveWorkspaceId) {
-      const workspaceAccess = await checkWorkspaceAccess(effectiveWorkspaceId, requesterUserId)
-      if (!workspaceAccess.hasAccess) {
-        return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
-      }
-    }
+    // Parse the provider to get base provider and feature type (if provider is present)
+    const { baseProvider } = parseProvider((providerParam || 'google') as OAuthProvider)
 
     let accountsData
 
-    if (credentialId) {
-      const [platformCredential] = await db
-        .select({
-          id: credential.id,
-          workspaceId: credential.workspaceId,
-          type: credential.type,
-          displayName: credential.displayName,
-          providerId: credential.providerId,
-          accountId: credential.accountId,
-          accountProviderId: account.providerId,
-          accountScope: account.scope,
-          accountUpdatedAt: account.updatedAt,
-        })
-        .from(credential)
-        .leftJoin(account, eq(credential.accountId, account.id))
-        .where(eq(credential.id, credentialId))
-        .limit(1)
-
-      if (platformCredential) {
-        if (platformCredential.type !== 'oauth' || !platformCredential.accountId) {
-          return NextResponse.json({ credentials: [] }, { status: 200 })
-        }
-
-        if (workflowId) {
-          if (!effectiveWorkspaceId || platformCredential.workspaceId !== effectiveWorkspaceId) {
-            return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
-          }
-        } else {
-          const [membership] = await db
-            .select({ id: credentialMember.id })
-            .from(credentialMember)
-            .where(
-              and(
-                eq(credentialMember.credentialId, platformCredential.id),
-                eq(credentialMember.userId, requesterUserId),
-                eq(credentialMember.status, 'active')
-              )
-            )
-            .limit(1)
-
-          if (!membership) {
-            return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
-          }
-        }
-
-        if (!platformCredential.accountProviderId || !platformCredential.accountUpdatedAt) {
-          return NextResponse.json({ credentials: [] }, { status: 200 })
-        }
-
-        return NextResponse.json(
-          {
-            credentials: [
-              toCredentialResponse(
-                platformCredential.id,
-                platformCredential.displayName,
-                platformCredential.accountProviderId,
-                platformCredential.accountUpdatedAt,
-                platformCredential.accountScope
-              ),
-            ],
-          },
-          { status: 200 }
-        )
-      }
-    }
-
-    if (effectiveWorkspaceId && providerParam) {
-      await syncWorkspaceOAuthCredentialsForUser({
-        workspaceId: effectiveWorkspaceId,
-        userId: requesterUserId,
-      })
-
-      const credentialsData = await db
-        .select({
-          id: credential.id,
-          displayName: credential.displayName,
-          providerId: account.providerId,
-          scope: account.scope,
-          updatedAt: account.updatedAt,
-        })
-        .from(credential)
-        .innerJoin(account, eq(credential.accountId, account.id))
-        .innerJoin(
-          credentialMember,
-          and(
-            eq(credentialMember.credentialId, credential.id),
-            eq(credentialMember.userId, requesterUserId),
-            eq(credentialMember.status, 'active')
-          )
-        )
-        .where(
-          and(
-            eq(credential.workspaceId, effectiveWorkspaceId),
-            eq(credential.type, 'oauth'),
-            eq(account.providerId, providerParam)
-          )
-        )
-
-      return NextResponse.json(
-        {
-          credentials: credentialsData.map((row) =>
-            toCredentialResponse(row.id, row.displayName, row.providerId, row.updatedAt, row.scope)
-          ),
-        },
-        { status: 200 }
-      )
-    }
-
     if (credentialId && workflowId) {
+      // When both workflowId and credentialId are provided, fetch by ID only.
+      // Workspace authorization above already proves access; the credential
+      // may belong to another workspace member (e.g. for display name resolution).
       accountsData = await db.select().from(account).where(eq(account.id, credentialId))
     } else if (credentialId) {
       accountsData = await db
         .select()
         .from(account)
-        .where(and(eq(account.userId, requesterUserId), eq(account.id, credentialId)))
+        .where(and(eq(account.userId, effectiveUserId), eq(account.id, credentialId)))
     } else {
+      // Fetch all credentials for provider and effective user
       accountsData = await db
         .select()
         .from(account)
-        .where(and(eq(account.userId, requesterUserId), eq(account.providerId, providerParam!)))
+        .where(and(eq(account.userId, effectiveUserId), eq(account.providerId, providerParam!)))
     }
 
     // Transform accounts into credentials
     const credentials = await Promise.all(
       accountsData.map(async (acc) => {
-        const displayName = await getFallbackDisplayName(requestId, providerParam, acc)
-        return toCredentialResponse(acc.id, displayName, acc.providerId, acc.updatedAt, acc.scope)
+        // Extract the feature type from providerId (e.g., 'google-default' -> 'default')
+        const [_, featureType = 'default'] = acc.providerId.split('-')
+
+        // Try multiple methods to get a user-friendly display name
+        let displayName = ''
+
+        // Method 1: Try to extract email from ID token (works for Google, etc.)
+        if (acc.idToken) {
+          try {
+            const decoded = jwtDecode<GoogleIdToken>(acc.idToken)
+            if (decoded.email) {
+              displayName = decoded.email
+            } else if (decoded.name) {
+              displayName = decoded.name
+            }
+          } catch (_error) {
+            logger.warn(`[${requestId}] Error decoding ID token`, {
+              accountId: acc.id,
+            })
+          }
+        }
+
+        // Method 2: For GitHub, the accountId might be the username
+        if (!displayName && baseProvider === 'github') {
+          displayName = `${acc.accountId} (GitHub)`
+        }
+
+        // Method 3: Try to get the user's email from our database
+        if (!displayName) {
+          try {
+            const userRecord = await db
+              .select({ email: user.email })
+              .from(user)
+              .where(eq(user.id, acc.userId))
+              .limit(1)
+
+            if (userRecord.length > 0) {
+              displayName = userRecord[0].email
+            }
+          } catch (_error) {
+            logger.warn(`[${requestId}] Error fetching user email`, {
+              userId: acc.userId,
+            })
+          }
+        }
+
+        // Fallback: Use accountId with provider type as context
+        if (!displayName) {
+          displayName = `${acc.accountId} (${baseProvider})`
+        }
+
+        const storedScope = acc.scope?.trim()
+        const grantedScopes = storedScope ? storedScope.split(/[\s,]+/).filter(Boolean) : []
+        const scopeEvaluation = evaluateScopeCoverage(acc.providerId, grantedScopes)
+
+        return {
+          id: acc.id,
+          name: displayName,
+          provider: acc.providerId,
+          lastUsed: acc.updatedAt.toISOString(),
+          isDefault: featureType === 'default',
+          scopes: scopeEvaluation.grantedScopes,
+          canonicalScopes: scopeEvaluation.canonicalScopes,
+          missingScopes: scopeEvaluation.missingScopes,
+          extraScopes: scopeEvaluation.extraScopes,
+          requiresReauthorization: scopeEvaluation.requiresReauthorization,
+        }
       })
     )
 

apps/sim/app/api/auth/oauth/disconnect/route.ts

@@ -15,7 +15,6 @@ const logger = createLogger('OAuthDisconnectAPI')
 const disconnectSchema = z.object({
   provider: z.string({ required_error: 'Provider is required' }).min(1, 'Provider is required'),
   providerId: z.string().optional(),
-  accountId: z.string().optional(),
 })
 
 /**
@@ -51,20 +50,15 @@ export async function POST(request: NextRequest) {
       )
     }
 
-    const { provider, providerId, accountId } = parseResult.data
+    const { provider, providerId } = parseResult.data
 
     logger.info(`[${requestId}] Processing OAuth disconnect request`, {
       provider,
       hasProviderId: !!providerId,
     })
 
-    // If a specific account row ID is provided, delete that exact account
-    if (accountId) {
-      await db
-        .delete(account)
-        .where(and(eq(account.userId, session.user.id), eq(account.id, accountId)))
-    } else if (providerId) {
-      // If a specific providerId is provided, delete accounts for that provider ID
+    // If a specific providerId is provided, delete only that account
+    if (providerId) {
       await db
         .delete(account)
         .where(and(eq(account.userId, session.user.id), eq(account.providerId, providerId)))

apps/sim/app/api/auth/oauth/microsoft/file/route.ts

@@ -38,18 +38,13 @@ export async function GET(request: NextRequest) {
       return NextResponse.json({ error: authz.error || 'Unauthorized' }, { status })
     }
 
-    const resolvedCredentialId = authz.resolvedCredentialId || credentialId
-    const credential = await getCredential(
-      requestId,
-      resolvedCredentialId,
-      authz.credentialOwnerUserId
-    )
+    const credential = await getCredential(requestId, credentialId, authz.credentialOwnerUserId)
     if (!credential) {
       return NextResponse.json({ error: 'Credential not found' }, { status: 404 })
     }
 
     const accessToken = await refreshAccessTokenIfNeeded(
-      resolvedCredentialId,
+      credentialId,
       authz.credentialOwnerUserId,
       requestId
     )

apps/sim/app/api/auth/oauth/microsoft/files/route.ts

@@ -37,19 +37,14 @@ export async function GET(request: NextRequest) {
       return NextResponse.json({ error: authz.error || 'Unauthorized' }, { status })
     }
 
-    const resolvedCredentialId = authz.resolvedCredentialId || credentialId
-    const credential = await getCredential(
-      requestId,
-      resolvedCredentialId,
-      authz.credentialOwnerUserId
-    )
+    const credential = await getCredential(requestId, credentialId, authz.credentialOwnerUserId)
     if (!credential) {
       return NextResponse.json({ error: 'Credential not found' }, { status: 404 })
     }
 
     // Refresh access token if needed using the utility function
     const accessToken = await refreshAccessTokenIfNeeded(
-      resolvedCredentialId,
+      credentialId,
       authz.credentialOwnerUserId,
       requestId
     )

apps/sim/app/api/auth/oauth/token/route.test.ts

@@ -351,11 +351,10 @@ describe('OAuth Token API Routes', () => {
    */
   describe('GET handler', () => {
     it('should return access token successfully', async () => {
-      mockAuthorizeCredentialUse.mockResolvedValueOnce({
-        ok: true,
+      mockCheckSessionOrInternalAuth.mockResolvedValueOnce({
+        success: true,
         authType: 'session',
-        requesterUserId: 'test-user-id',
-        credentialOwnerUserId: 'test-user-id',
+        userId: 'test-user-id',
       })
       mockGetCredential.mockResolvedValueOnce({
         id: 'credential-id',
@@ -381,8 +380,8 @@ describe('OAuth Token API Routes', () => {
       expect(response.status).toBe(200)
       expect(data).toHaveProperty('accessToken', 'fresh-token')
 
-      expect(mockAuthorizeCredentialUse).toHaveBeenCalled()
-      expect(mockGetCredential).toHaveBeenCalled()
+      expect(mockCheckSessionOrInternalAuth).toHaveBeenCalled()
+      expect(mockGetCredential).toHaveBeenCalledWith(mockRequestId, 'credential-id', 'test-user-id')
       expect(mockRefreshTokenIfNeeded).toHaveBeenCalled()
     })
 
@@ -400,8 +399,8 @@ describe('OAuth Token API Routes', () => {
     })
 
     it('should handle authentication failure', async () => {
-      mockAuthorizeCredentialUse.mockResolvedValueOnce({
-        ok: false,
+      mockCheckSessionOrInternalAuth.mockResolvedValueOnce({
+        success: false,
         error: 'Authentication required',
       })
 
@@ -414,16 +413,15 @@ describe('OAuth Token API Routes', () => {
       const response = await GET(req as any)
       const data = await response.json()
 
-      expect(response.status).toBe(403)
+      expect(response.status).toBe(401)
       expect(data).toHaveProperty('error')
     })
 
     it('should handle credential not found', async () => {
-      mockAuthorizeCredentialUse.mockResolvedValueOnce({
-        ok: true,
+      mockCheckSessionOrInternalAuth.mockResolvedValueOnce({
+        success: true,
         authType: 'session',
-        requesterUserId: 'test-user-id',
-        credentialOwnerUserId: 'test-user-id',
+        userId: 'test-user-id',
       })
       mockGetCredential.mockResolvedValueOnce(undefined)
 
@@ -441,11 +439,10 @@ describe('OAuth Token API Routes', () => {
     })
 
     it('should handle missing access token', async () => {
-      mockAuthorizeCredentialUse.mockResolvedValueOnce({
-        ok: true,
+      mockCheckSessionOrInternalAuth.mockResolvedValueOnce({
+        success: true,
         authType: 'session',
-        requesterUserId: 'test-user-id',
-        credentialOwnerUserId: 'test-user-id',
+        userId: 'test-user-id',
       })
       mockGetCredential.mockResolvedValueOnce({
         id: 'credential-id',
@@ -468,11 +465,10 @@ describe('OAuth Token API Routes', () => {
     })
 
     it('should handle token refresh failure', async () => {
-      mockAuthorizeCredentialUse.mockResolvedValueOnce({
-        ok: true,
+      mockCheckSessionOrInternalAuth.mockResolvedValueOnce({
+        success: true,
         authType: 'session',
-        requesterUserId: 'test-user-id',
-        credentialOwnerUserId: 'test-user-id',
+        userId: 'test-user-id',
       })
       mockGetCredential.mockResolvedValueOnce({
         id: 'credential-id',

apps/sim/app/api/auth/oauth/token/route.ts

@@ -110,35 +110,23 @@ export async function POST(request: NextRequest) {
       return NextResponse.json({ error: 'Credential ID is required' }, { status: 400 })
     }
 
-    const callerUserId = new URL(request.url).searchParams.get('userId') || undefined
-
     const authz = await authorizeCredentialUse(request, {
       credentialId,
       workflowId: workflowId ?? undefined,
       requireWorkflowIdForInternal: false,
-      callerUserId,
     })
     if (!authz.ok || !authz.credentialOwnerUserId) {
       return NextResponse.json({ error: authz.error || 'Unauthorized' }, { status: 403 })
     }
 
-    const resolvedCredentialId = authz.resolvedCredentialId || credentialId
-    const credential = await getCredential(
-      requestId,
-      resolvedCredentialId,
-      authz.credentialOwnerUserId
-    )
+    const credential = await getCredential(requestId, credentialId, authz.credentialOwnerUserId)
 
     if (!credential) {
       return NextResponse.json({ error: 'Credential not found' }, { status: 404 })
     }
 
     try {
-      const { accessToken } = await refreshTokenIfNeeded(
-        requestId,
-        credential,
-        resolvedCredentialId
-      )
+      const { accessToken } = await refreshTokenIfNeeded(requestId, credential, credentialId)
 
       let instanceUrl: string | undefined
       if (credential.providerId === 'salesforce' && credential.scope) {
@@ -198,20 +186,13 @@ export async function GET(request: NextRequest) {
 
     const { credentialId } = parseResult.data
 
-    const authz = await authorizeCredentialUse(request, {
-      credentialId,
-      requireWorkflowIdForInternal: false,
-    })
-    if (!authz.ok || authz.authType !== 'session' || !authz.credentialOwnerUserId) {
-      return NextResponse.json({ error: authz.error || 'Unauthorized' }, { status: 403 })
+    // For GET requests, we only support session-based authentication
+    const auth = await checkSessionOrInternalAuth(request, { requireWorkflowId: false })
+    if (!auth.success || auth.authType !== 'session' || !auth.userId) {
+      return NextResponse.json({ error: 'User not authenticated' }, { status: 401 })
     }
 
-    const resolvedCredentialId = authz.resolvedCredentialId || credentialId
-    const credential = await getCredential(
-      requestId,
-      resolvedCredentialId,
-      authz.credentialOwnerUserId
-    )
+    const credential = await getCredential(requestId, credentialId, auth.userId)
 
     if (!credential) {
       return NextResponse.json({ error: 'Credential not found' }, { status: 404 })
@@ -223,11 +204,7 @@ export async function GET(request: NextRequest) {
     }
 
     try {
-      const { accessToken } = await refreshTokenIfNeeded(
-        requestId,
-        credential,
-        resolvedCredentialId
-      )
+      const { accessToken } = await refreshTokenIfNeeded(requestId, credential, credentialId)
 
       // For Salesforce, extract instanceUrl from the scope field
       let instanceUrl: string | undefined

apps/sim/app/api/auth/oauth/utils.test.ts

@@ -62,23 +62,21 @@ describe('OAuth Utils', () => {
 
   describe('getCredential', () => {
     it('should return credential when found', async () => {
-      const mockCredentialRow = { type: 'oauth', accountId: 'resolved-account-id' }
-      const mockAccountRow = { id: 'resolved-account-id', userId: 'test-user-id' }
-
-      mockSelectChain([mockCredentialRow])
-      mockSelectChain([mockAccountRow])
+      const mockCredential = { id: 'credential-id', userId: 'test-user-id' }
+      const { mockFrom, mockWhere, mockLimit } = mockSelectChain([mockCredential])
 
       const credential = await getCredential('request-id', 'credential-id', 'test-user-id')
 
-      expect(mockDb.select).toHaveBeenCalledTimes(2)
+      expect(mockDb.select).toHaveBeenCalled()
+      expect(mockFrom).toHaveBeenCalled()
+      expect(mockWhere).toHaveBeenCalled()
+      expect(mockLimit).toHaveBeenCalledWith(1)
 
-      expect(credential).toMatchObject(mockAccountRow)
-      expect(credential).toMatchObject({ resolvedCredentialId: 'resolved-account-id' })
+      expect(credential).toEqual(mockCredential)
     })
 
     it('should return undefined when credential is not found', async () => {
       mockSelectChain([])
-      mockSelectChain([])
 
       const credential = await getCredential('request-id', 'nonexistent-id', 'test-user-id')
 
@@ -160,17 +158,15 @@ describe('OAuth Utils', () => {
 
   describe('refreshAccessTokenIfNeeded', () => {
     it('should return valid access token without refresh if not expired', async () => {
-      const mockCredentialRow = { type: 'oauth', accountId: 'account-id' }
-      const mockAccountRow = {
-        id: 'account-id',
+      const mockCredential = {
+        id: 'credential-id',
         accessToken: 'valid-token',
         refreshToken: 'refresh-token',
         accessTokenExpiresAt: new Date(Date.now() + 3600 * 1000),
         providerId: 'google',
         userId: 'test-user-id',
       }
-      mockSelectChain([mockCredentialRow])
-      mockSelectChain([mockAccountRow])
+      mockSelectChain([mockCredential])
 
       const token = await refreshAccessTokenIfNeeded('credential-id', 'test-user-id', 'request-id')
 
@@ -179,17 +175,15 @@ describe('OAuth Utils', () => {
     })
 
     it('should refresh token when expired', async () => {
-      const mockCredentialRow = { type: 'oauth', accountId: 'account-id' }
-      const mockAccountRow = {
-        id: 'account-id',
+      const mockCredential = {
+        id: 'credential-id',
         accessToken: 'expired-token',
         refreshToken: 'refresh-token',
         accessTokenExpiresAt: new Date(Date.now() - 3600 * 1000),
         providerId: 'google',
         userId: 'test-user-id',
       }
-      mockSelectChain([mockCredentialRow])
-      mockSelectChain([mockAccountRow])
+      mockSelectChain([mockCredential])
       mockUpdateChain()
 
       mockRefreshOAuthToken.mockResolvedValueOnce({
@@ -207,7 +201,6 @@ describe('OAuth Utils', () => {
 
     it('should return null if credential not found', async () => {
       mockSelectChain([])
-      mockSelectChain([])
 
       const token = await refreshAccessTokenIfNeeded('nonexistent-id', 'test-user-id', 'request-id')
 
@@ -215,17 +208,15 @@ describe('OAuth Utils', () => {
     })
 
     it('should return null if refresh fails', async () => {
-      const mockCredentialRow = { type: 'oauth', accountId: 'account-id' }
-      const mockAccountRow = {
-        id: 'account-id',
+      const mockCredential = {
+        id: 'credential-id',
         accessToken: 'expired-token',
         refreshToken: 'refresh-token',
         accessTokenExpiresAt: new Date(Date.now() - 3600 * 1000),
         providerId: 'google',
         userId: 'test-user-id',
       }
-      mockSelectChain([mockCredentialRow])
-      mockSelectChain([mockAccountRow])
+      mockSelectChain([mockCredential])
 
       mockRefreshOAuthToken.mockResolvedValueOnce(null)
 

apps/sim/app/api/auth/oauth/utils.ts

@@ -1,5 +1,5 @@
 import { db } from '@sim/db'
-import { account, credential, credentialSetMember } from '@sim/db/schema'
+import { account, credentialSetMember } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
 import { and, desc, eq, inArray } from 'drizzle-orm'
 import { refreshOAuthToken } from '@/lib/oauth'
@@ -25,28 +25,6 @@ interface AccountInsertData {
   accessTokenExpiresAt?: Date
 }
 
-async function resolveOAuthAccountId(
-  credentialId: string
-): Promise<{ accountId: string; usedCredentialTable: boolean } | null> {
-  const [credentialRow] = await db
-    .select({
-      type: credential.type,
-      accountId: credential.accountId,
-    })
-    .from(credential)
-    .where(eq(credential.id, credentialId))
-    .limit(1)
-
-  if (credentialRow) {
-    if (credentialRow.type !== 'oauth' || !credentialRow.accountId) {
-      return null
-    }
-    return { accountId: credentialRow.accountId, usedCredentialTable: true }
-  }
-
-  return { accountId: credentialId, usedCredentialTable: false }
-}
-
 /**
  * Safely inserts an account record, handling duplicate constraint violations gracefully.
  * If a duplicate is detected (unique constraint violation), logs a warning and returns success.
@@ -74,16 +52,10 @@ export async function safeAccountInsert(
  * Get a credential by ID and verify it belongs to the user
  */
 export async function getCredential(requestId: string, credentialId: string, userId: string) {
-  const resolved = await resolveOAuthAccountId(credentialId)
-  if (!resolved) {
-    logger.warn(`[${requestId}] Credential is not an OAuth credential`)
-    return undefined
-  }
-
   const credentials = await db
     .select()
     .from(account)
-    .where(and(eq(account.id, resolved.accountId), eq(account.userId, userId)))
+    .where(and(eq(account.id, credentialId), eq(account.userId, userId)))
     .limit(1)
 
   if (!credentials.length) {
@@ -91,10 +63,7 @@ export async function getCredential(requestId: string, credentialId: string, use
     return undefined
   }
 
-  return {
-    ...credentials[0],
-    resolvedCredentialId: resolved.accountId,
-  }
+  return credentials[0]
 }
 
 export async function getOAuthToken(userId: string, providerId: string): Promise<string | null> {
@@ -269,9 +238,7 @@ export async function refreshAccessTokenIfNeeded(
       }
 
       // Update the token in the database
-      const resolvedCredentialId =
-        (credential as { resolvedCredentialId?: string }).resolvedCredentialId ?? credentialId
-      await db.update(account).set(updateData).where(eq(account.id, resolvedCredentialId))
+      await db.update(account).set(updateData).where(eq(account.id, credentialId))
 
       logger.info(`[${requestId}] Successfully refreshed access token for credential`)
       return refreshedToken.accessToken
@@ -307,8 +274,6 @@ export async function refreshTokenIfNeeded(
   credential: any,
   credentialId: string
 ): Promise<{ accessToken: string; refreshed: boolean }> {
-  const resolvedCredentialId = credential.resolvedCredentialId ?? credentialId
-
   // Decide if we should refresh: token missing OR expired
   const accessTokenExpiresAt = credential.accessTokenExpiresAt
   const refreshTokenExpiresAt = credential.refreshTokenExpiresAt
@@ -369,7 +334,7 @@ export async function refreshTokenIfNeeded(
       updateData.refreshTokenExpiresAt = getMicrosoftRefreshTokenExpiry()
     }
 
-    await db.update(account).set(updateData).where(eq(account.id, resolvedCredentialId))
+    await db.update(account).set(updateData).where(eq(account.id, credentialId))
 
     logger.info(`[${requestId}] Successfully refreshed access token`)
     return { accessToken: refreshedToken, refreshed: true }
@@ -378,7 +343,7 @@ export async function refreshTokenIfNeeded(
       `[${requestId}] Refresh attempt failed, checking if another concurrent request succeeded`
     )
 
-    const freshCredential = await getCredential(requestId, resolvedCredentialId, credential.userId)
+    const freshCredential = await getCredential(requestId, credentialId, credential.userId)
     if (freshCredential?.accessToken) {
       const freshExpiresAt = freshCredential.accessTokenExpiresAt
       const stillValid = !freshExpiresAt || freshExpiresAt > new Date()

apps/sim/app/api/auth/oauth2/shopify/store/route.ts

@@ -48,21 +48,16 @@ export async function GET(request: NextRequest) {
 
     const shopData = await shopResponse.json()
     const shopInfo = shopData.shop
-    const stableAccountId = shopInfo.id?.toString() || shopDomain
 
     const existing = await db.query.account.findFirst({
-      where: and(
-        eq(account.userId, session.user.id),
-        eq(account.providerId, 'shopify'),
-        eq(account.accountId, stableAccountId)
-      ),
+      where: and(eq(account.userId, session.user.id), eq(account.providerId, 'shopify')),
     })
 
     const now = new Date()
 
     const accountData = {
       accessToken: accessToken,
-      accountId: stableAccountId,
+      accountId: shopInfo.id?.toString() || shopDomain,
       scope: scope || '',
       updatedAt: now,
       idToken: shopDomain,

apps/sim/app/api/auth/trello/store/route.ts

@@ -52,11 +52,7 @@ export async function POST(request: NextRequest) {
     const trelloUser = await userResponse.json()
 
     const existing = await db.query.account.findFirst({
-      where: and(
-        eq(account.userId, session.user.id),
-        eq(account.providerId, 'trello'),
-        eq(account.accountId, trelloUser.id)
-      ),
+      where: and(eq(account.userId, session.user.id), eq(account.providerId, 'trello')),
     })
 
     const now = new Date()

apps/sim/app/api/credentials/[id]/members/route.ts

@@ -1,197 +0,0 @@
-import { db } from '@sim/db'
-import { credential, credentialMember, user } from '@sim/db/schema'
-import { createLogger } from '@sim/logger'
-import { and, eq } from 'drizzle-orm'
-import { type NextRequest, NextResponse } from 'next/server'
-import { z } from 'zod'
-import { getSession } from '@/lib/auth'
-
-const logger = createLogger('CredentialMembersAPI')
-
-interface RouteContext {
-  params: Promise<{ id: string }>
-}
-
-async function requireAdminMembership(credentialId: string, userId: string) {
-  const [membership] = await db
-    .select({ role: credentialMember.role, status: credentialMember.status })
-    .from(credentialMember)
-    .where(
-      and(eq(credentialMember.credentialId, credentialId), eq(credentialMember.userId, userId))
-    )
-    .limit(1)
-
-  if (!membership || membership.status !== 'active' || membership.role !== 'admin') {
-    return null
-  }
-  return membership
-}
-
-export async function GET(_request: NextRequest, context: RouteContext) {
-  try {
-    const session = await getSession()
-    if (!session?.user?.id) {
-      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
-    }
-
-    const { id: credentialId } = await context.params
-
-    const [cred] = await db
-      .select({ id: credential.id })
-      .from(credential)
-      .where(eq(credential.id, credentialId))
-      .limit(1)
-
-    if (!cred) {
-      return NextResponse.json({ members: [] }, { status: 200 })
-    }
-
-    const members = await db
-      .select({
-        id: credentialMember.id,
-        userId: credentialMember.userId,
-        role: credentialMember.role,
-        status: credentialMember.status,
-        joinedAt: credentialMember.joinedAt,
-        userName: user.name,
-        userEmail: user.email,
-      })
-      .from(credentialMember)
-      .innerJoin(user, eq(credentialMember.userId, user.id))
-      .where(eq(credentialMember.credentialId, credentialId))
-
-    return NextResponse.json({ members })
-  } catch (error) {
-    logger.error('Failed to fetch credential members', { error })
-    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })
-  }
-}
-
-const addMemberSchema = z.object({
-  userId: z.string().min(1),
-  role: z.enum(['admin', 'member']).default('member'),
-})
-
-export async function POST(request: NextRequest, context: RouteContext) {
-  try {
-    const session = await getSession()
-    if (!session?.user?.id) {
-      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
-    }
-
-    const { id: credentialId } = await context.params
-
-    const admin = await requireAdminMembership(credentialId, session.user.id)
-    if (!admin) {
-      return NextResponse.json({ error: 'Admin access required' }, { status: 403 })
-    }
-
-    const body = await request.json()
-    const parsed = addMemberSchema.safeParse(body)
-    if (!parsed.success) {
-      return NextResponse.json({ error: 'Invalid request body' }, { status: 400 })
-    }
-
-    const { userId, role } = parsed.data
-    const now = new Date()
-
-    const [existing] = await db
-      .select({ id: credentialMember.id, status: credentialMember.status })
-      .from(credentialMember)
-      .where(
-        and(eq(credentialMember.credentialId, credentialId), eq(credentialMember.userId, userId))
-      )
-      .limit(1)
-
-    if (existing) {
-      await db
-        .update(credentialMember)
-        .set({ role, status: 'active', updatedAt: now })
-        .where(eq(credentialMember.id, existing.id))
-      return NextResponse.json({ success: true })
-    }
-
-    await db.insert(credentialMember).values({
-      id: crypto.randomUUID(),
-      credentialId,
-      userId,
-      role,
-      status: 'active',
-      joinedAt: now,
-      invitedBy: session.user.id,
-      createdAt: now,
-      updatedAt: now,
-    })
-
-    return NextResponse.json({ success: true }, { status: 201 })
-  } catch (error) {
-    logger.error('Failed to add credential member', { error })
-    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })
-  }
-}
-
-export async function DELETE(request: NextRequest, context: RouteContext) {
-  try {
-    const session = await getSession()
-    if (!session?.user?.id) {
-      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
-    }
-
-    const { id: credentialId } = await context.params
-    const targetUserId = new URL(request.url).searchParams.get('userId')
-    if (!targetUserId) {
-      return NextResponse.json({ error: 'userId query parameter required' }, { status: 400 })
-    }
-
-    const admin = await requireAdminMembership(credentialId, session.user.id)
-    if (!admin) {
-      return NextResponse.json({ error: 'Admin access required' }, { status: 403 })
-    }
-
-    const [target] = await db
-      .select({
-        id: credentialMember.id,
-        role: credentialMember.role,
-        status: credentialMember.status,
-      })
-      .from(credentialMember)
-      .where(
-        and(
-          eq(credentialMember.credentialId, credentialId),
-          eq(credentialMember.userId, targetUserId)
-        )
-      )
-      .limit(1)
-
-    if (!target) {
-      return NextResponse.json({ error: 'Member not found' }, { status: 404 })
-    }
-
-    if (target.role === 'admin') {
-      const activeAdmins = await db
-        .select({ id: credentialMember.id })
-        .from(credentialMember)
-        .where(
-          and(
-            eq(credentialMember.credentialId, credentialId),
-            eq(credentialMember.role, 'admin'),
-            eq(credentialMember.status, 'active')
-          )
-        )
-
-      if (activeAdmins.length <= 1) {
-        return NextResponse.json({ error: 'Cannot remove the last admin' }, { status: 400 })
-      }
-    }
-
-    await db
-      .update(credentialMember)
-      .set({ status: 'revoked', updatedAt: new Date() })
-      .where(eq(credentialMember.id, target.id))
-
-    return NextResponse.json({ success: true })
-  } catch (error) {
-    logger.error('Failed to remove credential member', { error })
-    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })
-  }
-}

apps/sim/app/api/credentials/[id]/route.ts

@@ -1,258 +0,0 @@
-import { db } from '@sim/db'
-import { credential, credentialMember, environment, workspaceEnvironment } from '@sim/db/schema'
-import { createLogger } from '@sim/logger'
-import { and, eq } from 'drizzle-orm'
-import { type NextRequest, NextResponse } from 'next/server'
-import { z } from 'zod'
-import { getSession } from '@/lib/auth'
-import { getCredentialActorContext } from '@/lib/credentials/access'
-import {
-  syncPersonalEnvCredentialsForUser,
-  syncWorkspaceEnvCredentials,
-} from '@/lib/credentials/environment'
-
-const logger = createLogger('CredentialByIdAPI')
-
-const updateCredentialSchema = z
-  .object({
-    displayName: z.string().trim().min(1).max(255).optional(),
-    description: z.string().trim().max(500).nullish(),
-    accountId: z.string().trim().min(1).optional(),
-  })
-  .strict()
-  .refine(
-    (data) =>
-      data.displayName !== undefined ||
-      data.description !== undefined ||
-      data.accountId !== undefined,
-    {
-      message: 'At least one field must be provided',
-      path: ['displayName'],
-    }
-  )
-
-async function getCredentialResponse(credentialId: string, userId: string) {
-  const [row] = await db
-    .select({
-      id: credential.id,
-      workspaceId: credential.workspaceId,
-      type: credential.type,
-      displayName: credential.displayName,
-      description: credential.description,
-      providerId: credential.providerId,
-      accountId: credential.accountId,
-      envKey: credential.envKey,
-      envOwnerUserId: credential.envOwnerUserId,
-      createdBy: credential.createdBy,
-      createdAt: credential.createdAt,
-      updatedAt: credential.updatedAt,
-      role: credentialMember.role,
-      status: credentialMember.status,
-    })
-    .from(credential)
-    .innerJoin(
-      credentialMember,
-      and(eq(credentialMember.credentialId, credential.id), eq(credentialMember.userId, userId))
-    )
-    .where(eq(credential.id, credentialId))
-    .limit(1)
-
-  return row ?? null
-}
-
-export async function GET(request: NextRequest, { params }: { params: Promise<{ id: string }> }) {
-  const session = await getSession()
-  if (!session?.user?.id) {
-    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
-  }
-
-  const { id } = await params
-
-  try {
-    const access = await getCredentialActorContext(id, session.user.id)
-    if (!access.credential) {
-      return NextResponse.json({ error: 'Credential not found' }, { status: 404 })
-    }
-    if (!access.hasWorkspaceAccess || !access.member) {
-      return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
-    }
-
-    const row = await getCredentialResponse(id, session.user.id)
-    return NextResponse.json({ credential: row }, { status: 200 })
-  } catch (error) {
-    logger.error('Failed to fetch credential', error)
-    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })
-  }
-}
-
-export async function PUT(request: NextRequest, { params }: { params: Promise<{ id: string }> }) {
-  const session = await getSession()
-  if (!session?.user?.id) {
-    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
-  }
-
-  const { id } = await params
-
-  try {
-    const parseResult = updateCredentialSchema.safeParse(await request.json())
-    if (!parseResult.success) {
-      return NextResponse.json({ error: parseResult.error.errors[0]?.message }, { status: 400 })
-    }
-
-    const access = await getCredentialActorContext(id, session.user.id)
-    if (!access.credential) {
-      return NextResponse.json({ error: 'Credential not found' }, { status: 404 })
-    }
-    if (!access.hasWorkspaceAccess || !access.isAdmin) {
-      return NextResponse.json({ error: 'Credential admin permission required' }, { status: 403 })
-    }
-
-    const updates: Record<string, unknown> = {}
-
-    if (parseResult.data.description !== undefined) {
-      updates.description = parseResult.data.description ?? null
-    }
-
-    if (parseResult.data.displayName !== undefined && access.credential.type === 'oauth') {
-      updates.displayName = parseResult.data.displayName
-    }
-
-    if (Object.keys(updates).length === 0) {
-      if (access.credential.type === 'oauth') {
-        return NextResponse.json(
-          {
-            error: 'No updatable fields provided.',
-          },
-          { status: 400 }
-        )
-      }
-      return NextResponse.json(
-        {
-          error:
-            'Environment credentials cannot be updated via this endpoint. Use the environment value editor in credentials settings.',
-        },
-        { status: 400 }
-      )
-    }
-
-    updates.updatedAt = new Date()
-    await db.update(credential).set(updates).where(eq(credential.id, id))
-
-    const row = await getCredentialResponse(id, session.user.id)
-    return NextResponse.json({ credential: row }, { status: 200 })
-  } catch (error) {
-    logger.error('Failed to update credential', error)
-    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })
-  }
-}
-
-export async function DELETE(
-  request: NextRequest,
-  { params }: { params: Promise<{ id: string }> }
-) {
-  const session = await getSession()
-  if (!session?.user?.id) {
-    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
-  }
-
-  const { id } = await params
-
-  try {
-    const access = await getCredentialActorContext(id, session.user.id)
-    if (!access.credential) {
-      return NextResponse.json({ error: 'Credential not found' }, { status: 404 })
-    }
-    if (!access.hasWorkspaceAccess || !access.isAdmin) {
-      return NextResponse.json({ error: 'Credential admin permission required' }, { status: 403 })
-    }
-
-    if (access.credential.type === 'env_personal' && access.credential.envKey) {
-      const ownerUserId = access.credential.envOwnerUserId
-      if (!ownerUserId) {
-        return NextResponse.json({ error: 'Invalid personal secret owner' }, { status: 400 })
-      }
-
-      const [personalRow] = await db
-        .select({ variables: environment.variables })
-        .from(environment)
-        .where(eq(environment.userId, ownerUserId))
-        .limit(1)
-
-      const current = ((personalRow?.variables as Record<string, string> | null) ?? {}) as Record<
-        string,
-        string
-      >
-      if (access.credential.envKey in current) {
-        delete current[access.credential.envKey]
-      }
-
-      await db
-        .insert(environment)
-        .values({
-          id: ownerUserId,
-          userId: ownerUserId,
-          variables: current,
-          updatedAt: new Date(),
-        })
-        .onConflictDoUpdate({
-          target: [environment.userId],
-          set: { variables: current, updatedAt: new Date() },
-        })
-
-      await syncPersonalEnvCredentialsForUser({
-        userId: ownerUserId,
-        envKeys: Object.keys(current),
-      })
-
-      return NextResponse.json({ success: true }, { status: 200 })
-    }
-
-    if (access.credential.type === 'env_workspace' && access.credential.envKey) {
-      const [workspaceRow] = await db
-        .select({
-          id: workspaceEnvironment.id,
-          createdAt: workspaceEnvironment.createdAt,
-          variables: workspaceEnvironment.variables,
-        })
-        .from(workspaceEnvironment)
-        .where(eq(workspaceEnvironment.workspaceId, access.credential.workspaceId))
-        .limit(1)
-
-      const current = ((workspaceRow?.variables as Record<string, string> | null) ?? {}) as Record<
-        string,
-        string
-      >
-      if (access.credential.envKey in current) {
-        delete current[access.credential.envKey]
-      }
-
-      await db
-        .insert(workspaceEnvironment)
-        .values({
-          id: workspaceRow?.id || crypto.randomUUID(),
-          workspaceId: access.credential.workspaceId,
-          variables: current,
-          createdAt: workspaceRow?.createdAt || new Date(),
-          updatedAt: new Date(),
-        })
-        .onConflictDoUpdate({
-          target: [workspaceEnvironment.workspaceId],
-          set: { variables: current, updatedAt: new Date() },
-        })
-
-      await syncWorkspaceEnvCredentials({
-        workspaceId: access.credential.workspaceId,
-        envKeys: Object.keys(current),
-        actingUserId: session.user.id,
-      })
-
-      return NextResponse.json({ success: true }, { status: 200 })
-    }
-
-    await db.delete(credential).where(eq(credential.id, id))
-    return NextResponse.json({ success: true }, { status: 200 })
-  } catch (error) {
-    logger.error('Failed to delete credential', error)
-    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })
-  }
-}

apps/sim/app/api/credentials/draft/route.ts

@@ -1,85 +0,0 @@
-import { db } from '@sim/db'
-import { pendingCredentialDraft } from '@sim/db/schema'
-import { createLogger } from '@sim/logger'
-import { and, eq, lt } from 'drizzle-orm'
-import { NextResponse } from 'next/server'
-import { z } from 'zod'
-import { getSession } from '@/lib/auth'
-
-const logger = createLogger('CredentialDraftAPI')
-
-const DRAFT_TTL_MS = 15 * 60 * 1000
-
-const createDraftSchema = z.object({
-  workspaceId: z.string().min(1),
-  providerId: z.string().min(1),
-  displayName: z.string().min(1),
-  description: z.string().trim().max(500).optional(),
-  credentialId: z.string().min(1).optional(),
-})
-
-export async function POST(request: Request) {
-  try {
-    const session = await getSession()
-    if (!session?.user?.id) {
-      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
-    }
-
-    const body = await request.json()
-    const parsed = createDraftSchema.safeParse(body)
-    if (!parsed.success) {
-      return NextResponse.json({ error: 'Invalid request body' }, { status: 400 })
-    }
-
-    const { workspaceId, providerId, displayName, description, credentialId } = parsed.data
-    const userId = session.user.id
-    const now = new Date()
-
-    await db
-      .delete(pendingCredentialDraft)
-      .where(
-        and(eq(pendingCredentialDraft.userId, userId), lt(pendingCredentialDraft.expiresAt, now))
-      )
-
-    await db
-      .insert(pendingCredentialDraft)
-      .values({
-        id: crypto.randomUUID(),
-        userId,
-        workspaceId,
-        providerId,
-        displayName,
-        description: description || null,
-        credentialId: credentialId || null,
-        expiresAt: new Date(now.getTime() + DRAFT_TTL_MS),
-        createdAt: now,
-      })
-      .onConflictDoUpdate({
-        target: [
-          pendingCredentialDraft.userId,
-          pendingCredentialDraft.providerId,
-          pendingCredentialDraft.workspaceId,
-        ],
-        set: {
-          displayName,
-          description: description || null,
-          credentialId: credentialId || null,
-          expiresAt: new Date(now.getTime() + DRAFT_TTL_MS),
-          createdAt: now,
-        },
-      })
-
-    logger.info('Credential draft saved', {
-      userId,
-      workspaceId,
-      providerId,
-      displayName,
-      credentialId: credentialId || null,
-    })
-
-    return NextResponse.json({ success: true }, { status: 200 })
-  } catch (error) {
-    logger.error('Failed to save credential draft', { error })
-    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })
-  }
-}

apps/sim/app/api/credentials/memberships/route.ts

@@ -1,112 +0,0 @@
-import { db } from '@sim/db'
-import { credential, credentialMember } from '@sim/db/schema'
-import { createLogger } from '@sim/logger'
-import { and, eq } from 'drizzle-orm'
-import { type NextRequest, NextResponse } from 'next/server'
-import { z } from 'zod'
-import { getSession } from '@/lib/auth'
-
-const logger = createLogger('CredentialMembershipsAPI')
-
-const leaveCredentialSchema = z.object({
-  credentialId: z.string().min(1),
-})
-
-export async function GET() {
-  const session = await getSession()
-  if (!session?.user?.id) {
-    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
-  }
-
-  try {
-    const memberships = await db
-      .select({
-        membershipId: credentialMember.id,
-        credentialId: credential.id,
-        workspaceId: credential.workspaceId,
-        type: credential.type,
-        displayName: credential.displayName,
-        providerId: credential.providerId,
-        role: credentialMember.role,
-        status: credentialMember.status,
-        joinedAt: credentialMember.joinedAt,
-      })
-      .from(credentialMember)
-      .innerJoin(credential, eq(credentialMember.credentialId, credential.id))
-      .where(eq(credentialMember.userId, session.user.id))
-
-    return NextResponse.json({ memberships }, { status: 200 })
-  } catch (error) {
-    logger.error('Failed to list credential memberships', error)
-    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })
-  }
-}
-
-export async function DELETE(request: NextRequest) {
-  const session = await getSession()
-  if (!session?.user?.id) {
-    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
-  }
-
-  try {
-    const parseResult = leaveCredentialSchema.safeParse({
-      credentialId: new URL(request.url).searchParams.get('credentialId'),
-    })
-    if (!parseResult.success) {
-      return NextResponse.json({ error: parseResult.error.errors[0]?.message }, { status: 400 })
-    }
-
-    const { credentialId } = parseResult.data
-    const [membership] = await db
-      .select()
-      .from(credentialMember)
-      .where(
-        and(
-          eq(credentialMember.credentialId, credentialId),
-          eq(credentialMember.userId, session.user.id)
-        )
-      )
-      .limit(1)
-
-    if (!membership) {
-      return NextResponse.json({ error: 'Membership not found' }, { status: 404 })
-    }
-
-    if (membership.status !== 'active') {
-      return NextResponse.json({ success: true }, { status: 200 })
-    }
-
-    if (membership.role === 'admin') {
-      const activeAdmins = await db
-        .select({ id: credentialMember.id })
-        .from(credentialMember)
-        .where(
-          and(
-            eq(credentialMember.credentialId, credentialId),
-            eq(credentialMember.role, 'admin'),
-            eq(credentialMember.status, 'active')
-          )
-        )
-
-      if (activeAdmins.length <= 1) {
-        return NextResponse.json(
-          { error: 'Cannot leave credential as the last active admin' },
-          { status: 400 }
-        )
-      }
-    }
-
-    await db
-      .update(credentialMember)
-      .set({
-        status: 'revoked',
-        updatedAt: new Date(),
-      })
-      .where(eq(credentialMember.id, membership.id))
-
-    return NextResponse.json({ success: true }, { status: 200 })
-  } catch (error) {
-    logger.error('Failed to leave credential', error)
-    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })
-  }
-}

apps/sim/app/api/credentials/route.ts

@@ -1,521 +0,0 @@
-import { db } from '@sim/db'
-import { account, credential, credentialMember, workspace } from '@sim/db/schema'
-import { createLogger } from '@sim/logger'
-import { and, eq } from 'drizzle-orm'
-import { type NextRequest, NextResponse } from 'next/server'
-import { z } from 'zod'
-import { getSession } from '@/lib/auth'
-import { generateRequestId } from '@/lib/core/utils/request'
-import { getWorkspaceMemberUserIds } from '@/lib/credentials/environment'
-import { syncWorkspaceOAuthCredentialsForUser } from '@/lib/credentials/oauth'
-import { getServiceConfigByProviderId } from '@/lib/oauth'
-import { checkWorkspaceAccess } from '@/lib/workspaces/permissions/utils'
-import { isValidEnvVarName } from '@/executor/constants'
-
-const logger = createLogger('CredentialsAPI')
-
-const credentialTypeSchema = z.enum(['oauth', 'env_workspace', 'env_personal'])
-
-function normalizeEnvKeyInput(raw: string): string {
-  const trimmed = raw.trim()
-  const wrappedMatch = /^\{\{\s*([A-Za-z0-9_]+)\s*\}\}$/.exec(trimmed)
-  return wrappedMatch ? wrappedMatch[1] : trimmed
-}
-
-const listCredentialsSchema = z.object({
-  workspaceId: z.string().uuid('Workspace ID must be a valid UUID'),
-  type: credentialTypeSchema.optional(),
-  providerId: z.string().optional(),
-  credentialId: z.string().optional(),
-})
-
-const createCredentialSchema = z
-  .object({
-    workspaceId: z.string().uuid('Workspace ID must be a valid UUID'),
-    type: credentialTypeSchema,
-    displayName: z.string().trim().min(1).max(255).optional(),
-    description: z.string().trim().max(500).optional(),
-    providerId: z.string().trim().min(1).optional(),
-    accountId: z.string().trim().min(1).optional(),
-    envKey: z.string().trim().min(1).optional(),
-    envOwnerUserId: z.string().trim().min(1).optional(),
-  })
-  .superRefine((data, ctx) => {
-    if (data.type === 'oauth') {
-      if (!data.accountId) {
-        ctx.addIssue({
-          code: z.ZodIssueCode.custom,
-          message: 'accountId is required for oauth credentials',
-          path: ['accountId'],
-        })
-      }
-      if (!data.providerId) {
-        ctx.addIssue({
-          code: z.ZodIssueCode.custom,
-          message: 'providerId is required for oauth credentials',
-          path: ['providerId'],
-        })
-      }
-      if (!data.displayName) {
-        ctx.addIssue({
-          code: z.ZodIssueCode.custom,
-          message: 'displayName is required for oauth credentials',
-          path: ['displayName'],
-        })
-      }
-      return
-    }
-
-    const normalizedEnvKey = data.envKey ? normalizeEnvKeyInput(data.envKey) : ''
-    if (!normalizedEnvKey) {
-      ctx.addIssue({
-        code: z.ZodIssueCode.custom,
-        message: 'envKey is required for env credentials',
-        path: ['envKey'],
-      })
-      return
-    }
-
-    if (!isValidEnvVarName(normalizedEnvKey)) {
-      ctx.addIssue({
-        code: z.ZodIssueCode.custom,
-        message: 'envKey must contain only letters, numbers, and underscores',
-        path: ['envKey'],
-      })
-    }
-  })
-
-interface ExistingCredentialSourceParams {
-  workspaceId: string
-  type: 'oauth' | 'env_workspace' | 'env_personal'
-  accountId?: string | null
-  envKey?: string | null
-  envOwnerUserId?: string | null
-}
-
-async function findExistingCredentialBySource(params: ExistingCredentialSourceParams) {
-  const { workspaceId, type, accountId, envKey, envOwnerUserId } = params
-
-  if (type === 'oauth' && accountId) {
-    const [row] = await db
-      .select()
-      .from(credential)
-      .where(
-        and(
-          eq(credential.workspaceId, workspaceId),
-          eq(credential.type, 'oauth'),
-          eq(credential.accountId, accountId)
-        )
-      )
-      .limit(1)
-    return row ?? null
-  }
-
-  if (type === 'env_workspace' && envKey) {
-    const [row] = await db
-      .select()
-      .from(credential)
-      .where(
-        and(
-          eq(credential.workspaceId, workspaceId),
-          eq(credential.type, 'env_workspace'),
-          eq(credential.envKey, envKey)
-        )
-      )
-      .limit(1)
-    return row ?? null
-  }
-
-  if (type === 'env_personal' && envKey && envOwnerUserId) {
-    const [row] = await db
-      .select()
-      .from(credential)
-      .where(
-        and(
-          eq(credential.workspaceId, workspaceId),
-          eq(credential.type, 'env_personal'),
-          eq(credential.envKey, envKey),
-          eq(credential.envOwnerUserId, envOwnerUserId)
-        )
-      )
-      .limit(1)
-    return row ?? null
-  }
-
-  return null
-}
-
-export async function GET(request: NextRequest) {
-  const requestId = generateRequestId()
-  const session = await getSession()
-
-  if (!session?.user?.id) {
-    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
-  }
-
-  try {
-    const { searchParams } = new URL(request.url)
-    const rawWorkspaceId = searchParams.get('workspaceId')
-    const rawType = searchParams.get('type')
-    const rawProviderId = searchParams.get('providerId')
-    const rawCredentialId = searchParams.get('credentialId')
-    const parseResult = listCredentialsSchema.safeParse({
-      workspaceId: rawWorkspaceId?.trim(),
-      type: rawType?.trim() || undefined,
-      providerId: rawProviderId?.trim() || undefined,
-      credentialId: rawCredentialId?.trim() || undefined,
-    })
-
-    if (!parseResult.success) {
-      logger.warn(`[${requestId}] Invalid credential list request`, {
-        workspaceId: rawWorkspaceId,
-        type: rawType,
-        providerId: rawProviderId,
-        errors: parseResult.error.errors,
-      })
-      return NextResponse.json({ error: parseResult.error.errors[0]?.message }, { status: 400 })
-    }
-
-    const { workspaceId, type, providerId, credentialId: lookupCredentialId } = parseResult.data
-    const workspaceAccess = await checkWorkspaceAccess(workspaceId, session.user.id)
-
-    if (!workspaceAccess.hasAccess) {
-      return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
-    }
-
-    if (lookupCredentialId) {
-      let [row] = await db
-        .select({
-          id: credential.id,
-          displayName: credential.displayName,
-          type: credential.type,
-          providerId: credential.providerId,
-        })
-        .from(credential)
-        .where(and(eq(credential.id, lookupCredentialId), eq(credential.workspaceId, workspaceId)))
-        .limit(1)
-
-      if (!row) {
-        ;[row] = await db
-          .select({
-            id: credential.id,
-            displayName: credential.displayName,
-            type: credential.type,
-            providerId: credential.providerId,
-          })
-          .from(credential)
-          .where(
-            and(
-              eq(credential.accountId, lookupCredentialId),
-              eq(credential.workspaceId, workspaceId)
-            )
-          )
-          .limit(1)
-      }
-
-      return NextResponse.json({ credential: row ?? null })
-    }
-
-    if (!type || type === 'oauth') {
-      await syncWorkspaceOAuthCredentialsForUser({ workspaceId, userId: session.user.id })
-    }
-
-    const whereClauses = [
-      eq(credential.workspaceId, workspaceId),
-      eq(credentialMember.userId, session.user.id),
-      eq(credentialMember.status, 'active'),
-    ]
-
-    if (type) {
-      whereClauses.push(eq(credential.type, type))
-    }
-    if (providerId) {
-      whereClauses.push(eq(credential.providerId, providerId))
-    }
-
-    const credentials = await db
-      .select({
-        id: credential.id,
-        workspaceId: credential.workspaceId,
-        type: credential.type,
-        displayName: credential.displayName,
-        description: credential.description,
-        providerId: credential.providerId,
-        accountId: credential.accountId,
-        envKey: credential.envKey,
-        envOwnerUserId: credential.envOwnerUserId,
-        createdBy: credential.createdBy,
-        createdAt: credential.createdAt,
-        updatedAt: credential.updatedAt,
-        role: credentialMember.role,
-      })
-      .from(credential)
-      .innerJoin(
-        credentialMember,
-        and(
-          eq(credentialMember.credentialId, credential.id),
-          eq(credentialMember.userId, session.user.id),
-          eq(credentialMember.status, 'active')
-        )
-      )
-      .where(and(...whereClauses))
-
-    return NextResponse.json({ credentials })
-  } catch (error) {
-    logger.error(`[${requestId}] Failed to list credentials`, error)
-    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })
-  }
-}
-
-export async function POST(request: NextRequest) {
-  const requestId = generateRequestId()
-  const session = await getSession()
-
-  if (!session?.user?.id) {
-    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
-  }
-
-  try {
-    const body = await request.json()
-    const parseResult = createCredentialSchema.safeParse(body)
-
-    if (!parseResult.success) {
-      return NextResponse.json({ error: parseResult.error.errors[0]?.message }, { status: 400 })
-    }
-
-    const {
-      workspaceId,
-      type,
-      displayName,
-      description,
-      providerId,
-      accountId,
-      envKey,
-      envOwnerUserId,
-    } = parseResult.data
-
-    const workspaceAccess = await checkWorkspaceAccess(workspaceId, session.user.id)
-    if (!workspaceAccess.canWrite) {
-      return NextResponse.json({ error: 'Write permission required' }, { status: 403 })
-    }
-
-    let resolvedDisplayName = displayName?.trim() ?? ''
-    const resolvedDescription = description?.trim() || null
-    let resolvedProviderId: string | null = providerId ?? null
-    let resolvedAccountId: string | null = accountId ?? null
-    const resolvedEnvKey: string | null = envKey ? normalizeEnvKeyInput(envKey) : null
-    let resolvedEnvOwnerUserId: string | null = null
-
-    if (type === 'oauth') {
-      const [accountRow] = await db
-        .select({
-          id: account.id,
-          userId: account.userId,
-          providerId: account.providerId,
-          accountId: account.accountId,
-        })
-        .from(account)
-        .where(eq(account.id, accountId!))
-        .limit(1)
-
-      if (!accountRow) {
-        return NextResponse.json({ error: 'OAuth account not found' }, { status: 404 })
-      }
-
-      if (accountRow.userId !== session.user.id) {
-        return NextResponse.json(
-          { error: 'Only account owners can create oauth credentials for an account' },
-          { status: 403 }
-        )
-      }
-
-      if (providerId !== accountRow.providerId) {
-        return NextResponse.json(
-          { error: 'providerId does not match the selected OAuth account' },
-          { status: 400 }
-        )
-      }
-      if (!resolvedDisplayName) {
-        resolvedDisplayName =
-          getServiceConfigByProviderId(accountRow.providerId)?.name || accountRow.providerId
-      }
-    } else if (type === 'env_personal') {
-      resolvedEnvOwnerUserId = envOwnerUserId ?? session.user.id
-      if (resolvedEnvOwnerUserId !== session.user.id) {
-        return NextResponse.json(
-          { error: 'Only the current user can create personal env credentials for themselves' },
-          { status: 403 }
-        )
-      }
-      resolvedProviderId = null
-      resolvedAccountId = null
-      resolvedDisplayName = resolvedEnvKey || ''
-    } else {
-      resolvedProviderId = null
-      resolvedAccountId = null
-      resolvedEnvOwnerUserId = null
-      resolvedDisplayName = resolvedEnvKey || ''
-    }
-
-    if (!resolvedDisplayName) {
-      return NextResponse.json({ error: 'Display name is required' }, { status: 400 })
-    }
-
-    const existingCredential = await findExistingCredentialBySource({
-      workspaceId,
-      type,
-      accountId: resolvedAccountId,
-      envKey: resolvedEnvKey,
-      envOwnerUserId: resolvedEnvOwnerUserId,
-    })
-
-    if (existingCredential) {
-      const [membership] = await db
-        .select({
-          id: credentialMember.id,
-          status: credentialMember.status,
-          role: credentialMember.role,
-        })
-        .from(credentialMember)
-        .where(
-          and(
-            eq(credentialMember.credentialId, existingCredential.id),
-            eq(credentialMember.userId, session.user.id)
-          )
-        )
-        .limit(1)
-
-      if (!membership || membership.status !== 'active') {
-        return NextResponse.json(
-          { error: 'A credential with this source already exists in this workspace' },
-          { status: 409 }
-        )
-      }
-
-      const canUpdateExistingCredential = membership.role === 'admin'
-      const shouldUpdateDisplayName =
-        type === 'oauth' &&
-        resolvedDisplayName &&
-        resolvedDisplayName !== existingCredential.displayName
-      const shouldUpdateDescription =
-        typeof description !== 'undefined' &&
-        (existingCredential.description ?? null) !== resolvedDescription
-
-      if (canUpdateExistingCredential && (shouldUpdateDisplayName || shouldUpdateDescription)) {
-        await db
-          .update(credential)
-          .set({
-            ...(shouldUpdateDisplayName ? { displayName: resolvedDisplayName } : {}),
-            ...(shouldUpdateDescription ? { description: resolvedDescription } : {}),
-            updatedAt: new Date(),
-          })
-          .where(eq(credential.id, existingCredential.id))
-
-        const [updatedCredential] = await db
-          .select()
-          .from(credential)
-          .where(eq(credential.id, existingCredential.id))
-          .limit(1)
-
-        return NextResponse.json(
-          { credential: updatedCredential ?? existingCredential },
-          { status: 200 }
-        )
-      }
-
-      return NextResponse.json({ credential: existingCredential }, { status: 200 })
-    }
-
-    const now = new Date()
-    const credentialId = crypto.randomUUID()
-    const [workspaceRow] = await db
-      .select({ ownerId: workspace.ownerId })
-      .from(workspace)
-      .where(eq(workspace.id, workspaceId))
-      .limit(1)
-
-    await db.transaction(async (tx) => {
-      await tx.insert(credential).values({
-        id: credentialId,
-        workspaceId,
-        type,
-        displayName: resolvedDisplayName,
-        description: resolvedDescription,
-        providerId: resolvedProviderId,
-        accountId: resolvedAccountId,
-        envKey: resolvedEnvKey,
-        envOwnerUserId: resolvedEnvOwnerUserId,
-        createdBy: session.user.id,
-        createdAt: now,
-        updatedAt: now,
-      })
-
-      if (type === 'env_workspace' && workspaceRow?.ownerId) {
-        const workspaceUserIds = await getWorkspaceMemberUserIds(workspaceId)
-        if (workspaceUserIds.length > 0) {
-          for (const memberUserId of workspaceUserIds) {
-            await tx.insert(credentialMember).values({
-              id: crypto.randomUUID(),
-              credentialId,
-              userId: memberUserId,
-              role: memberUserId === workspaceRow.ownerId ? 'admin' : 'member',
-              status: 'active',
-              joinedAt: now,
-              invitedBy: session.user.id,
-              createdAt: now,
-              updatedAt: now,
-            })
-          }
-        }
-      } else {
-        await tx.insert(credentialMember).values({
-          id: crypto.randomUUID(),
-          credentialId,
-          userId: session.user.id,
-          role: 'admin',
-          status: 'active',
-          joinedAt: now,
-          invitedBy: session.user.id,
-          createdAt: now,
-          updatedAt: now,
-        })
-      }
-    })
-
-    const [created] = await db
-      .select()
-      .from(credential)
-      .where(eq(credential.id, credentialId))
-      .limit(1)
-
-    return NextResponse.json({ credential: created }, { status: 201 })
-  } catch (error: any) {
-    if (error?.code === '23505') {
-      return NextResponse.json(
-        { error: 'A credential with this source already exists' },
-        { status: 409 }
-      )
-    }
-    if (error?.code === '23503') {
-      return NextResponse.json(
-        { error: 'Invalid credential reference or membership target' },
-        { status: 400 }
-      )
-    }
-    if (error?.code === '23514') {
-      return NextResponse.json(
-        { error: 'Credential source data failed validation checks' },
-        { status: 400 }
-      )
-    }
-    logger.error(`[${requestId}] Credential create failure details`, {
-      code: error?.code,
-      detail: error?.detail,
-      constraint: error?.constraint,
-      table: error?.table,
-      message: error?.message,
-    })
-    logger.error(`[${requestId}] Failed to create credential`, error)
-    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })
-  }
-}

apps/sim/app/api/environment/route.ts

@@ -7,7 +7,6 @@ import { z } from 'zod'
 import { getSession } from '@/lib/auth'
 import { decryptSecret, encryptSecret } from '@/lib/core/security/encryption'
 import { generateRequestId } from '@/lib/core/utils/request'
-import { syncPersonalEnvCredentialsForUser } from '@/lib/credentials/environment'
 import type { EnvironmentVariable } from '@/stores/settings/environment'
 
 const logger = createLogger('EnvironmentAPI')
@@ -54,11 +53,6 @@ export async function POST(req: NextRequest) {
           },
         })
 
-      await syncPersonalEnvCredentialsForUser({
-        userId: session.user.id,
-        envKeys: Object.keys(variables),
-      })
-
       return NextResponse.json({ success: true })
     } catch (validationError) {
       if (validationError instanceof z.ZodError) {

apps/sim/app/api/organizations/[id]/invitations/[invitationId]/route.ts

@@ -11,7 +11,6 @@ import {
   user,
   userStats,
   type WorkspaceInvitationStatus,
-  workspaceEnvironment,
   workspaceInvitation,
 } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
@@ -24,7 +23,6 @@ import { hasAccessControlAccess } from '@/lib/billing'
 import { syncUsageLimitsFromSubscription } from '@/lib/billing/core/usage'
 import { requireStripeClient } from '@/lib/billing/stripe-client'
 import { getBaseUrl } from '@/lib/core/utils/urls'
-import { syncWorkspaceEnvCredentials } from '@/lib/credentials/environment'
 import { sendEmail } from '@/lib/messaging/email/mailer'
 
 const logger = createLogger('OrganizationInvitation')
@@ -497,34 +495,6 @@ export async function PUT(
       }
     })
 
-    if (status === 'accepted') {
-      const acceptedWsInvitations = await db
-        .select({ workspaceId: workspaceInvitation.workspaceId })
-        .from(workspaceInvitation)
-        .where(
-          and(
-            eq(workspaceInvitation.orgInvitationId, invitationId),
-            eq(workspaceInvitation.status, 'accepted' as WorkspaceInvitationStatus)
-          )
-        )
-
-      for (const wsInv of acceptedWsInvitations) {
-        const [wsEnvRow] = await db
-          .select({ variables: workspaceEnvironment.variables })
-          .from(workspaceEnvironment)
-          .where(eq(workspaceEnvironment.workspaceId, wsInv.workspaceId))
-          .limit(1)
-        const wsEnvKeys = Object.keys((wsEnvRow?.variables as Record<string, string>) || {})
-        if (wsEnvKeys.length > 0) {
-          await syncWorkspaceEnvCredentials({
-            workspaceId: wsInv.workspaceId,
-            envKeys: wsEnvKeys,
-            actingUserId: session.user.id,
-          })
-        }
-      }
-    }
-
     // Handle Pro subscription cancellation after transaction commits
     if (personalProToCancel) {
       try {

apps/sim/app/api/v1/admin/workspaces/[id]/members/route.ts

@@ -32,10 +32,9 @@
 
 import crypto from 'crypto'
 import { db } from '@sim/db'
-import { permissions, user, workspace, workspaceEnvironment } from '@sim/db/schema'
+import { permissions, user, workspace } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
 import { and, count, eq } from 'drizzle-orm'
-import { syncWorkspaceEnvCredentials } from '@/lib/credentials/environment'
 import { withAdminAuthParams } from '@/app/api/v1/admin/middleware'
 import {
   badRequestResponse,
@@ -233,20 +232,6 @@ export const POST = withAdminAuthParams<RouteParams>(async (request, context) =>
       permissionId,
     })
 
-    const [wsEnvRow] = await db
-      .select({ variables: workspaceEnvironment.variables })
-      .from(workspaceEnvironment)
-      .where(eq(workspaceEnvironment.workspaceId, workspaceId))
-      .limit(1)
-    const wsEnvKeys = Object.keys((wsEnvRow?.variables as Record<string, string>) || {})
-    if (wsEnvKeys.length > 0) {
-      await syncWorkspaceEnvCredentials({
-        workspaceId,
-        envKeys: wsEnvKeys,
-        actingUserId: body.userId,
-      })
-    }
-
     return singleResponse({
       id: permissionId,
       workspaceId,

apps/sim/app/api/wand/route.ts

@@ -238,6 +238,11 @@ Use this context to calculate relative dates like "yesterday", "last week", "beg
       finalSystemPrompt += currentTimeContext
     }
 
+    if (generationType === 'cron-expression') {
+      finalSystemPrompt +=
+        '\n\nIMPORTANT: Return ONLY the raw cron expression (e.g., "0 9 * * 1-5"). Do NOT wrap it in markdown code blocks, backticks, or quotes. Do NOT include any explanation or text before or after the expression.'
+    }
+
     if (generationType === 'json-object') {
       finalSystemPrompt +=
         '\n\nIMPORTANT: Return ONLY the raw JSON object. Do NOT wrap it in markdown code blocks (no ```json or ```). Do NOT include any explanation or text before or after the JSON. The response must start with { and end with }.'

apps/sim/app/api/workflows/[id]/execute/route.ts

@@ -536,7 +536,6 @@ export async function POST(req: NextRequest, { params }: { params: Promise<{ id:
           useDraftState: shouldUseDraftState,
           startTime: new Date().toISOString(),
           isClientSession,
-          enforceCredentialAccess: useAuthenticatedUserAsActor,
           workflowStateOverride: effectiveWorkflowStateOverride,
         }
 
@@ -886,7 +885,6 @@ export async function POST(req: NextRequest, { params }: { params: Promise<{ id:
             useDraftState: shouldUseDraftState,
             startTime: new Date().toISOString(),
             isClientSession,
-            enforceCredentialAccess: useAuthenticatedUserAsActor,
             workflowStateOverride: effectiveWorkflowStateOverride,
           }
 

apps/sim/app/api/workspaces/[id]/environment/route.ts

@@ -1,14 +1,12 @@
 import { db } from '@sim/db'
-import { workspaceEnvironment } from '@sim/db/schema'
+import { environment, workspaceEnvironment } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
 import { eq } from 'drizzle-orm'
 import { type NextRequest, NextResponse } from 'next/server'
 import { z } from 'zod'
 import { getSession } from '@/lib/auth'
-import { encryptSecret } from '@/lib/core/security/encryption'
+import { decryptSecret, encryptSecret } from '@/lib/core/security/encryption'
 import { generateRequestId } from '@/lib/core/utils/request'
-import { syncWorkspaceEnvCredentials } from '@/lib/credentials/environment'
-import { getPersonalAndWorkspaceEnv } from '@/lib/environment/utils'
 import { getUserEntityPermissions, getWorkspaceById } from '@/lib/workspaces/permissions/utils'
 
 const logger = createLogger('WorkspaceEnvironmentAPI')
@@ -46,10 +44,44 @@ export async function GET(request: NextRequest, { params }: { params: Promise<{
       return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
     }
 
-    const { workspaceDecrypted, personalDecrypted, conflicts } = await getPersonalAndWorkspaceEnv(
-      userId,
-      workspaceId
-    )
+    // Workspace env (encrypted)
+    const wsEnvRow = await db
+      .select()
+      .from(workspaceEnvironment)
+      .where(eq(workspaceEnvironment.workspaceId, workspaceId))
+      .limit(1)
+
+    const wsEncrypted: Record<string, string> = (wsEnvRow[0]?.variables as any) || {}
+
+    // Personal env (encrypted)
+    const personalRow = await db
+      .select()
+      .from(environment)
+      .where(eq(environment.userId, userId))
+      .limit(1)
+
+    const personalEncrypted: Record<string, string> = (personalRow[0]?.variables as any) || {}
+
+    // Decrypt both for UI
+    const decryptAll = async (src: Record<string, string>) => {
+      const out: Record<string, string> = {}
+      for (const [k, v] of Object.entries(src)) {
+        try {
+          const { decrypted } = await decryptSecret(v)
+          out[k] = decrypted
+        } catch {
+          out[k] = ''
+        }
+      }
+      return out
+    }
+
+    const [workspaceDecrypted, personalDecrypted] = await Promise.all([
+      decryptAll(wsEncrypted),
+      decryptAll(personalEncrypted),
+    ])
+
+    const conflicts = Object.keys(personalDecrypted).filter((k) => k in workspaceDecrypted)
 
     return NextResponse.json(
       {
@@ -124,12 +156,6 @@ export async function PUT(request: NextRequest, { params }: { params: Promise<{
         set: { variables: merged, updatedAt: new Date() },
       })
 
-    await syncWorkspaceEnvCredentials({
-      workspaceId,
-      envKeys: Object.keys(merged),
-      actingUserId: userId,
-    })
-
     return NextResponse.json({ success: true })
   } catch (error: any) {
     logger.error(`[${requestId}] Workspace env PUT error`, error)
@@ -196,12 +222,6 @@ export async function DELETE(
         set: { variables: current, updatedAt: new Date() },
       })
 
-    await syncWorkspaceEnvCredentials({
-      workspaceId,
-      envKeys: Object.keys(current),
-      actingUserId: userId,
-    })
-
     return NextResponse.json({ success: true })
   } catch (error: any) {
     logger.error(`[${requestId}] Workspace env DELETE error`, error)

apps/sim/app/api/workspaces/[id]/permissions/route.ts

@@ -1,12 +1,11 @@
 import crypto from 'crypto'
 import { db } from '@sim/db'
-import { permissions, workspace, workspaceEnvironment } from '@sim/db/schema'
+import { permissions, workspace } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
 import { and, eq } from 'drizzle-orm'
 import { type NextRequest, NextResponse } from 'next/server'
 import { z } from 'zod'
 import { getSession } from '@/lib/auth'
-import { syncWorkspaceEnvCredentials } from '@/lib/credentials/environment'
 import {
   getUsersWithPermissions,
   hasWorkspaceAdminAccess,
@@ -155,20 +154,6 @@ export async function PATCH(request: NextRequest, { params }: { params: Promise<
       }
     })
 
-    const [wsEnvRow] = await db
-      .select({ variables: workspaceEnvironment.variables })
-      .from(workspaceEnvironment)
-      .where(eq(workspaceEnvironment.workspaceId, workspaceId))
-      .limit(1)
-    const wsEnvKeys = Object.keys((wsEnvRow?.variables as Record<string, string>) || {})
-    if (wsEnvKeys.length > 0) {
-      await syncWorkspaceEnvCredentials({
-        workspaceId,
-        envKeys: wsEnvKeys,
-        actingUserId: session.user.id,
-      })
-    }
-
     const updatedUsers = await getUsersWithPermissions(workspaceId)
 
     return NextResponse.json({

apps/sim/app/api/workspaces/invitations/[invitationId]/route.test.ts

@@ -8,27 +8,15 @@ const mockHasWorkspaceAdminAccess = vi.fn()
 let dbSelectResults: any[] = []
 let dbSelectCallIndex = 0
 
-const mockDbSelect = vi.fn().mockImplementation(() => {
-  const makeThen = () =>
-    vi.fn().mockImplementation((callback: (rows: any[]) => any) => {
-      const result = dbSelectResults[dbSelectCallIndex] || []
-      dbSelectCallIndex++
-      return Promise.resolve(callback ? callback(result) : result)
-    })
-  const makeLimit = () =>
-    vi.fn().mockImplementation(() => {
-      const result = dbSelectResults[dbSelectCallIndex] || []
-      dbSelectCallIndex++
-      return Promise.resolve(result)
-    })
-
-  const chain: any = {}
-  chain.from = vi.fn().mockReturnValue(chain)
-  chain.where = vi.fn().mockReturnValue(chain)
-  chain.limit = makeLimit()
-  chain.then = makeThen()
-  return chain
-})
+const mockDbSelect = vi.fn().mockImplementation(() => ({
+  from: vi.fn().mockReturnThis(),
+  where: vi.fn().mockReturnThis(),
+  then: vi.fn().mockImplementation((callback: (rows: any[]) => any) => {
+    const result = dbSelectResults[dbSelectCallIndex] || []
+    dbSelectCallIndex++
+    return Promise.resolve(callback ? callback(result) : result)
+  }),
+}))
 
 const mockDbInsert = vi.fn().mockImplementation(() => ({
   values: vi.fn().mockResolvedValue(undefined),
@@ -65,10 +53,6 @@ vi.mock('@/lib/workspaces/permissions/utils', () => ({
     mockHasWorkspaceAdminAccess(userId, workspaceId),
 }))
 
-vi.mock('@/lib/credentials/environment', () => ({
-  syncWorkspaceEnvCredentials: vi.fn().mockResolvedValue(undefined),
-}))
-
 vi.mock('@sim/logger', () => loggerMock)
 
 vi.mock('@/lib/core/utils/urls', () => ({
@@ -111,10 +95,6 @@ vi.mock('@sim/db/schema', () => ({
     userId: 'userId',
     permissionType: 'permissionType',
   },
-  workspaceEnvironment: {
-    workspaceId: 'workspaceId',
-    variables: 'variables',
-  },
 }))
 
 vi.mock('drizzle-orm', () => ({
@@ -227,7 +207,6 @@ describe('Workspace Invitation [invitationId] API Route', () => {
         [mockWorkspace],
         [{ ...mockUser, email: 'invited@example.com' }],
         [],
-        [],
       ]
 
       const request = new NextRequest(
@@ -481,7 +460,6 @@ describe('Workspace Invitation [invitationId] API Route', () => {
         [mockWorkspace],
         [{ ...mockUser, email: 'invited@example.com' }],
         [],
-        [],
       ]
 
       const request2 = new NextRequest(

apps/sim/app/api/workspaces/invitations/[invitationId]/route.ts

@@ -6,7 +6,6 @@ import {
   user,
   type WorkspaceInvitationStatus,
   workspace,
-  workspaceEnvironment,
   workspaceInvitation,
 } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
@@ -15,7 +14,6 @@ import { type NextRequest, NextResponse } from 'next/server'
 import { WorkspaceInvitationEmail } from '@/components/emails'
 import { getSession } from '@/lib/auth'
 import { getBaseUrl } from '@/lib/core/utils/urls'
-import { syncWorkspaceEnvCredentials } from '@/lib/credentials/environment'
 import { sendEmail } from '@/lib/messaging/email/mailer'
 import { getFromEmailAddress } from '@/lib/messaging/email/utils'
 import { hasWorkspaceAdminAccess } from '@/lib/workspaces/permissions/utils'
@@ -164,20 +162,6 @@ export async function GET(
           .where(eq(workspaceInvitation.id, invitation.id))
       })
 
-      const [wsEnvRow] = await db
-        .select({ variables: workspaceEnvironment.variables })
-        .from(workspaceEnvironment)
-        .where(eq(workspaceEnvironment.workspaceId, invitation.workspaceId))
-        .limit(1)
-      const wsEnvKeys = Object.keys((wsEnvRow?.variables as Record<string, string>) || {})
-      if (wsEnvKeys.length > 0) {
-        await syncWorkspaceEnvCredentials({
-          workspaceId: invitation.workspaceId,
-          envKeys: wsEnvKeys,
-          actingUserId: session.user.id,
-        })
-      }
-
       return NextResponse.redirect(new URL(`/workspace/${invitation.workspaceId}/w`, getBaseUrl()))
     }
 

apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/credential-selector/components/oauth-required-modal.tsx

@@ -30,7 +30,6 @@ export interface OAuthRequiredModalProps {
   requiredScopes?: string[]
   serviceId: string
   newScopes?: string[]
-  onConnect?: () => Promise<void> | void
 }
 
 const SCOPE_DESCRIPTIONS: Record<string, string> = {
@@ -315,7 +314,6 @@ export function OAuthRequiredModal({
   requiredScopes = [],
   serviceId,
   newScopes = [],
-  onConnect,
 }: OAuthRequiredModalProps) {
   const [error, setError] = useState<string | null>(null)
   const { baseProvider } = parseProvider(provider)
@@ -361,12 +359,6 @@ export function OAuthRequiredModal({
     setError(null)
 
     try {
-      if (onConnect) {
-        await onConnect()
-        onClose()
-        return
-      }
-
       const providerId = getProviderIdFromServiceId(serviceId)
 
       logger.info('Linking OAuth2:', {

apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/credential-selector/credential-selector.tsx

@@ -3,12 +3,10 @@
 import { createElement, useCallback, useEffect, useMemo, useState } from 'react'
 import { createLogger } from '@sim/logger'
 import { ExternalLink, Users } from 'lucide-react'
-import { useParams } from 'next/navigation'
 import { Button, Combobox } from '@/components/emcn/components'
 import { getSubscriptionStatus } from '@/lib/billing/client'
 import { getEnv, isTruthy } from '@/lib/core/config/env'
 import { getPollingProviderFromOAuth } from '@/lib/credential-sets/providers'
-import { writePendingCredentialCreateRequest } from '@/lib/credentials/client-state'
 import {
   getCanonicalScopesForProvider,
   getProviderIdFromServiceId,
@@ -20,9 +18,9 @@ import { OAuthRequiredModal } from '@/app/workspace/[workspaceId]/w/[workflowId]
 import { useDependsOnGate } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/hooks/use-depends-on-gate'
 import { useSubBlockValue } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/hooks/use-sub-block-value'
 import type { SubBlockConfig } from '@/blocks/types'
-import { CREDENTIAL_SET } from '@/executor/constants'
+import { CREDENTIAL, CREDENTIAL_SET } from '@/executor/constants'
 import { useCredentialSets } from '@/hooks/queries/credential-sets'
-import { useOAuthCredentials } from '@/hooks/queries/oauth-credentials'
+import { useOAuthCredentialDetail, useOAuthCredentials } from '@/hooks/queries/oauth-credentials'
 import { useOrganizations } from '@/hooks/queries/organization'
 import { useSubscriptionData } from '@/hooks/queries/subscription'
 import { getMissingRequiredScopes } from '@/hooks/use-oauth-scope-status'
@@ -48,8 +46,6 @@ export function CredentialSelector({
   previewValue,
   previewContextValues,
 }: CredentialSelectorProps) {
-  const params = useParams()
-  const workspaceId = (params?.workspaceId as string) || ''
   const [showOAuthModal, setShowOAuthModal] = useState(false)
   const [editingValue, setEditingValue] = useState('')
   const [isEditing, setIsEditing] = useState(false)
@@ -100,70 +96,64 @@ export function CredentialSelector({
     data: credentials = [],
     isFetching: credentialsLoading,
     refetch: refetchCredentials,
-  } = useOAuthCredentials(effectiveProviderId, {
-    enabled: Boolean(effectiveProviderId),
-    workspaceId,
-    workflowId: activeWorkflowId || undefined,
-  })
+  } = useOAuthCredentials(effectiveProviderId, Boolean(effectiveProviderId))
 
   const selectedCredential = useMemo(
     () => credentials.find((cred) => cred.id === selectedId),
     [credentials, selectedId]
   )
 
+  const shouldFetchForeignMeta =
+    Boolean(selectedId) &&
+    !selectedCredential &&
+    Boolean(activeWorkflowId) &&
+    Boolean(effectiveProviderId)
+
+  const { data: foreignCredentials = [], isFetching: foreignMetaLoading } =
+    useOAuthCredentialDetail(
+      shouldFetchForeignMeta ? selectedId : undefined,
+      activeWorkflowId || undefined,
+      shouldFetchForeignMeta
+    )
+
+  const hasForeignMeta = foreignCredentials.length > 0
+  const isForeign = Boolean(selectedId && !selectedCredential && hasForeignMeta)
+
   const selectedCredentialSet = useMemo(
     () => credentialSets.find((cs) => cs.id === selectedCredentialSetId),
     [credentialSets, selectedCredentialSetId]
   )
 
-  const [inaccessibleCredentialName, setInaccessibleCredentialName] = useState<string | null>(null)
-
-  useEffect(() => {
-    if (!selectedId || selectedCredential || credentialsLoading || !workspaceId) {
-      setInaccessibleCredentialName(null)
-      return
-    }
-
-    let cancelled = false
-    ;(async () => {
-      try {
-        const response = await fetch(
-          `/api/credentials?workspaceId=${encodeURIComponent(workspaceId)}&credentialId=${encodeURIComponent(selectedId)}`
-        )
-        if (!response.ok || cancelled) return
-        const data = await response.json()
-        if (!cancelled && data.credential?.displayName) {
-          if (data.credential.id !== selectedId) {
-            setStoreValue(data.credential.id)
-          }
-          setInaccessibleCredentialName(data.credential.displayName)
-        }
-      } catch {
-        // Ignore fetch errors
-      }
-    })()
-
-    return () => {
-      cancelled = true
-    }
-  }, [selectedId, selectedCredential, credentialsLoading, workspaceId])
+  const isForeignCredentialSet = Boolean(isCredentialSetSelected && !selectedCredentialSet)
 
   const resolvedLabel = useMemo(() => {
     if (selectedCredentialSet) return selectedCredentialSet.name
+    if (isForeignCredentialSet) return CREDENTIAL.FOREIGN_LABEL
     if (selectedCredential) return selectedCredential.name
-    if (inaccessibleCredentialName) return inaccessibleCredentialName
+    if (isForeign) return CREDENTIAL.FOREIGN_LABEL
     return ''
-  }, [
-    selectedCredentialSet,
-    selectedCredential,
-    inaccessibleCredentialName,
-    selectedId,
-    credentialsLoading,
-  ])
+  }, [selectedCredentialSet, isForeignCredentialSet, selectedCredential, isForeign])
 
   const displayValue = isEditing ? editingValue : resolvedLabel
 
-  useCredentialRefreshTriggers(refetchCredentials, effectiveProviderId, workspaceId)
+  const invalidSelection =
+    !isPreview &&
+    Boolean(selectedId) &&
+    !selectedCredential &&
+    !hasForeignMeta &&
+    !credentialsLoading &&
+    !foreignMetaLoading
+
+  useEffect(() => {
+    if (!invalidSelection) return
+    logger.info('Clearing invalid credential selection - credential was disconnected', {
+      selectedId,
+      provider: effectiveProviderId,
+    })
+    setStoreValue('')
+  }, [invalidSelection, selectedId, effectiveProviderId, setStoreValue])
+
+  useCredentialRefreshTriggers(refetchCredentials)
 
   const handleOpenChange = useCallback(
     (isOpen: boolean) => {
@@ -205,18 +195,8 @@ export function CredentialSelector({
   )
 
   const handleAddCredential = useCallback(() => {
-    writePendingCredentialCreateRequest({
-      workspaceId,
-      type: 'oauth',
-      providerId: effectiveProviderId,
-      displayName: '',
-      serviceId,
-      requiredScopes: getCanonicalScopesForProvider(effectiveProviderId),
-      requestedAt: Date.now(),
-    })
-
-    window.dispatchEvent(new CustomEvent('open-settings', { detail: { tab: 'credentials' } }))
-  }, [workspaceId, effectiveProviderId, serviceId])
+    setShowOAuthModal(true)
+  }, [])
 
   const getProviderIcon = useCallback((providerName: OAuthProvider) => {
     const { baseProvider } = parseProvider(providerName)
@@ -271,18 +251,23 @@ export function CredentialSelector({
         label: cred.name,
         value: cred.id,
       }))
-      credentialItems.push({
-        label:
-          credentials.length > 0
-            ? `Connect another ${getProviderName(provider)} account`
-            : `Connect ${getProviderName(provider)} account`,
-        value: '__connect_account__',
-      })
 
-      groups.push({
-        section: 'Personal Credential',
-        items: credentialItems,
-      })
+      if (credentialItems.length > 0) {
+        groups.push({
+          section: 'Personal Credential',
+          items: credentialItems,
+        })
+      } else {
+        groups.push({
+          section: 'Personal Credential',
+          items: [
+            {
+              label: `Connect ${getProviderName(provider)} account`,
+              value: '__connect_account__',
+            },
+          ],
+        })
+      }
 
       return { comboboxOptions: [], comboboxGroups: groups }
     }
@@ -292,13 +277,12 @@ export function CredentialSelector({
       value: cred.id,
     }))
 
-    options.push({
-      label:
-        credentials.length > 0
-          ? `Connect another ${getProviderName(provider)} account`
-          : `Connect ${getProviderName(provider)} account`,
-      value: '__connect_account__',
-    })
+    if (credentials.length === 0) {
+      options.push({
+        label: `Connect ${getProviderName(provider)} account`,
+        value: '__connect_account__',
+      })
+    }
 
     return { comboboxOptions: options, comboboxGroups: undefined }
   }, [
@@ -384,7 +368,7 @@ export function CredentialSelector({
         }
         disabled={effectiveDisabled}
         editable={true}
-        filterOptions={true}
+        filterOptions={!isForeign && !isForeignCredentialSet}
         isLoading={credentialsLoading}
         overlayContent={overlayContent}
         className={selectedId || isCredentialSetSelected ? 'pl-[28px]' : ''}
@@ -396,13 +380,15 @@ export function CredentialSelector({
             <span className='mr-[6px] inline-block h-[6px] w-[6px] rounded-[2px] bg-amber-500' />
             Additional permissions required
           </div>
-          <Button
-            variant='active'
-            onClick={() => setShowOAuthModal(true)}
-            className='w-full px-[8px] py-[4px] font-medium text-[12px]'
-          >
-            Update access
-          </Button>
+          {!isForeign && (
+            <Button
+              variant='active'
+              onClick={() => setShowOAuthModal(true)}
+              className='w-full px-[8px] py-[4px] font-medium text-[12px]'
+            >
+              Update access
+            </Button>
+          )}
         </div>
       )}
 
@@ -421,11 +407,7 @@ export function CredentialSelector({
   )
 }
 
-function useCredentialRefreshTriggers(
-  refetchCredentials: () => Promise<unknown>,
-  providerId: string,
-  workspaceId: string
-) {
+function useCredentialRefreshTriggers(refetchCredentials: () => Promise<unknown>) {
   useEffect(() => {
     const refresh = () => {
       void refetchCredentials()
@@ -443,29 +425,12 @@ function useCredentialRefreshTriggers(
       }
     }
 
-    const handleCredentialsUpdated = (
-      event: CustomEvent<{ providerId?: string; workspaceId?: string }>
-    ) => {
-      if (event.detail?.providerId && event.detail.providerId !== providerId) {
-        return
-      }
-      if (event.detail?.workspaceId && workspaceId && event.detail.workspaceId !== workspaceId) {
-        return
-      }
-      refresh()
-    }
-
     document.addEventListener('visibilitychange', handleVisibilityChange)
     window.addEventListener('pageshow', handlePageShow)
-    window.addEventListener('oauth-credentials-updated', handleCredentialsUpdated as EventListener)
 
     return () => {
       document.removeEventListener('visibilitychange', handleVisibilityChange)
       window.removeEventListener('pageshow', handlePageShow)
-      window.removeEventListener(
-        'oauth-credentials-updated',
-        handleCredentialsUpdated as EventListener
-      )
     }
-  }, [providerId, workspaceId, refetchCredentials])
+  }, [refetchCredentials])
 }

apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/env-var-dropdown.tsx

@@ -9,7 +9,6 @@ import {
   PopoverSection,
 } from '@/components/emcn'
 import { cn } from '@/lib/core/utils/cn'
-import { writePendingCredentialCreateRequest } from '@/lib/credentials/client-state'
 import {
   usePersonalEnvironment,
   useWorkspaceEnvironment,
@@ -169,15 +168,7 @@ export const EnvVarDropdown: React.FC<EnvVarDropdownProps> = ({
   }, [searchTerm])
 
   const openEnvironmentSettings = () => {
-    if (workspaceId) {
-      writePendingCredentialCreateRequest({
-        workspaceId,
-        type: 'env_personal',
-        envKey: searchTerm.trim(),
-        requestedAt: Date.now(),
-      })
-    }
-    window.dispatchEvent(new CustomEvent('open-settings', { detail: { tab: 'credentials' } }))
+    window.dispatchEvent(new CustomEvent('open-settings', { detail: { tab: 'environment' } }))
     onClose?.()
   }
 
@@ -311,7 +302,7 @@ export const EnvVarDropdown: React.FC<EnvVarDropdownProps> = ({
               }}
             >
               <Plus className='h-3 w-3' />
-              <span>Create Secret</span>
+              <span>Create environment variable</span>
             </PopoverItem>
           </PopoverScrollArea>
         ) : (

apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/file-selector/file-selector-input.tsx

@@ -7,6 +7,7 @@ import { getProviderIdFromServiceId } from '@/lib/oauth'
 import { buildCanonicalIndex, resolveDependencyValue } from '@/lib/workflows/subblocks/visibility'
 import { SelectorCombobox } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/selector-combobox/selector-combobox'
 import { useDependsOnGate } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/hooks/use-depends-on-gate'
+import { useForeignCredential } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/hooks/use-foreign-credential'
 import { useSubBlockValue } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/hooks/use-sub-block-value'
 import { resolvePreviewContextValue } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/utils'
 import { getBlock } from '@/blocks/registry'
@@ -124,6 +125,8 @@ export function FileSelectorInput({
   const serviceId = subBlock.serviceId || ''
   const effectiveProviderId = useMemo(() => getProviderIdFromServiceId(serviceId), [serviceId])
 
+  const { isForeignCredential } = useForeignCredential(effectiveProviderId, normalizedCredentialId)
+
   const selectorResolution = useMemo<SelectorResolution | null>(() => {
     return resolveSelectorForSubBlock(subBlock, {
       workflowId: workflowIdFromUrl,
@@ -165,6 +168,7 @@ export function FileSelectorInput({
 
   const disabledReason =
     finalDisabled ||
+    isForeignCredential ||
     missingCredential ||
     missingDomain ||
     missingProject ||

apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/folder-selector/components/folder-selector-input.tsx

@@ -4,6 +4,7 @@ import { useCallback, useEffect, useMemo, useState } from 'react'
 import { getProviderIdFromServiceId } from '@/lib/oauth'
 import { SelectorCombobox } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/selector-combobox/selector-combobox'
 import { useDependsOnGate } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/hooks/use-depends-on-gate'
+import { useForeignCredential } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/hooks/use-foreign-credential'
 import { useSubBlockValue } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/hooks/use-sub-block-value'
 import { resolvePreviewContextValue } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/utils'
 import type { SubBlockConfig } from '@/blocks/types'
@@ -46,6 +47,10 @@ export function FolderSelectorInput({
     subBlock.canonicalParamId === 'copyDestinationId' ||
     subBlock.id === 'copyDestinationFolder' ||
     subBlock.id === 'manualCopyDestinationFolder'
+  const { isForeignCredential } = useForeignCredential(
+    effectiveProviderId,
+    (connectedCredential as string) || ''
+  )
 
   // Central dependsOn gating
   const { finalDisabled } = useDependsOnGate(blockId, subBlock, {
@@ -114,7 +119,9 @@ export function FolderSelectorInput({
       selectorContext={
         selectorResolution?.context ?? { credentialId, workflowId: activeWorkflowId || '' }
       }
-      disabled={finalDisabled || missingCredential || !selectorResolution?.key}
+      disabled={
+        finalDisabled || isForeignCredential || missingCredential || !selectorResolution?.key
+      }
       isPreview={isPreview}
       previewValue={previewValue ?? null}
       placeholder={subBlock.placeholder || 'Select folder'}

apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/project-selector/project-selector-input.tsx

@@ -7,6 +7,7 @@ import { getProviderIdFromServiceId } from '@/lib/oauth'
 import { buildCanonicalIndex, resolveDependencyValue } from '@/lib/workflows/subblocks/visibility'
 import { SelectorCombobox } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/selector-combobox/selector-combobox'
 import { useDependsOnGate } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/hooks/use-depends-on-gate'
+import { useForeignCredential } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/hooks/use-foreign-credential'
 import { useSubBlockValue } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/hooks/use-sub-block-value'
 import { resolvePreviewContextValue } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/utils'
 import { getBlock } from '@/blocks/registry'
@@ -72,6 +73,11 @@ export function ProjectSelectorInput({
 
   const serviceId = subBlock.serviceId || ''
   const effectiveProviderId = useMemo(() => getProviderIdFromServiceId(serviceId), [serviceId])
+
+  const { isForeignCredential } = useForeignCredential(
+    effectiveProviderId,
+    (connectedCredential as string) || ''
+  )
   const workflowIdFromUrl = (params?.workflowId as string) || activeWorkflowId || ''
   const { finalDisabled } = useDependsOnGate(blockId, subBlock, {
     disabled,
@@ -117,7 +123,7 @@ export function ProjectSelectorInput({
               subBlock={subBlock}
               selectorKey={selectorResolution.key}
               selectorContext={selectorResolution.context}
-              disabled={finalDisabled || missingCredential}
+              disabled={finalDisabled || isForeignCredential || missingCredential}
               isPreview={isPreview}
               previewValue={previewValue ?? null}
               placeholder={subBlock.placeholder || 'Select project'}

apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/sheet-selector/sheet-selector-input.tsx

@@ -7,6 +7,7 @@ import { getProviderIdFromServiceId } from '@/lib/oauth'
 import { buildCanonicalIndex, resolveDependencyValue } from '@/lib/workflows/subblocks/visibility'
 import { SelectorCombobox } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/selector-combobox/selector-combobox'
 import { useDependsOnGate } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/hooks/use-depends-on-gate'
+import { useForeignCredential } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/hooks/use-foreign-credential'
 import { resolvePreviewContextValue } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/utils'
 import { getBlock } from '@/blocks/registry'
 import type { SubBlockConfig } from '@/blocks/types'
@@ -86,6 +87,8 @@ export function SheetSelectorInput({
   const serviceId = subBlock.serviceId || ''
   const effectiveProviderId = useMemo(() => getProviderIdFromServiceId(serviceId), [serviceId])
 
+  const { isForeignCredential } = useForeignCredential(effectiveProviderId, normalizedCredentialId)
+
   const selectorResolution = useMemo<SelectorResolution | null>(() => {
     return resolveSelectorForSubBlock(subBlock, {
       workflowId: workflowIdFromUrl,
@@ -98,7 +101,11 @@ export function SheetSelectorInput({
   const missingSpreadsheet = !normalizedSpreadsheetId
 
   const disabledReason =
-    finalDisabled || missingCredential || missingSpreadsheet || !selectorResolution?.key
+    finalDisabled ||
+    isForeignCredential ||
+    missingCredential ||
+    missingSpreadsheet ||
+    !selectorResolution?.key
 
   if (!selectorResolution?.key) {
     return (

apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/slack-selector/slack-selector-input.tsx

@@ -6,6 +6,7 @@ import { Tooltip } from '@/components/emcn'
 import { getProviderIdFromServiceId } from '@/lib/oauth'
 import { SelectorCombobox } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/selector-combobox/selector-combobox'
 import { useDependsOnGate } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/hooks/use-depends-on-gate'
+import { useForeignCredential } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/hooks/use-foreign-credential'
 import { useSubBlockValue } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/hooks/use-sub-block-value'
 import { resolvePreviewContextValue } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/utils'
 import type { SubBlockConfig } from '@/blocks/types'
@@ -84,6 +85,11 @@ export function SlackSelectorInput({
       ? (effectiveBotToken as string) || ''
       : (effectiveCredential as string) || ''
 
+  const { isForeignCredential } = useForeignCredential(
+    effectiveProviderId,
+    (effectiveAuthMethod as string) === 'bot_token' ? '' : (effectiveCredential as string) || ''
+  )
+
   useEffect(() => {
     const val = isPreview && previewValue !== undefined ? previewValue : storeValue
     if (typeof val === 'string') {
@@ -93,7 +99,7 @@ export function SlackSelectorInput({
 
   const requiresCredential = dependsOn.includes('credential')
   const missingCredential = !credential || credential.trim().length === 0
-  const shouldForceDisable = requiresCredential && missingCredential
+  const shouldForceDisable = requiresCredential && (missingCredential || isForeignCredential)
 
   const context: SelectorContext = useMemo(
     () => ({
@@ -130,7 +136,7 @@ export function SlackSelectorInput({
             subBlock={subBlock}
             selectorKey={config.selectorKey}
             selectorContext={context}
-            disabled={finalDisabled || shouldForceDisable}
+            disabled={finalDisabled || shouldForceDisable || isForeignCredential}
             isPreview={isPreview}
             previewValue={previewValue ?? null}
             placeholder={subBlock.placeholder || config.placeholder}

apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/tool-input/components/tools/credential-selector.tsx

@@ -1,8 +1,6 @@
 import { createElement, useCallback, useEffect, useMemo, useState } from 'react'
 import { ExternalLink } from 'lucide-react'
-import { useParams } from 'next/navigation'
 import { Button, Combobox } from '@/components/emcn/components'
-import { writePendingCredentialCreateRequest } from '@/lib/credentials/client-state'
 import {
   getCanonicalScopesForProvider,
   getProviderIdFromServiceId,
@@ -13,7 +11,8 @@ import {
   parseProvider,
 } from '@/lib/oauth'
 import { OAuthRequiredModal } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/credential-selector/components/oauth-required-modal'
-import { useOAuthCredentials } from '@/hooks/queries/oauth-credentials'
+import { CREDENTIAL } from '@/executor/constants'
+import { useOAuthCredentialDetail, useOAuthCredentials } from '@/hooks/queries/oauth-credentials'
 import { getMissingRequiredScopes } from '@/hooks/use-oauth-scope-status'
 import { useWorkflowRegistry } from '@/stores/workflows/registry/store'
 
@@ -65,8 +64,6 @@ export function ToolCredentialSelector({
   serviceId,
   disabled = false,
 }: ToolCredentialSelectorProps) {
-  const params = useParams()
-  const workspaceId = (params?.workspaceId as string) || ''
   const [showOAuthModal, setShowOAuthModal] = useState(false)
   const [editingInputValue, setEditingInputValue] = useState('')
   const [isEditing, setIsEditing] = useState(false)
@@ -81,58 +78,50 @@ export function ToolCredentialSelector({
     data: credentials = [],
     isFetching: credentialsLoading,
     refetch: refetchCredentials,
-  } = useOAuthCredentials(effectiveProviderId, {
-    enabled: Boolean(effectiveProviderId),
-    workspaceId,
-    workflowId: activeWorkflowId || undefined,
-  })
+  } = useOAuthCredentials(effectiveProviderId, Boolean(effectiveProviderId))
 
   const selectedCredential = useMemo(
     () => credentials.find((cred) => cred.id === selectedId),
     [credentials, selectedId]
   )
 
-  const [inaccessibleCredentialName, setInaccessibleCredentialName] = useState<string | null>(null)
+  const shouldFetchForeignMeta =
+    Boolean(selectedId) &&
+    !selectedCredential &&
+    Boolean(activeWorkflowId) &&
+    Boolean(effectiveProviderId)
 
-  useEffect(() => {
-    if (!selectedId || selectedCredential || credentialsLoading || !workspaceId) {
-      setInaccessibleCredentialName(null)
-      return
-    }
+  const { data: foreignCredentials = [], isFetching: foreignMetaLoading } =
+    useOAuthCredentialDetail(
+      shouldFetchForeignMeta ? selectedId : undefined,
+      activeWorkflowId || undefined,
+      shouldFetchForeignMeta
+    )
 
-    let cancelled = false
-    ;(async () => {
-      try {
-        const response = await fetch(
-          `/api/credentials?workspaceId=${encodeURIComponent(workspaceId)}&credentialId=${encodeURIComponent(selectedId)}`
-        )
-        if (!response.ok || cancelled) return
-        const data = await response.json()
-        if (!cancelled && data.credential?.displayName) {
-          if (data.credential.id !== selectedId) {
-            onChange(data.credential.id)
-          }
-          setInaccessibleCredentialName(data.credential.displayName)
-        }
-      } catch {
-        // Ignore fetch errors
-      }
-    })()
-
-    return () => {
-      cancelled = true
-    }
-  }, [selectedId, selectedCredential, credentialsLoading, workspaceId])
+  const hasForeignMeta = foreignCredentials.length > 0
+  const isForeign = Boolean(selectedId && !selectedCredential && hasForeignMeta)
 
   const resolvedLabel = useMemo(() => {
     if (selectedCredential) return selectedCredential.name
-    if (inaccessibleCredentialName) return inaccessibleCredentialName
+    if (isForeign) return CREDENTIAL.FOREIGN_LABEL
     return ''
-  }, [selectedCredential, inaccessibleCredentialName, selectedId, credentialsLoading])
+  }, [selectedCredential, isForeign])
 
   const inputValue = isEditing ? editingInputValue : resolvedLabel
 
-  useCredentialRefreshTriggers(refetchCredentials, effectiveProviderId, workspaceId)
+  const invalidSelection =
+    Boolean(selectedId) &&
+    !selectedCredential &&
+    !hasForeignMeta &&
+    !credentialsLoading &&
+    !foreignMetaLoading
+
+  useEffect(() => {
+    if (!invalidSelection) return
+    onChange('')
+  }, [invalidSelection, onChange])
+
+  useCredentialRefreshTriggers(refetchCredentials)
 
   const handleOpenChange = useCallback(
     (isOpen: boolean) => {
@@ -160,18 +149,8 @@ export function ToolCredentialSelector({
   )
 
   const handleAddCredential = useCallback(() => {
-    writePendingCredentialCreateRequest({
-      workspaceId,
-      type: 'oauth',
-      providerId: effectiveProviderId,
-      displayName: '',
-      serviceId,
-      requiredScopes: getCanonicalScopesForProvider(effectiveProviderId),
-      requestedAt: Date.now(),
-    })
-
-    window.dispatchEvent(new CustomEvent('open-settings', { detail: { tab: 'credentials' } }))
-  }, [workspaceId, effectiveProviderId, serviceId])
+    setShowOAuthModal(true)
+  }, [])
 
   const comboboxOptions = useMemo(() => {
     const options = credentials.map((cred) => ({
@@ -179,13 +158,12 @@ export function ToolCredentialSelector({
       value: cred.id,
     }))
 
-    options.push({
-      label:
-        credentials.length > 0
-          ? `Connect another ${getProviderName(provider)} account`
-          : `Connect ${getProviderName(provider)} account`,
-      value: '__connect_account__',
-    })
+    if (credentials.length === 0) {
+      options.push({
+        label: `Connect ${getProviderName(provider)} account`,
+        value: '__connect_account__',
+      })
+    }
 
     return options
   }, [credentials, provider])
@@ -235,7 +213,7 @@ export function ToolCredentialSelector({
         placeholder={effectiveLabel}
         disabled={disabled}
         editable={true}
-        filterOptions={true}
+        filterOptions={!isForeign}
         isLoading={credentialsLoading}
         overlayContent={overlayContent}
         className={selectedId ? 'pl-[28px]' : ''}
@@ -247,13 +225,15 @@ export function ToolCredentialSelector({
             <span className='mr-[6px] inline-block h-[6px] w-[6px] rounded-[2px] bg-amber-500' />
             Additional permissions required
           </div>
-          <Button
-            variant='active'
-            onClick={() => setShowOAuthModal(true)}
-            className='w-full px-[8px] py-[4px] font-medium text-[12px]'
-          >
-            Update access
-          </Button>
+          {!isForeign && (
+            <Button
+              variant='active'
+              onClick={() => setShowOAuthModal(true)}
+              className='w-full px-[8px] py-[4px] font-medium text-[12px]'
+            >
+              Update access
+            </Button>
+          )}
         </div>
       )}
 
@@ -272,11 +252,7 @@ export function ToolCredentialSelector({
   )
 }
 
-function useCredentialRefreshTriggers(
-  refetchCredentials: () => Promise<unknown>,
-  providerId: string,
-  workspaceId: string
-) {
+function useCredentialRefreshTriggers(refetchCredentials: () => Promise<unknown>) {
   useEffect(() => {
     const refresh = () => {
       void refetchCredentials()
@@ -294,29 +270,12 @@ function useCredentialRefreshTriggers(
       }
     }
 
-    const handleCredentialsUpdated = (
-      event: CustomEvent<{ providerId?: string; workspaceId?: string }>
-    ) => {
-      if (event.detail?.providerId && event.detail.providerId !== providerId) {
-        return
-      }
-      if (event.detail?.workspaceId && workspaceId && event.detail.workspaceId !== workspaceId) {
-        return
-      }
-      refresh()
-    }
-
     document.addEventListener('visibilitychange', handleVisibilityChange)
     window.addEventListener('pageshow', handlePageShow)
-    window.addEventListener('oauth-credentials-updated', handleCredentialsUpdated as EventListener)
 
     return () => {
       document.removeEventListener('visibilitychange', handleVisibilityChange)
       window.removeEventListener('pageshow', handlePageShow)
-      window.removeEventListener(
-        'oauth-credentials-updated',
-        handleCredentialsUpdated as EventListener
-      )
     }
-  }, [providerId, workspaceId, refetchCredentials])
+  }, [refetchCredentials])
 }

apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/tool-input/components/tools/sub-block-renderer.tsx

@@ -1,9 +1,10 @@
 'use client'
 
 import { useEffect, useRef } from 'react'
-import { useSubBlockValue } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/hooks/use-sub-block-value'
 import { SubBlock } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/sub-block'
 import type { SubBlockConfig as BlockSubBlockConfig } from '@/blocks/types'
+import { useWorkflowRegistry } from '@/stores/workflows/registry/store'
+import { useSubBlockStore } from '@/stores/workflows/subblock/store'
 
 interface ToolSubBlockRendererProps {
   blockId: string
@@ -44,53 +45,43 @@ export function ToolSubBlockRenderer({
   canonicalToggle,
 }: ToolSubBlockRendererProps) {
   const syntheticId = `${subBlockId}-tool-${toolIndex}-${effectiveParamId}`
-  const [storeValue, setStoreValue] = useSubBlockValue(blockId, syntheticId)
-
   const toolParamValue = toolParams?.[effectiveParamId] ?? ''
   const isObjectType = OBJECT_SUBBLOCK_TYPES.has(subBlock.type)
 
-  const lastPushedToStoreRef = useRef<string | null>(null)
-  const lastPushedToParamsRef = useRef<string | null>(null)
+  const syncedRef = useRef<string | null>(null)
+  const onParamChangeRef = useRef(onParamChange)
+  onParamChangeRef.current = onParamChange
 
   useEffect(() => {
-    if (!toolParamValue && lastPushedToStoreRef.current === null) {
-      lastPushedToStoreRef.current = toolParamValue
-      lastPushedToParamsRef.current = toolParamValue
-      return
-    }
-    if (toolParamValue !== lastPushedToStoreRef.current) {
-      lastPushedToStoreRef.current = toolParamValue
-      lastPushedToParamsRef.current = toolParamValue
+    const unsub = useSubBlockStore.subscribe((state, prevState) => {
+      const wfId = useWorkflowRegistry.getState().activeWorkflowId
+      if (!wfId) return
+      const newVal = state.workflowValues[wfId]?.[blockId]?.[syntheticId]
+      const oldVal = prevState.workflowValues[wfId]?.[blockId]?.[syntheticId]
+      if (newVal === oldVal) return
+      const stringified =
+        newVal == null ? '' : typeof newVal === 'string' ? newVal : JSON.stringify(newVal)
+      if (stringified === syncedRef.current) return
+      syncedRef.current = stringified
+      onParamChangeRef.current(toolIndex, effectiveParamId, stringified)
+    })
+    return unsub
+  }, [blockId, syntheticId, toolIndex, effectiveParamId])
 
-      if (isObjectType && typeof toolParamValue === 'string' && toolParamValue) {
-        try {
-          const parsed = JSON.parse(toolParamValue)
-          if (typeof parsed === 'object' && parsed !== null) {
-            setStoreValue(parsed)
-            return
-          }
-        } catch {
-          // Not valid JSON — fall through to set as string
+  useEffect(() => {
+    if (toolParamValue === syncedRef.current) return
+    syncedRef.current = toolParamValue
+    if (isObjectType && toolParamValue) {
+      try {
+        const parsed = JSON.parse(toolParamValue)
+        if (typeof parsed === 'object' && parsed !== null) {
+          useSubBlockStore.getState().setValue(blockId, syntheticId, parsed)
+          return
         }
-      }
-      setStoreValue(toolParamValue)
+      } catch {}
     }
-  }, [toolParamValue, setStoreValue, isObjectType])
-
-  useEffect(() => {
-    if (storeValue == null && lastPushedToParamsRef.current === null) return
-    const stringValue =
-      storeValue == null
-        ? ''
-        : typeof storeValue === 'string'
-          ? storeValue
-          : JSON.stringify(storeValue)
-    if (stringValue !== lastPushedToParamsRef.current) {
-      lastPushedToParamsRef.current = stringValue
-      lastPushedToStoreRef.current = stringValue
-      onParamChange(toolIndex, effectiveParamId, stringValue)
-    }
-  }, [storeValue, toolIndex, effectiveParamId, onParamChange])
+    useSubBlockStore.getState().setValue(blockId, syntheticId, toolParamValue)
+  }, [toolParamValue, blockId, syntheticId, isObjectType])
 
   const visibility = subBlock.paramVisibility ?? 'user-or-llm'
   const isOptionalForUser = visibility !== 'user-only'

apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/tool-input/tool-input.tsx

@@ -1741,36 +1741,97 @@ export const ToolInput = memo(function ToolInput({
                     ) : null
                   })()}
 
-                  {requiresOAuth && oauthConfig && (
-                    <div className='relative min-w-0 space-y-[6px]'>
-                      <div className='font-medium text-[13px] text-[var(--text-primary)]'>
-                        Account <span className='ml-0.5'>*</span>
-                      </div>
-                      <div className='w-full min-w-0'>
-                        <ToolCredentialSelector
-                          value={tool.params?.credential || ''}
-                          onChange={(value: string) =>
-                            handleParamChange(toolIndex, 'credential', value)
-                          }
-                          provider={oauthConfig.provider as OAuthProvider}
-                          requiredScopes={
-                            toolBlock?.subBlocks?.find((sb) => sb.id === 'credential')
-                              ?.requiredScopes ||
-                            getCanonicalScopesForProvider(oauthConfig.provider)
-                          }
-                          serviceId={oauthConfig.provider}
-                          disabled={disabled}
-                        />
-                      </div>
-                    </div>
-                  )}
-
                   {(() => {
                     const renderedElements: React.ReactNode[] = []
 
+                    const showOAuth =
+                      requiresOAuth && oauthConfig && tool.params?.authMethod !== 'bot_token'
+
+                    const renderOAuthAccount = (): React.ReactNode => {
+                      if (!showOAuth || !oauthConfig) return null
+                      const credentialSubBlock = toolBlock?.subBlocks?.find(
+                        (s) => s.type === 'oauth-input'
+                      )
+                      return (
+                        <div key='oauth-account' className='relative min-w-0 space-y-[6px]'>
+                          <div className='font-medium text-[13px] text-[var(--text-primary)]'>
+                            {credentialSubBlock?.title || 'Account'}{' '}
+                            <span className='ml-0.5'>*</span>
+                          </div>
+                          <div className='w-full min-w-0'>
+                            <ToolCredentialSelector
+                              value={tool.params?.credential || ''}
+                              onChange={(value: string) =>
+                                handleParamChange(toolIndex, 'credential', value)
+                              }
+                              provider={oauthConfig.provider as OAuthProvider}
+                              requiredScopes={
+                                credentialSubBlock?.requiredScopes ||
+                                getCanonicalScopesForProvider(oauthConfig.provider)
+                              }
+                              serviceId={oauthConfig.provider}
+                              disabled={disabled}
+                            />
+                          </div>
+                        </div>
+                      )
+                    }
+
+                    const renderSubBlock = (sb: BlockSubBlockConfig): React.ReactNode => {
+                      const effectiveParamId = sb.id
+                      const canonicalId = toolCanonicalIndex?.canonicalIdBySubBlockId[sb.id]
+                      const canonicalGroup = canonicalId
+                        ? toolCanonicalIndex?.groupsById[canonicalId]
+                        : undefined
+                      const hasCanonicalPair = isCanonicalPair(canonicalGroup)
+                      const canonicalMode =
+                        canonicalGroup && hasCanonicalPair
+                          ? resolveCanonicalMode(
+                              canonicalGroup,
+                              { operation: tool.operation, ...tool.params },
+                              toolScopedOverrides
+                            )
+                          : undefined
+
+                      const canonicalToggleProp =
+                        hasCanonicalPair && canonicalMode && canonicalId
+                          ? {
+                              mode: canonicalMode,
+                              onToggle: () => {
+                                const nextMode = canonicalMode === 'advanced' ? 'basic' : 'advanced'
+                                collaborativeSetBlockCanonicalMode(
+                                  blockId,
+                                  `${tool.type}:${canonicalId}`,
+                                  nextMode
+                                )
+                              },
+                            }
+                          : undefined
+
+                      const sbWithTitle = sb.title
+                        ? sb
+                        : { ...sb, title: formatParameterLabel(effectiveParamId) }
+
+                      return (
+                        <ToolSubBlockRenderer
+                          key={sb.id}
+                          blockId={blockId}
+                          subBlockId={subBlockId}
+                          toolIndex={toolIndex}
+                          subBlock={sbWithTitle}
+                          effectiveParamId={effectiveParamId}
+                          toolParams={tool.params}
+                          onParamChange={handleParamChange}
+                          disabled={disabled}
+                          canonicalToggle={canonicalToggleProp}
+                        />
+                      )
+                    }
+
                     if (useSubBlocks && displaySubBlocks.length > 0) {
+                      const allBlockSubBlocks = toolBlock?.subBlocks || []
                       const coveredParamIds = new Set(
-                        displaySubBlocks.flatMap((sb) => {
+                        allBlockSubBlocks.flatMap((sb) => {
                           const ids = [sb.id]
                           if (sb.canonicalParamId) ids.push(sb.canonicalParamId)
                           const cId = toolCanonicalIndex?.canonicalIdBySubBlockId[sb.id]
@@ -1785,57 +1846,45 @@ export const ToolInput = memo(function ToolInput({
                         })
                       )
 
-                      displaySubBlocks.forEach((sb) => {
-                        const effectiveParamId = sb.id
-                        const canonicalId = toolCanonicalIndex?.canonicalIdBySubBlockId[sb.id]
-                        const canonicalGroup = canonicalId
-                          ? toolCanonicalIndex?.groupsById[canonicalId]
-                          : undefined
-                        const hasCanonicalPair = isCanonicalPair(canonicalGroup)
-                        const canonicalMode =
-                          canonicalGroup && hasCanonicalPair
-                            ? resolveCanonicalMode(
-                                canonicalGroup,
-                                { operation: tool.operation, ...tool.params },
-                                toolScopedOverrides
-                              )
-                            : undefined
+                      type RenderItem =
+                        | { kind: 'subblock'; sb: BlockSubBlockConfig }
+                        | { kind: 'oauth' }
 
-                        const canonicalToggleProp =
-                          hasCanonicalPair && canonicalMode && canonicalId
-                            ? {
-                                mode: canonicalMode,
-                                onToggle: () => {
-                                  const nextMode =
-                                    canonicalMode === 'advanced' ? 'basic' : 'advanced'
-                                  collaborativeSetBlockCanonicalMode(
-                                    blockId,
-                                    `${tool.type}:${canonicalId}`,
-                                    nextMode
-                                  )
-                                },
-                              }
-                            : undefined
+                      const renderOrder: RenderItem[] = displaySubBlocks.map((sb) => ({
+                        kind: 'subblock' as const,
+                        sb,
+                      }))
 
-                        const sbWithTitle = sb.title
-                          ? sb
-                          : { ...sb, title: formatParameterLabel(effectiveParamId) }
-
-                        renderedElements.push(
-                          <ToolSubBlockRenderer
-                            key={sb.id}
-                            blockId={blockId}
-                            subBlockId={subBlockId}
-                            toolIndex={toolIndex}
-                            subBlock={sbWithTitle}
-                            effectiveParamId={effectiveParamId}
-                            toolParams={tool.params}
-                            onParamChange={handleParamChange}
-                            disabled={disabled}
-                            canonicalToggle={canonicalToggleProp}
-                          />
+                      if (showOAuth) {
+                        const credentialIdx = allBlockSubBlocks.findIndex(
+                          (sb) => sb.type === 'oauth-input'
                         )
-                      })
+                        if (credentialIdx >= 0) {
+                          const sbPositions = new Map(allBlockSubBlocks.map((sb, i) => [sb.id, i]))
+                          const insertAt = renderOrder.findIndex(
+                            (item) =>
+                              item.kind === 'subblock' &&
+                              (sbPositions.get(item.sb.id) ?? Number.POSITIVE_INFINITY) >
+                                credentialIdx
+                          )
+                          if (insertAt === -1) {
+                            renderOrder.push({ kind: 'oauth' })
+                          } else {
+                            renderOrder.splice(insertAt, 0, { kind: 'oauth' })
+                          }
+                        } else {
+                          renderOrder.unshift({ kind: 'oauth' })
+                        }
+                      }
+
+                      for (const item of renderOrder) {
+                        if (item.kind === 'oauth') {
+                          const el = renderOAuthAccount()
+                          if (el) renderedElements.push(el)
+                        } else {
+                          renderedElements.push(renderSubBlock(item.sb))
+                        }
+                      }
 
                       const uncoveredParams = displayParams.filter(
                         (param) =>
@@ -1873,6 +1922,11 @@ export const ToolInput = memo(function ToolInput({
                       )
                     }
 
+                    {
+                      const el = renderOAuthAccount()
+                      if (el) renderedElements.push(el)
+                    }
+
                     const filteredParams = displayParams.filter((param) =>
                       evaluateParameterCondition(param, tool)
                     )

apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/hooks/use-foreign-credential.ts

@@ -0,0 +1,50 @@
+import { useEffect, useMemo, useState } from 'react'
+
+export function useForeignCredential(
+  provider: string | undefined,
+  credentialId: string | undefined
+) {
+  const [isForeign, setIsForeign] = useState<boolean>(false)
+  const [loading, setLoading] = useState<boolean>(false)
+  const [error, setError] = useState<string | null>(null)
+
+  const normalizedProvider = useMemo(() => (provider || '').toString(), [provider])
+  const normalizedCredentialId = useMemo(() => credentialId || '', [credentialId])
+
+  useEffect(() => {
+    let cancelled = false
+    async function check() {
+      setLoading(true)
+      setError(null)
+      try {
+        if (!normalizedProvider || !normalizedCredentialId) {
+          if (!cancelled) setIsForeign(false)
+          return
+        }
+        const res = await fetch(
+          `/api/auth/oauth/credentials?provider=${encodeURIComponent(normalizedProvider)}`
+        )
+        if (!res.ok) {
+          if (!cancelled) setIsForeign(true)
+          return
+        }
+        const data = await res.json()
+        const isOwn = (data.credentials || []).some((c: any) => c.id === normalizedCredentialId)
+        if (!cancelled) setIsForeign(!isOwn)
+      } catch (e) {
+        if (!cancelled) {
+          setIsForeign(true)
+          setError((e as Error).message)
+        }
+      } finally {
+        if (!cancelled) setLoading(false)
+      }
+    }
+    void check()
+    return () => {
+      cancelled = true
+    }
+  }, [normalizedProvider, normalizedCredentialId])
+
+  return { isForeignCredential: isForeign, loading, error }
+}

apps/sim/app/workspace/[workspaceId]/w/[workflowId]/workflow.tsx

@@ -255,69 +255,6 @@ const WorkflowContent = React.memo(() => {
 
   const addNotification = useNotificationStore((state) => state.addNotification)
 
-  useEffect(() => {
-    const OAUTH_CONNECT_PENDING_KEY = 'sim.oauth-connect-pending'
-    const pending = window.sessionStorage.getItem(OAUTH_CONNECT_PENDING_KEY)
-    if (!pending) return
-    window.sessionStorage.removeItem(OAUTH_CONNECT_PENDING_KEY)
-
-    ;(async () => {
-      try {
-        const {
-          displayName,
-          providerId,
-          preCount,
-          workspaceId: wsId,
-          reconnect,
-        } = JSON.parse(pending) as {
-          displayName: string
-          providerId: string
-          preCount: number
-          workspaceId: string
-          reconnect?: boolean
-        }
-
-        if (reconnect) {
-          addNotification({
-            level: 'info',
-            message: `"${displayName}" reconnected successfully.`,
-          })
-          window.dispatchEvent(
-            new CustomEvent('oauth-credentials-updated', {
-              detail: { providerId, workspaceId: wsId },
-            })
-          )
-          return
-        }
-
-        const response = await fetch(
-          `/api/credentials?workspaceId=${encodeURIComponent(wsId)}&type=oauth`
-        )
-        const data = response.ok ? await response.json() : { credentials: [] }
-        const oauthCredentials = (data.credentials ?? []) as Array<{
-          displayName: string
-          providerId: string | null
-        }>
-
-        if (oauthCredentials.length > preCount) {
-          addNotification({
-            level: 'info',
-            message: `"${displayName}" credential connected successfully.`,
-          })
-        } else {
-          const existing = oauthCredentials.find((c) => c.providerId === providerId)
-          const existingName = existing?.displayName || displayName
-          addNotification({
-            level: 'info',
-            message: `This account is already connected as "${existingName}".`,
-          })
-        }
-      } catch {
-        // Ignore malformed sessionStorage data
-      }
-    })()
-  }, [])
-
   const {
     workflows,
     activeWorkflowId,

apps/sim/app/workspace/[workspaceId]/w/components/preview/components/preview-editor/preview-editor.tsx

@@ -473,7 +473,7 @@ function ConnectionsSection({
           </div>
         )}
 
-        {/* Secrets */}
+        {/* Environment Variables */}
         {envVars.length > 0 && (
           <div className='mb-[2px] last:mb-0'>
             <div
@@ -489,7 +489,7 @@ function ConnectionsSection({
                   'text-[var(--text-secondary)] group-hover:text-[var(--text-primary)]'
                 )}
               >
-                Secrets
+                Environment Variables
               </span>
               <ChevronDownIcon
                 className={cn(

apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/settings-modal/components/credentials/credentials.tsx

@@ -1,17 +0,0 @@
-'use client'
-
-import { CredentialsManager } from '@/app/workspace/[workspaceId]/w/components/sidebar/components/settings-modal/components/credentials/credentials-manager'
-
-interface CredentialsProps {
-  onOpenChange?: (open: boolean) => void
-  registerCloseHandler?: (handler: (open: boolean) => void) => void
-  registerBeforeLeaveHandler?: (handler: (onProceed: () => void) => void) => void
-}
-
-export function Credentials(_props: CredentialsProps) {
-  return (
-    <div className='h-full min-h-0'>
-      <CredentialsManager />
-    </div>
-  )
-}

apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/settings-modal/components/environment/environment.tsx

@@ -134,7 +134,7 @@ function WorkspaceVariableRow({
               <Trash />
             </Button>
           </Tooltip.Trigger>
-          <Tooltip.Content>Delete secret</Tooltip.Content>
+          <Tooltip.Content>Delete environment variable</Tooltip.Content>
         </Tooltip.Root>
       </div>
     </div>
@@ -637,7 +637,7 @@ export function EnvironmentVariables({ registerBeforeLeaveHandler }: Environment
                     <Trash />
                   </Button>
                 </Tooltip.Trigger>
-                <Tooltip.Content>Delete secret</Tooltip.Content>
+                <Tooltip.Content>Delete environment variable</Tooltip.Content>
               </Tooltip.Root>
             </div>
           </div>
@@ -811,7 +811,7 @@ export function EnvironmentVariables({ registerBeforeLeaveHandler }: Environment
                   filteredWorkspaceEntries.length === 0 &&
                   (envVars.length > 0 || Object.keys(workspaceVars).length > 0) && (
                     <div className='py-[16px] text-center text-[13px] text-[var(--text-muted)]'>
-                      No secrets found matching "{searchTerm}"
+                      No environment variables found matching "{searchTerm}"
                     </div>
                   )}
               </>

apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/settings-modal/components/index.ts

@@ -2,7 +2,6 @@ export { ApiKeys } from './api-keys/api-keys'
 export { BYOK } from './byok/byok'
 export { Copilot } from './copilot/copilot'
 export { CredentialSets } from './credential-sets/credential-sets'
-export { Credentials } from './credentials/credentials'
 export { CustomTools } from './custom-tools/custom-tools'
 export { Debug } from './debug/debug'
 export { EnvironmentVariables } from './environment/environment'

apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/settings-modal/settings-modal.tsx

@@ -20,6 +20,7 @@ import {
 import {
   Card,
   Connections,
+  FolderCode,
   HexSimple,
   Key,
   SModal,
@@ -44,11 +45,12 @@ import {
   BYOK,
   Copilot,
   CredentialSets,
-  Credentials,
   CustomTools,
   Debug,
+  EnvironmentVariables,
   FileUploads,
   General,
+  Integrations,
   MCP,
   Skills,
   Subscription,
@@ -78,7 +80,6 @@ interface SettingsModalProps {
 
 type SettingsSection =
   | 'general'
-  | 'credentials'
   | 'environment'
   | 'template-profile'
   | 'integrations'
@@ -155,10 +156,11 @@ const allNavigationItems: NavigationItem[] = [
     requiresHosted: true,
     requiresTeam: true,
   },
-  { id: 'credentials', label: 'Credentials', icon: Connections, section: 'tools' },
+  { id: 'integrations', label: 'Integrations', icon: Connections, section: 'tools' },
   { id: 'custom-tools', label: 'Custom Tools', icon: Wrench, section: 'tools' },
   { id: 'skills', label: 'Skills', icon: AgentSkillsIcon, section: 'tools' },
   { id: 'mcp', label: 'MCP Tools', icon: McpIcon, section: 'tools' },
+  { id: 'environment', label: 'Environment', icon: FolderCode, section: 'system' },
   { id: 'apikeys', label: 'API Keys', icon: Key, section: 'system' },
   { id: 'workflow-mcp-servers', label: 'MCP Servers', icon: Server, section: 'system' },
   {
@@ -254,6 +256,9 @@ export function SettingsModal({ open, onOpenChange }: SettingsModalProps) {
       if (item.id === 'apikeys' && permissionConfig.hideApiKeysTab) {
         return false
       }
+      if (item.id === 'environment' && permissionConfig.hideEnvironmentTab) {
+        return false
+      }
       if (item.id === 'files' && permissionConfig.hideFilesTab) {
         return false
       }
@@ -319,9 +324,6 @@ export function SettingsModal({ open, onOpenChange }: SettingsModalProps) {
     if (!isBillingEnabled && (activeSection === 'subscription' || activeSection === 'team')) {
       return 'general'
     }
-    if (activeSection === 'environment' || activeSection === 'integrations') {
-      return 'credentials'
-    }
     return activeSection
   }, [activeSection])
 
@@ -340,7 +342,7 @@ export function SettingsModal({ open, onOpenChange }: SettingsModalProps) {
     (sectionId: SettingsSection) => {
       if (sectionId === effectiveActiveSection) return
 
-      if (effectiveActiveSection === 'credentials' && environmentBeforeLeaveHandler.current) {
+      if (effectiveActiveSection === 'environment' && environmentBeforeLeaveHandler.current) {
         environmentBeforeLeaveHandler.current(() => setActiveSection(sectionId))
         return
       }
@@ -368,11 +370,7 @@ export function SettingsModal({ open, onOpenChange }: SettingsModalProps) {
 
   useEffect(() => {
     const handleOpenSettings = (event: CustomEvent<{ tab: SettingsSection }>) => {
-      if (event.detail.tab === 'environment' || event.detail.tab === 'integrations') {
-        setActiveSection('credentials')
-      } else {
-        setActiveSection(event.detail.tab)
-      }
+      setActiveSection(event.detail.tab)
       onOpenChange(true)
     }
 
@@ -481,19 +479,13 @@ export function SettingsModal({ open, onOpenChange }: SettingsModalProps) {
   const handleDialogOpenChange = (newOpen: boolean) => {
     if (
       !newOpen &&
-      effectiveActiveSection === 'credentials' &&
+      effectiveActiveSection === 'environment' &&
       environmentBeforeLeaveHandler.current
     ) {
-      environmentBeforeLeaveHandler.current(() => {
-        if (integrationsCloseHandler.current) {
-          integrationsCloseHandler.current(newOpen)
-        } else {
-          onOpenChange(false)
-        }
-      })
+      environmentBeforeLeaveHandler.current(() => onOpenChange(false))
     } else if (
       !newOpen &&
-      effectiveActiveSection === 'credentials' &&
+      effectiveActiveSection === 'integrations' &&
       integrationsCloseHandler.current
     ) {
       integrationsCloseHandler.current(newOpen)
@@ -510,7 +502,7 @@ export function SettingsModal({ open, onOpenChange }: SettingsModalProps) {
         </VisuallyHidden.Root>
         <VisuallyHidden.Root>
           <DialogPrimitive.Description>
-            Configure your workspace settings, credentials, and preferences
+            Configure your workspace settings, environment variables, integrations, and preferences
           </DialogPrimitive.Description>
         </VisuallyHidden.Root>
 
@@ -547,14 +539,18 @@ export function SettingsModal({ open, onOpenChange }: SettingsModalProps) {
           </SModalMainHeader>
           <SModalMainBody>
             {effectiveActiveSection === 'general' && <General onOpenChange={onOpenChange} />}
-            {effectiveActiveSection === 'credentials' && (
-              <Credentials
-                onOpenChange={onOpenChange}
-                registerCloseHandler={registerIntegrationsCloseHandler}
+            {effectiveActiveSection === 'environment' && (
+              <EnvironmentVariables
                 registerBeforeLeaveHandler={registerEnvironmentBeforeLeaveHandler}
               />
             )}
             {effectiveActiveSection === 'template-profile' && <TemplateProfile />}
+            {effectiveActiveSection === 'integrations' && (
+              <Integrations
+                onOpenChange={onOpenChange}
+                registerCloseHandler={registerIntegrationsCloseHandler}
+              />
+            )}
             {effectiveActiveSection === 'credential-sets' && <CredentialSets />}
             {effectiveActiveSection === 'access-control' && <AccessControl />}
             {effectiveActiveSection === 'apikeys' && <ApiKeys onOpenChange={onOpenChange} />}

apps/sim/blocks/blocks/agent.ts

@@ -142,8 +142,6 @@ Return ONLY the JSON array.`,
       title: 'Google Cloud Account',
       type: 'oauth-input',
       serviceId: 'vertex-ai',
-      canonicalParamId: 'oauthCredential',
-      mode: 'basic',
       requiredScopes: ['https://www.googleapis.com/auth/cloud-platform'],
       placeholder: 'Select Google Cloud account',
       required: true,
@@ -152,19 +150,6 @@ Return ONLY the JSON array.`,
         value: providers.vertex.models,
       },
     },
-    {
-      id: 'manualCredential',
-      title: 'Google Cloud Account',
-      type: 'short-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'advanced',
-      placeholder: 'Enter credential ID',
-      required: true,
-      condition: {
-        field: 'model',
-        value: providers.vertex.models,
-      },
-    },
     {
       id: 'reasoningEffort',
       title: 'Reasoning Effort',
@@ -763,7 +748,6 @@ Example 3 (Array Input):
     apiKey: { type: 'string', description: 'Provider API key' },
     azureEndpoint: { type: 'string', description: 'Azure endpoint URL' },
     azureApiVersion: { type: 'string', description: 'Azure API version' },
-    oauthCredential: { type: 'string', description: 'OAuth credential for Vertex AI' },
     vertexProject: { type: 'string', description: 'Google Cloud project ID for Vertex AI' },
     vertexLocation: { type: 'string', description: 'Google Cloud location for Vertex AI' },
     bedrockAccessKeyId: { type: 'string', description: 'AWS Access Key ID for Bedrock' },

apps/sim/blocks/blocks/airtable.ts

@@ -32,8 +32,6 @@ export const AirtableBlock: BlockConfig<AirtableResponse> = {
       id: 'credential',
       title: 'Airtable Account',
       type: 'oauth-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'basic',
       serviceId: 'airtable',
       requiredScopes: [
         'data.records:read',
@@ -44,15 +42,6 @@ export const AirtableBlock: BlockConfig<AirtableResponse> = {
       placeholder: 'Select Airtable account',
       required: true,
     },
-    {
-      id: 'manualCredential',
-      title: 'Airtable Account',
-      type: 'short-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'advanced',
-      placeholder: 'Enter credential ID',
-      required: true,
-    },
     {
       id: 'baseId',
       title: 'Base ID',
@@ -230,7 +219,7 @@ Return ONLY the valid JSON object - no explanations, no markdown.`,
         }
       },
       params: (params) => {
-        const { oauthCredential, records, fields, ...rest } = params
+        const { credential, records, fields, ...rest } = params
         let parsedRecords: any | undefined
         let parsedFields: any | undefined
 
@@ -248,7 +237,7 @@ Return ONLY the valid JSON object - no explanations, no markdown.`,
 
         // Construct parameters based on operation
         const baseParams = {
-          credential: oauthCredential,
+          credential,
           ...rest,
         }
 
@@ -266,7 +255,7 @@ Return ONLY the valid JSON object - no explanations, no markdown.`,
   },
   inputs: {
     operation: { type: 'string', description: 'Operation to perform' },
-    oauthCredential: { type: 'string', description: 'Airtable access token' },
+    credential: { type: 'string', description: 'Airtable access token' },
     baseId: { type: 'string', description: 'Airtable base identifier' },
     tableId: { type: 'string', description: 'Airtable table identifier' },
     // Conditional inputs

apps/sim/blocks/blocks/asana.ts

@@ -32,22 +32,12 @@ export const AsanaBlock: BlockConfig<AsanaResponse> = {
       id: 'credential',
       title: 'Asana Account',
       type: 'oauth-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'basic',
+
       required: true,
       serviceId: 'asana',
       requiredScopes: ['default'],
       placeholder: 'Select Asana account',
     },
-    {
-      id: 'manualCredential',
-      title: 'Asana Account',
-      type: 'short-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'advanced',
-      placeholder: 'Enter credential ID',
-      required: true,
-    },
     {
       id: 'workspace',
       title: 'Workspace GID',
@@ -225,7 +215,7 @@ Return ONLY the date string in YYYY-MM-DD format - no explanations, no quotes, n
         }
       },
       params: (params) => {
-        const { oauthCredential, operation } = params
+        const { credential, operation } = params
 
         const projectsArray = params.projects
           ? params.projects
@@ -235,7 +225,7 @@ Return ONLY the date string in YYYY-MM-DD format - no explanations, no quotes, n
           : undefined
 
         const baseParams = {
-          accessToken: oauthCredential?.accessToken,
+          accessToken: credential?.accessToken,
         }
 
         switch (operation) {
@@ -294,7 +284,6 @@ Return ONLY the date string in YYYY-MM-DD format - no explanations, no quotes, n
   },
   inputs: {
     operation: { type: 'string', description: 'Operation to perform' },
-    oauthCredential: { type: 'string', description: 'Asana OAuth credential' },
     workspace: { type: 'string', description: 'Workspace GID' },
     taskGid: { type: 'string', description: 'Task GID' },
     getTasks_workspace: { type: 'string', description: 'Workspace GID for getting tasks' },

apps/sim/blocks/blocks/calcom.ts

@@ -49,20 +49,9 @@ export const CalComBlock: BlockConfig<ToolResponse> = {
       title: 'Cal.com Account',
       type: 'oauth-input',
       serviceId: 'calcom',
-      canonicalParamId: 'oauthCredential',
-      mode: 'basic',
       placeholder: 'Select Cal.com account',
       required: true,
     },
-    {
-      id: 'manualCredential',
-      title: 'Cal.com Account',
-      type: 'short-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'advanced',
-      placeholder: 'Enter credential ID',
-      required: true,
-    },
 
     // === Create Booking fields ===
     {
@@ -566,7 +555,7 @@ Return ONLY valid JSON - no explanations.`,
       params: (params) => {
         const {
           operation,
-          oauthCredential,
+          credential,
           attendeeName,
           attendeeEmail,
           attendeeTimeZone,
@@ -756,7 +745,7 @@ Return ONLY valid JSON - no explanations.`,
   },
   inputs: {
     operation: { type: 'string', description: 'Operation to perform' },
-    oauthCredential: { type: 'string', description: 'Cal.com OAuth credential' },
+    credential: { type: 'string', description: 'Cal.com OAuth credential' },
     eventTypeId: { type: 'number', description: 'Event type ID' },
     start: { type: 'string', description: 'Start time (ISO 8601)' },
     end: { type: 'string', description: 'End time (ISO 8601)' },

apps/sim/blocks/blocks/confluence.ts

@@ -51,8 +51,6 @@ export const ConfluenceBlock: BlockConfig<ConfluenceResponse> = {
       id: 'credential',
       title: 'Confluence Account',
       type: 'oauth-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'basic',
       serviceId: 'confluence',
       requiredScopes: [
         'read:confluence-content.all',
@@ -87,15 +85,6 @@ export const ConfluenceBlock: BlockConfig<ConfluenceResponse> = {
       placeholder: 'Select Confluence account',
       required: true,
     },
-    {
-      id: 'manualCredential',
-      title: 'Confluence Account',
-      type: 'short-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'advanced',
-      placeholder: 'Enter credential ID',
-      required: true,
-    },
     {
       id: 'pageId',
       title: 'Select Page',
@@ -298,7 +287,7 @@ export const ConfluenceBlock: BlockConfig<ConfluenceResponse> = {
       },
       params: (params) => {
         const {
-          oauthCredential,
+          credential,
           pageId,
           operation,
           attachmentFile,
@@ -311,7 +300,7 @@ export const ConfluenceBlock: BlockConfig<ConfluenceResponse> = {
 
         if (operation === 'upload_attachment') {
           return {
-            credential: oauthCredential,
+            credential,
             pageId: effectivePageId,
             operation,
             file: attachmentFile,
@@ -322,7 +311,7 @@ export const ConfluenceBlock: BlockConfig<ConfluenceResponse> = {
         }
 
         return {
-          credential: oauthCredential,
+          credential,
           pageId: effectivePageId || undefined,
           operation,
           ...rest,
@@ -333,7 +322,7 @@ export const ConfluenceBlock: BlockConfig<ConfluenceResponse> = {
   inputs: {
     operation: { type: 'string', description: 'Operation to perform' },
     domain: { type: 'string', description: 'Confluence domain' },
-    oauthCredential: { type: 'string', description: 'Confluence access token' },
+    credential: { type: 'string', description: 'Confluence access token' },
     pageId: { type: 'string', description: 'Page identifier (canonical param)' },
     spaceId: { type: 'string', description: 'Space identifier' },
     title: { type: 'string', description: 'Page title' },
@@ -439,8 +428,6 @@ export const ConfluenceV2Block: BlockConfig<ConfluenceResponse> = {
       id: 'credential',
       title: 'Confluence Account',
       type: 'oauth-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'basic',
       serviceId: 'confluence',
       requiredScopes: [
         'read:confluence-content.all',
@@ -475,15 +462,6 @@ export const ConfluenceV2Block: BlockConfig<ConfluenceResponse> = {
       placeholder: 'Select Confluence account',
       required: true,
     },
-    {
-      id: 'manualCredential',
-      title: 'Confluence Account',
-      type: 'short-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'advanced',
-      placeholder: 'Enter credential ID',
-      required: true,
-    },
     {
       id: 'domain',
       title: 'Domain',
@@ -965,7 +943,7 @@ export const ConfluenceV2Block: BlockConfig<ConfluenceResponse> = {
       },
       params: (params) => {
         const {
-          oauthCredential,
+          credential,
           pageId,
           operation,
           attachmentFile,
@@ -990,7 +968,7 @@ export const ConfluenceV2Block: BlockConfig<ConfluenceResponse> = {
 
         if (operation === 'add_label') {
           return {
-            credential: oauthCredential,
+            credential,
             pageId: effectivePageId,
             operation,
             prefix: labelPrefix || 'global',
@@ -1000,7 +978,7 @@ export const ConfluenceV2Block: BlockConfig<ConfluenceResponse> = {
 
         if (operation === 'create_blogpost') {
           return {
-            credential: oauthCredential,
+            credential,
             operation,
             status: blogPostStatus || 'current',
             ...rest,
@@ -1009,7 +987,7 @@ export const ConfluenceV2Block: BlockConfig<ConfluenceResponse> = {
 
         if (operation === 'delete') {
           return {
-            credential: oauthCredential,
+            credential,
             pageId: effectivePageId,
             operation,
             purge: purge || false,
@@ -1019,7 +997,7 @@ export const ConfluenceV2Block: BlockConfig<ConfluenceResponse> = {
 
         if (operation === 'list_comments') {
           return {
-            credential: oauthCredential,
+            credential,
             pageId: effectivePageId,
             operation,
             bodyFormat: bodyFormat || 'storage',
@@ -1045,7 +1023,7 @@ export const ConfluenceV2Block: BlockConfig<ConfluenceResponse> = {
 
         if (supportsCursor.includes(operation) && cursor) {
           return {
-            credential: oauthCredential,
+            credential,
             pageId: effectivePageId || undefined,
             operation,
             cursor,
@@ -1058,7 +1036,7 @@ export const ConfluenceV2Block: BlockConfig<ConfluenceResponse> = {
             throw new Error('Property key is required for this operation.')
           }
           return {
-            credential: oauthCredential,
+            credential,
             pageId: effectivePageId,
             operation,
             key: propertyKey,
@@ -1069,7 +1047,7 @@ export const ConfluenceV2Block: BlockConfig<ConfluenceResponse> = {
 
         if (operation === 'delete_page_property') {
           return {
-            credential: oauthCredential,
+            credential,
             pageId: effectivePageId,
             operation,
             propertyId,
@@ -1079,7 +1057,7 @@ export const ConfluenceV2Block: BlockConfig<ConfluenceResponse> = {
 
         if (operation === 'get_pages_by_label') {
           return {
-            credential: oauthCredential,
+            credential,
             operation,
             labelId,
             cursor: cursor || undefined,
@@ -1089,7 +1067,7 @@ export const ConfluenceV2Block: BlockConfig<ConfluenceResponse> = {
 
         if (operation === 'list_space_labels') {
           return {
-            credential: oauthCredential,
+            credential,
             operation,
             cursor: cursor || undefined,
             ...rest,
@@ -1102,7 +1080,7 @@ export const ConfluenceV2Block: BlockConfig<ConfluenceResponse> = {
             throw new Error('File is required for upload attachment operation.')
           }
           return {
-            credential: oauthCredential,
+            credential,
             pageId: effectivePageId,
             operation,
             file: normalizedFile,
@@ -1113,7 +1091,7 @@ export const ConfluenceV2Block: BlockConfig<ConfluenceResponse> = {
         }
 
         return {
-          credential: oauthCredential,
+          credential,
           pageId: effectivePageId || undefined,
           blogPostId: blogPostId || undefined,
           versionNumber: versionNumber ? Number.parseInt(String(versionNumber), 10) : undefined,
@@ -1126,7 +1104,7 @@ export const ConfluenceV2Block: BlockConfig<ConfluenceResponse> = {
   inputs: {
     operation: { type: 'string', description: 'Operation to perform' },
     domain: { type: 'string', description: 'Confluence domain' },
-    oauthCredential: { type: 'string', description: 'Confluence access token' },
+    credential: { type: 'string', description: 'Confluence access token' },
     pageId: { type: 'string', description: 'Page identifier (canonical param)' },
     spaceId: { type: 'string', description: 'Space identifier' },
     blogPostId: { type: 'string', description: 'Blog post identifier' },

apps/sim/blocks/blocks/dropbox.ts

@@ -38,8 +38,6 @@ export const DropboxBlock: BlockConfig<DropboxResponse> = {
       id: 'credential',
       title: 'Dropbox Account',
       type: 'oauth-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'basic',
       serviceId: 'dropbox',
       requiredScopes: [
         'account_info.read',
@@ -53,15 +51,6 @@ export const DropboxBlock: BlockConfig<DropboxResponse> = {
       placeholder: 'Select Dropbox account',
       required: true,
     },
-    {
-      id: 'manualCredential',
-      title: 'Dropbox Account',
-      type: 'short-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'advanced',
-      placeholder: 'Enter credential ID',
-      required: true,
-    },
     // Upload operation inputs
     {
       id: 'path',
@@ -363,7 +352,7 @@ Return ONLY the timestamp string - no explanations, no quotes, no extra text.`,
   },
   inputs: {
     operation: { type: 'string', description: 'Operation to perform' },
-    oauthCredential: { type: 'string', description: 'Dropbox OAuth credential' },
+    credential: { type: 'string', description: 'Dropbox OAuth credential' },
     // Common inputs
     path: { type: 'string', description: 'Path in Dropbox' },
     autorename: { type: 'boolean', description: 'Auto-rename on conflict' },

apps/sim/blocks/blocks/gmail.ts

@@ -76,8 +76,6 @@ export const GmailBlock: BlockConfig<GmailToolResponse> = {
       id: 'credential',
       title: 'Gmail Account',
       type: 'oauth-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'basic',
       serviceId: 'gmail',
       requiredScopes: [
         'https://www.googleapis.com/auth/gmail.send',
@@ -87,15 +85,6 @@ export const GmailBlock: BlockConfig<GmailToolResponse> = {
       placeholder: 'Select Gmail account',
       required: true,
     },
-    {
-      id: 'manualCredential',
-      title: 'Gmail Account',
-      type: 'short-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'advanced',
-      placeholder: 'Enter credential ID',
-      required: true,
-    },
     // Send Email Fields
     {
       id: 'to',
@@ -417,7 +406,7 @@ Return ONLY the search query - no explanations, no extra text.`,
       tool: selectGmailToolId,
       params: (params) => {
         const {
-          oauthCredential,
+          credential,
           folder,
           addLabelIds,
           removeLabelIds,
@@ -478,7 +467,7 @@ Return ONLY the search query - no explanations, no extra text.`,
 
         return {
           ...rest,
-          oauthCredential,
+          credential,
           ...(normalizedAttachments && { attachments: normalizedAttachments }),
         }
       },
@@ -486,7 +475,7 @@ Return ONLY the search query - no explanations, no extra text.`,
   },
   inputs: {
     operation: { type: 'string', description: 'Operation to perform' },
-    oauthCredential: { type: 'string', description: 'Gmail access token' },
+    credential: { type: 'string', description: 'Gmail access token' },
     // Send operation inputs
     to: { type: 'string', description: 'Recipient email address' },
     subject: { type: 'string', description: 'Email subject' },

apps/sim/blocks/blocks/google_calendar.ts

@@ -39,22 +39,11 @@ export const GoogleCalendarBlock: BlockConfig<GoogleCalendarResponse> = {
       id: 'credential',
       title: 'Google Calendar Account',
       type: 'oauth-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'basic',
       required: true,
       serviceId: 'google-calendar',
       requiredScopes: ['https://www.googleapis.com/auth/calendar'],
       placeholder: 'Select Google Calendar account',
     },
-    {
-      id: 'manualCredential',
-      title: 'Google Calendar Account',
-      type: 'short-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'advanced',
-      placeholder: 'Enter credential ID',
-      required: true,
-    },
     // Calendar selector (basic mode) - not needed for list_calendars
     {
       id: 'calendarId',
@@ -523,7 +512,7 @@ Return ONLY the natural language event text - no explanations.`,
       },
       params: (params) => {
         const {
-          oauthCredential,
+          credential,
           operation,
           attendees,
           replaceExisting,
@@ -587,7 +576,7 @@ Return ONLY the natural language event text - no explanations.`,
         }
 
         return {
-          oauthCredential,
+          credential,
           ...processedParams,
         }
       },
@@ -595,7 +584,7 @@ Return ONLY the natural language event text - no explanations.`,
   },
   inputs: {
     operation: { type: 'string', description: 'Operation to perform' },
-    oauthCredential: { type: 'string', description: 'Google Calendar access token' },
+    credential: { type: 'string', description: 'Google Calendar access token' },
     calendarId: { type: 'string', description: 'Calendar identifier (canonical param)' },
 
     // Create/Update operation inputs

apps/sim/blocks/blocks/google_docs.ts

@@ -32,8 +32,6 @@ export const GoogleDocsBlock: BlockConfig<GoogleDocsResponse> = {
       id: 'credential',
       title: 'Google Account',
       type: 'oauth-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'basic',
       required: true,
       serviceId: 'google-docs',
       requiredScopes: [
@@ -42,15 +40,6 @@ export const GoogleDocsBlock: BlockConfig<GoogleDocsResponse> = {
       ],
       placeholder: 'Select Google account',
     },
-    {
-      id: 'manualCredential',
-      title: 'Google Account',
-      type: 'short-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'advanced',
-      placeholder: 'Enter credential ID',
-      required: true,
-    },
     // Document selector (basic mode)
     {
       id: 'documentId',
@@ -168,7 +157,7 @@ Return ONLY the document content - no explanations, no extra text.`,
         }
       },
       params: (params) => {
-        const { oauthCredential, documentId, folderId, ...rest } = params
+        const { credential, documentId, folderId, ...rest } = params
 
         const effectiveDocumentId = documentId ? String(documentId).trim() : ''
         const effectiveFolderId = folderId ? String(folderId).trim() : ''
@@ -177,14 +166,14 @@ Return ONLY the document content - no explanations, no extra text.`,
           ...rest,
           documentId: effectiveDocumentId || undefined,
           folderId: effectiveFolderId || undefined,
-          oauthCredential,
+          credential,
         }
       },
     },
   },
   inputs: {
     operation: { type: 'string', description: 'Operation to perform' },
-    oauthCredential: { type: 'string', description: 'Google Docs access token' },
+    credential: { type: 'string', description: 'Google Docs access token' },
     documentId: { type: 'string', description: 'Document identifier (canonical param)' },
     title: { type: 'string', description: 'Document title' },
     folderId: { type: 'string', description: 'Parent folder identifier (canonical param)' },

apps/sim/blocks/blocks/google_drive.ts

@@ -44,8 +44,6 @@ export const GoogleDriveBlock: BlockConfig<GoogleDriveResponse> = {
       id: 'credential',
       title: 'Google Drive Account',
       type: 'oauth-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'basic',
       required: true,
       serviceId: 'google-drive',
       requiredScopes: [
@@ -54,15 +52,6 @@ export const GoogleDriveBlock: BlockConfig<GoogleDriveResponse> = {
       ],
       placeholder: 'Select Google Drive account',
     },
-    {
-      id: 'manualCredential',
-      title: 'Google Drive Account',
-      type: 'short-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'advanced',
-      placeholder: 'Enter credential ID',
-      required: true,
-    },
     // Create/Upload File Fields
     {
       id: 'fileName',
@@ -797,7 +786,7 @@ Return ONLY the message text - no subject line, no greetings/signatures, no extr
       },
       params: (params) => {
         const {
-          oauthCredential,
+          credential,
           // Folder canonical params (per-operation)
           uploadFolderId,
           createFolderParentId,
@@ -884,7 +873,7 @@ Return ONLY the message text - no subject line, no greetings/signatures, no extr
           sendNotification === 'true' ? true : sendNotification === 'false' ? false : undefined
 
         return {
-          oauthCredential,
+          credential,
           folderId: effectiveFolderId,
           fileId: effectiveFileId,
           destinationFolderId: effectiveDestinationFolderId,
@@ -902,7 +891,7 @@ Return ONLY the message text - no subject line, no greetings/signatures, no extr
   },
   inputs: {
     operation: { type: 'string', description: 'Operation to perform' },
-    oauthCredential: { type: 'string', description: 'Google Drive access token' },
+    credential: { type: 'string', description: 'Google Drive access token' },
     // Folder canonical params (per-operation)
     uploadFolderId: { type: 'string', description: 'Parent folder for upload/create' },
     createFolderParentId: { type: 'string', description: 'Parent folder for create folder' },

apps/sim/blocks/blocks/google_forms.ts

@@ -34,8 +34,6 @@ export const GoogleFormsBlock: BlockConfig = {
       id: 'credential',
       title: 'Google Account',
       type: 'oauth-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'basic',
       required: true,
       serviceId: 'google-forms',
       requiredScopes: [
@@ -47,15 +45,6 @@ export const GoogleFormsBlock: BlockConfig = {
       ],
       placeholder: 'Select Google account',
     },
-    {
-      id: 'manualCredential',
-      title: 'Google Account',
-      type: 'short-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'advanced',
-      placeholder: 'Enter credential ID',
-      required: true,
-    },
     // Form selector (basic mode)
     {
       id: 'formSelector',
@@ -244,7 +233,7 @@ Example for "Add a required multiple choice question about favorite color":
       },
       params: (params) => {
         const {
-          oauthCredential,
+          credential,
           operation,
           formId, // Canonical param from formSelector (basic) or manualFormId (advanced)
           responseId,
@@ -262,7 +251,7 @@ Example for "Add a required multiple choice question about favorite color":
           ...rest
         } = params
 
-        const baseParams = { ...rest, oauthCredential }
+        const baseParams = { ...rest, credential }
         const effectiveFormId = formId ? String(formId).trim() : undefined
 
         switch (operation) {
@@ -320,7 +309,7 @@ Example for "Add a required multiple choice question about favorite color":
   },
   inputs: {
     operation: { type: 'string', description: 'Operation to perform' },
-    oauthCredential: { type: 'string', description: 'Google OAuth credential' },
+    credential: { type: 'string', description: 'Google OAuth credential' },
     formId: { type: 'string', description: 'Google Form ID' },
     responseId: { type: 'string', description: 'Specific response ID' },
     pageSize: { type: 'string', description: 'Max responses to retrieve' },

apps/sim/blocks/blocks/google_groups.ts

@@ -42,8 +42,6 @@ export const GoogleGroupsBlock: BlockConfig = {
       id: 'credential',
       title: 'Google Groups Account',
       type: 'oauth-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'basic',
       required: true,
       serviceId: 'google-groups',
       requiredScopes: [
@@ -52,15 +50,6 @@ export const GoogleGroupsBlock: BlockConfig = {
       ],
       placeholder: 'Select Google Workspace account',
     },
-    {
-      id: 'manualCredential',
-      title: 'Google Groups Account',
-      type: 'short-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'advanced',
-      placeholder: 'Enter credential ID',
-      required: true,
-    },
 
     {
       id: 'customer',
@@ -322,12 +311,12 @@ Return ONLY the description text - no explanations, no quotes, no extra text.`,
         }
       },
       params: (params) => {
-        const { oauthCredential, operation, ...rest } = params
+        const { credential, operation, ...rest } = params
 
         switch (operation) {
           case 'list_groups':
             return {
-              oauthCredential,
+              credential,
               customer: rest.customer,
               domain: rest.domain,
               query: rest.query,
@@ -336,19 +325,19 @@ Return ONLY the description text - no explanations, no quotes, no extra text.`,
           case 'get_group':
           case 'delete_group':
             return {
-              credential: oauthCredential,
+              credential,
               groupKey: rest.groupKey,
             }
           case 'create_group':
             return {
-              credential: oauthCredential,
+              credential,
               email: rest.email,
               name: rest.name,
               description: rest.description,
             }
           case 'update_group':
             return {
-              credential: oauthCredential,
+              credential,
               groupKey: rest.groupKey,
               name: rest.newName,
               email: rest.newEmail,
@@ -356,7 +345,7 @@ Return ONLY the description text - no explanations, no quotes, no extra text.`,
             }
           case 'list_members':
             return {
-              credential: oauthCredential,
+              credential,
               groupKey: rest.groupKey,
               maxResults: rest.maxResults ? Number(rest.maxResults) : undefined,
               roles: rest.roles,
@@ -364,66 +353,66 @@ Return ONLY the description text - no explanations, no quotes, no extra text.`,
           case 'get_member':
           case 'remove_member':
             return {
-              credential: oauthCredential,
+              credential,
               groupKey: rest.groupKey,
               memberKey: rest.memberKey,
             }
           case 'add_member':
             return {
-              credential: oauthCredential,
+              credential,
               groupKey: rest.groupKey,
               email: rest.memberEmail,
               role: rest.role,
             }
           case 'update_member':
             return {
-              credential: oauthCredential,
+              credential,
               groupKey: rest.groupKey,
               memberKey: rest.memberKey,
               role: rest.role,
             }
           case 'has_member':
             return {
-              credential: oauthCredential,
+              credential,
               groupKey: rest.groupKey,
               memberKey: rest.memberKey,
             }
           case 'list_aliases':
             return {
-              credential: oauthCredential,
+              credential,
               groupKey: rest.groupKey,
             }
           case 'add_alias':
             return {
-              credential: oauthCredential,
+              credential,
               groupKey: rest.groupKey,
               alias: rest.alias,
             }
           case 'remove_alias':
             return {
-              oauthCredential,
+              credential,
               groupKey: rest.groupKey,
               alias: rest.alias,
             }
           case 'get_settings':
             return {
-              oauthCredential,
+              credential,
               groupEmail: rest.groupEmail,
             }
           case 'update_settings':
             return {
-              oauthCredential,
+              credential,
               groupEmail: rest.groupEmail,
             }
           default:
-            return { oauthCredential, ...rest }
+            return { credential, ...rest }
         }
       },
     },
   },
   inputs: {
     operation: { type: 'string', description: 'Operation to perform' },
-    oauthCredential: { type: 'string', description: 'Google Workspace OAuth credential' },
+    credential: { type: 'string', description: 'Google Workspace OAuth credential' },
     customer: { type: 'string', description: 'Customer ID for listing groups' },
     domain: { type: 'string', description: 'Domain filter for listing groups' },
     query: { type: 'string', description: 'Search query for filtering groups' },

apps/sim/blocks/blocks/google_sheets.ts

@@ -36,8 +36,6 @@ export const GoogleSheetsBlock: BlockConfig<GoogleSheetsResponse> = {
       id: 'credential',
       title: 'Google Account',
       type: 'oauth-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'basic',
       required: true,
       serviceId: 'google-sheets',
       requiredScopes: [
@@ -46,15 +44,6 @@ export const GoogleSheetsBlock: BlockConfig<GoogleSheetsResponse> = {
       ],
       placeholder: 'Select Google account',
     },
-    {
-      id: 'manualCredential',
-      title: 'Google Account',
-      type: 'short-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'advanced',
-      placeholder: 'Enter credential ID',
-      required: true,
-    },
     // Spreadsheet Selector
     {
       id: 'spreadsheetId',
@@ -257,7 +246,7 @@ Return ONLY the JSON array - no explanations, no markdown, no extra text.`,
         }
       },
       params: (params) => {
-        const { oauthCredential, values, spreadsheetId, ...rest } = params
+        const { credential, values, spreadsheetId, ...rest } = params
 
         const parsedValues = values ? JSON.parse(values as string) : undefined
 
@@ -271,14 +260,14 @@ Return ONLY the JSON array - no explanations, no markdown, no extra text.`,
           ...rest,
           spreadsheetId: effectiveSpreadsheetId,
           values: parsedValues,
-          oauthCredential,
+          credential,
         }
       },
     },
   },
   inputs: {
     operation: { type: 'string', description: 'Operation to perform' },
-    oauthCredential: { type: 'string', description: 'Google Sheets access token' },
+    credential: { type: 'string', description: 'Google Sheets access token' },
     spreadsheetId: { type: 'string', description: 'Spreadsheet identifier (canonical param)' },
     range: { type: 'string', description: 'Cell range' },
     values: { type: 'string', description: 'Cell values data' },
@@ -334,8 +323,6 @@ export const GoogleSheetsV2Block: BlockConfig<GoogleSheetsV2Response> = {
       id: 'credential',
       title: 'Google Account',
       type: 'oauth-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'basic',
       required: true,
       serviceId: 'google-sheets',
       requiredScopes: [
@@ -344,15 +331,6 @@ export const GoogleSheetsV2Block: BlockConfig<GoogleSheetsV2Response> = {
       ],
       placeholder: 'Select Google account',
     },
-    {
-      id: 'manualCredential',
-      title: 'Google Account',
-      type: 'short-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'advanced',
-      placeholder: 'Enter credential ID',
-      required: true,
-    },
     // Spreadsheet Selector (basic mode) - not for create operation
     {
       id: 'spreadsheetId',
@@ -737,7 +715,7 @@ Return ONLY the JSON array - no explanations, no markdown, no extra text.`,
       }),
       params: (params) => {
         const {
-          oauthCredential,
+          credential,
           values,
           spreadsheetId,
           sheetName,
@@ -761,7 +739,7 @@ Return ONLY the JSON array - no explanations, no markdown, no extra text.`,
           return {
             title: (title as string)?.trim(),
             sheetTitles: sheetTitlesArray,
-            oauthCredential,
+            credential,
           }
         }
 
@@ -775,7 +753,7 @@ Return ONLY the JSON array - no explanations, no markdown, no extra text.`,
         if (operation === 'get_info') {
           return {
             spreadsheetId: effectiveSpreadsheetId,
-            oauthCredential,
+            credential,
           }
         }
 
@@ -785,7 +763,7 @@ Return ONLY the JSON array - no explanations, no markdown, no extra text.`,
           return {
             spreadsheetId: effectiveSpreadsheetId,
             ranges: parsedRanges,
-            oauthCredential,
+            credential,
           }
         }
 
@@ -796,7 +774,7 @@ Return ONLY the JSON array - no explanations, no markdown, no extra text.`,
             ...rest,
             spreadsheetId: effectiveSpreadsheetId,
             data: parsedData,
-            oauthCredential,
+            credential,
           }
         }
 
@@ -806,7 +784,7 @@ Return ONLY the JSON array - no explanations, no markdown, no extra text.`,
           return {
             spreadsheetId: effectiveSpreadsheetId,
             ranges: parsedRanges,
-            oauthCredential,
+            credential,
           }
         }
 
@@ -816,7 +794,7 @@ Return ONLY the JSON array - no explanations, no markdown, no extra text.`,
             sourceSpreadsheetId: effectiveSpreadsheetId,
             sheetId: Number.parseInt(sheetId as string, 10),
             destinationSpreadsheetId: (destinationSpreadsheetId as string)?.trim(),
-            oauthCredential,
+            credential,
           }
         }
 
@@ -835,14 +813,14 @@ Return ONLY the JSON array - no explanations, no markdown, no extra text.`,
           sheetName: effectiveSheetName,
           cellRange: cellRange ? (cellRange as string).trim() : undefined,
           values: parsedValues,
-          oauthCredential,
+          credential,
         }
       },
     },
   },
   inputs: {
     operation: { type: 'string', description: 'Operation to perform' },
-    oauthCredential: { type: 'string', description: 'Google Sheets access token' },
+    credential: { type: 'string', description: 'Google Sheets access token' },
     spreadsheetId: { type: 'string', description: 'Spreadsheet identifier (canonical param)' },
     sheetName: { type: 'string', description: 'Name of the sheet/tab (canonical param)' },
     cellRange: { type: 'string', description: 'Cell range (e.g., A1:D10)' },

apps/sim/blocks/blocks/google_slides.ts

@@ -46,8 +46,6 @@ export const GoogleSlidesBlock: BlockConfig<GoogleSlidesResponse> = {
       id: 'credential',
       title: 'Google Account',
       type: 'oauth-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'basic',
       required: true,
       serviceId: 'google-drive',
       requiredScopes: [
@@ -56,15 +54,6 @@ export const GoogleSlidesBlock: BlockConfig<GoogleSlidesResponse> = {
       ],
       placeholder: 'Select Google account',
     },
-    {
-      id: 'manualCredential',
-      title: 'Google Account',
-      type: 'short-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'advanced',
-      placeholder: 'Enter credential ID',
-      required: true,
-    },
     // Presentation selector (basic mode) - for operations that need an existing presentation
     {
       id: 'presentationId',
@@ -673,7 +662,7 @@ Return ONLY the text content - no explanations, no markdown formatting markers,
       },
       params: (params) => {
         const {
-          oauthCredential,
+          credential,
           presentationId,
           folderId,
           slideIndex,
@@ -690,7 +679,7 @@ Return ONLY the text content - no explanations, no markdown formatting markers,
         const result: Record<string, any> = {
           ...rest,
           presentationId: effectivePresentationId || undefined,
-          oauthCredential,
+          credential,
         }
 
         // Handle operation-specific params
@@ -810,7 +799,7 @@ Return ONLY the text content - no explanations, no markdown formatting markers,
   },
   inputs: {
     operation: { type: 'string', description: 'Operation to perform' },
-    oauthCredential: { type: 'string', description: 'Google Slides access token' },
+    credential: { type: 'string', description: 'Google Slides access token' },
     presentationId: { type: 'string', description: 'Presentation identifier (canonical param)' },
     // Write operation
     slideIndex: { type: 'number', description: 'Slide index to write to' },

apps/sim/blocks/blocks/google_vault.ts

@@ -34,8 +34,6 @@ export const GoogleVaultBlock: BlockConfig = {
       id: 'credential',
       title: 'Google Vault Account',
       type: 'oauth-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'basic',
       required: true,
       serviceId: 'google-vault',
       requiredScopes: [
@@ -44,15 +42,6 @@ export const GoogleVaultBlock: BlockConfig = {
       ],
       placeholder: 'Select Google Vault account',
     },
-    {
-      id: 'manualCredential',
-      title: 'Google Vault Account',
-      type: 'short-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'advanced',
-      placeholder: 'Enter credential ID',
-      required: true,
-    },
     // Create Hold inputs
     {
       id: 'matterId',
@@ -449,10 +438,10 @@ Return ONLY the description text - no explanations, no quotes, no extra text.`,
         }
       },
       params: (params) => {
-        const { oauthCredential, holdStartTime, holdEndTime, holdTerms, ...rest } = params
+        const { credential, holdStartTime, holdEndTime, holdTerms, ...rest } = params
         return {
           ...rest,
-          oauthCredential,
+          credential,
           // Map hold-specific fields to their tool parameter names
           ...(holdStartTime && { startTime: holdStartTime }),
           ...(holdEndTime && { endTime: holdEndTime }),
@@ -464,7 +453,7 @@ Return ONLY the description text - no explanations, no quotes, no extra text.`,
   inputs: {
     // Core inputs
     operation: { type: 'string', description: 'Operation to perform' },
-    oauthCredential: { type: 'string', description: 'Google Vault OAuth credential' },
+    credential: { type: 'string', description: 'Google Vault OAuth credential' },
     matterId: { type: 'string', description: 'Matter ID' },
 
     // Create export inputs

apps/sim/blocks/blocks/hubspot.ts

@@ -39,8 +39,6 @@ export const HubSpotBlock: BlockConfig<HubSpotResponse> = {
       id: 'credential',
       title: 'HubSpot Account',
       type: 'oauth-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'basic',
       serviceId: 'hubspot',
       requiredScopes: [
         'crm.objects.contacts.read',
@@ -70,15 +68,6 @@ export const HubSpotBlock: BlockConfig<HubSpotResponse> = {
       placeholder: 'Select HubSpot account',
       required: true,
     },
-    {
-      id: 'manualCredential',
-      title: 'HubSpot Account',
-      type: 'short-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'advanced',
-      placeholder: 'Enter credential ID',
-      required: true,
-    },
     {
       id: 'contactId',
       title: 'Contact ID or Email',
@@ -834,7 +823,7 @@ Return ONLY the JSON array of property names - no explanations, no markdown, no
       },
       params: (params) => {
         const {
-          oauthCredential,
+          credential,
           operation,
           propertiesToSet,
           properties,
@@ -846,7 +835,7 @@ Return ONLY the JSON array of property names - no explanations, no markdown, no
         } = params
 
         const cleanParams: Record<string, any> = {
-          oauthCredential,
+          credential,
         }
 
         const createUpdateOps = [
@@ -901,7 +890,7 @@ Return ONLY the JSON array of property names - no explanations, no markdown, no
   },
   inputs: {
     operation: { type: 'string', description: 'Operation to perform' },
-    oauthCredential: { type: 'string', description: 'HubSpot access token' },
+    credential: { type: 'string', description: 'HubSpot access token' },
     contactId: { type: 'string', description: 'Contact ID or email' },
     companyId: { type: 'string', description: 'Company ID or domain' },
     idProperty: { type: 'string', description: 'Property name to use as unique identifier' },

apps/sim/blocks/blocks/jira.ts

@@ -60,8 +60,6 @@ export const JiraBlock: BlockConfig<JiraResponse> = {
       id: 'credential',
       title: 'Jira Account',
       type: 'oauth-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'basic',
       required: true,
       serviceId: 'jira',
       requiredScopes: [
@@ -98,15 +96,6 @@ export const JiraBlock: BlockConfig<JiraResponse> = {
       ],
       placeholder: 'Select Jira account',
     },
-    {
-      id: 'manualCredential',
-      title: 'Jira Account',
-      type: 'short-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'advanced',
-      placeholder: 'Enter credential ID',
-      required: true,
-    },
     // Project selector (basic mode)
     {
       id: 'projectId',
@@ -800,14 +789,14 @@ Return ONLY the comment text - no explanations.`,
         }
       },
       params: (params) => {
-        const { oauthCredential, projectId, issueKey, ...rest } = params
+        const { credential, projectId, issueKey, ...rest } = params
 
         // Use canonical param IDs (raw subBlock IDs are deleted after serialization)
         const effectiveProjectId = projectId ? String(projectId).trim() : ''
         const effectiveIssueKey = issueKey ? String(issueKey).trim() : ''
 
         const baseParams = {
-          oauthCredential,
+          credential,
           domain: params.domain,
         }
 
@@ -1060,7 +1049,7 @@ Return ONLY the comment text - no explanations.`,
   inputs: {
     operation: { type: 'string', description: 'Operation to perform' },
     domain: { type: 'string', description: 'Jira domain' },
-    oauthCredential: { type: 'string', description: 'Jira access token' },
+    credential: { type: 'string', description: 'Jira access token' },
     issueKey: { type: 'string', description: 'Issue key identifier (canonical param)' },
     projectId: { type: 'string', description: 'Project identifier (canonical param)' },
     // Update/Write operation inputs

apps/sim/blocks/blocks/jira_service_management.ts

@@ -55,8 +55,6 @@ export const JiraServiceManagementBlock: BlockConfig<JsmResponse> = {
       id: 'credential',
       title: 'Jira Account',
       type: 'oauth-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'basic',
       required: true,
       serviceId: 'jira',
       requiredScopes: [
@@ -97,15 +95,6 @@ export const JiraServiceManagementBlock: BlockConfig<JsmResponse> = {
       ],
       placeholder: 'Select Jira account',
     },
-    {
-      id: 'manualCredential',
-      title: 'Jira Account',
-      type: 'short-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'advanced',
-      placeholder: 'Enter credential ID',
-      required: true,
-    },
     {
       id: 'serviceDeskId',
       title: 'Service Desk ID',
@@ -504,7 +493,7 @@ Return ONLY the comment text - no explanations.`,
       },
       params: (params) => {
         const baseParams = {
-          oauthCredential: params.oauthCredential,
+          credential: params.credential,
           domain: params.domain,
         }
 
@@ -751,7 +740,7 @@ Return ONLY the comment text - no explanations.`,
   inputs: {
     operation: { type: 'string', description: 'Operation to perform' },
     domain: { type: 'string', description: 'Jira domain' },
-    oauthCredential: { type: 'string', description: 'Jira Service Management access token' },
+    credential: { type: 'string', description: 'Jira Service Management access token' },
     serviceDeskId: { type: 'string', description: 'Service desk ID' },
     requestTypeId: { type: 'string', description: 'Request type ID' },
     issueIdOrKey: { type: 'string', description: 'Issue ID or key' },

apps/sim/blocks/blocks/linear.ts

@@ -129,22 +129,11 @@ export const LinearBlock: BlockConfig<LinearResponse> = {
       id: 'credential',
       title: 'Linear Account',
       type: 'oauth-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'basic',
       serviceId: 'linear',
       requiredScopes: ['read', 'write'],
       placeholder: 'Select Linear account',
       required: true,
     },
-    {
-      id: 'manualCredential',
-      title: 'Linear Account',
-      type: 'short-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'advanced',
-      placeholder: 'Enter credential ID',
-      required: true,
-    },
     // Team selector (for most operations)
     {
       id: 'teamId',
@@ -1515,7 +1504,7 @@ Return ONLY the date string in YYYY-MM-DD format - no explanations, no quotes, n
 
         // Base params that most operations need
         const baseParams: Record<string, any> = {
-          oauthCredential: params.oauthCredential,
+          credential: params.credential,
         }
 
         // Operation-specific param mapping
@@ -2334,7 +2323,7 @@ Return ONLY the date string in YYYY-MM-DD format - no explanations, no quotes, n
   },
   inputs: {
     operation: { type: 'string', description: 'Operation to perform' },
-    oauthCredential: { type: 'string', description: 'Linear access token' },
+    credential: { type: 'string', description: 'Linear access token' },
     teamId: { type: 'string', description: 'Linear team identifier (canonical param)' },
     projectId: { type: 'string', description: 'Linear project identifier (canonical param)' },
     issueId: { type: 'string', description: 'Issue identifier' },

apps/sim/blocks/blocks/linkedin.ts

@@ -33,21 +33,10 @@ export const LinkedInBlock: BlockConfig<LinkedInResponse> = {
       title: 'LinkedIn Account',
       type: 'oauth-input',
       serviceId: 'linkedin',
-      canonicalParamId: 'oauthCredential',
-      mode: 'basic',
       requiredScopes: ['profile', 'openid', 'email', 'w_member_social'],
       placeholder: 'Select LinkedIn account',
       required: true,
     },
-    {
-      id: 'manualCredential',
-      title: 'LinkedIn Account',
-      type: 'short-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'advanced',
-      placeholder: 'Enter credential ID',
-      required: true,
-    },
 
     // Share Post specific fields
     {
@@ -91,25 +80,25 @@ export const LinkedInBlock: BlockConfig<LinkedInResponse> = {
       },
       params: (inputs) => {
         const operation = inputs.operation || 'share_post'
-        const { oauthCredential, ...rest } = inputs
+        const { credential, ...rest } = inputs
 
         if (operation === 'get_profile') {
           return {
-            accessToken: oauthCredential,
+            accessToken: credential,
           }
         }
 
         return {
           text: rest.text,
           visibility: rest.visibility || 'PUBLIC',
-          accessToken: oauthCredential,
+          accessToken: credential,
         }
       },
     },
   },
   inputs: {
     operation: { type: 'string', description: 'Operation to perform' },
-    oauthCredential: { type: 'string', description: 'LinkedIn access token' },
+    credential: { type: 'string', description: 'LinkedIn access token' },
     text: { type: 'string', description: 'Post text content' },
     visibility: { type: 'string', description: 'Post visibility (PUBLIC or CONNECTIONS)' },
   },

apps/sim/blocks/blocks/microsoft_excel.ts

@@ -36,8 +36,6 @@ export const MicrosoftExcelBlock: BlockConfig<MicrosoftExcelResponse> = {
       id: 'credential',
       title: 'Microsoft Account',
       type: 'oauth-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'basic',
       serviceId: 'microsoft-excel',
       requiredScopes: [
         'openid',
@@ -50,15 +48,6 @@ export const MicrosoftExcelBlock: BlockConfig<MicrosoftExcelResponse> = {
       placeholder: 'Select Microsoft account',
       required: true,
     },
-    {
-      id: 'manualCredential',
-      title: 'Microsoft Account',
-      type: 'short-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'advanced',
-      placeholder: 'Enter credential ID',
-      required: true,
-    },
     {
       id: 'spreadsheetId',
       title: 'Select Sheet',
@@ -252,7 +241,7 @@ Return ONLY the JSON array - no explanations, no markdown, no extra text.`,
         }
       },
       params: (params) => {
-        const { oauthCredential, values, spreadsheetId, tableName, worksheetName, ...rest } = params
+        const { credential, values, spreadsheetId, tableName, worksheetName, ...rest } = params
 
         // Use canonical param ID (raw subBlock IDs are deleted after serialization)
         const effectiveSpreadsheetId = spreadsheetId ? String(spreadsheetId).trim() : ''
@@ -280,7 +269,7 @@ Return ONLY the JSON array - no explanations, no markdown, no extra text.`,
           ...rest,
           spreadsheetId: effectiveSpreadsheetId,
           values: parsedValues,
-          oauthCredential,
+          credential,
         }
 
         if (params.operation === 'table_add') {
@@ -303,7 +292,7 @@ Return ONLY the JSON array - no explanations, no markdown, no extra text.`,
   },
   inputs: {
     operation: { type: 'string', description: 'Operation to perform' },
-    oauthCredential: { type: 'string', description: 'Microsoft Excel access token' },
+    credential: { type: 'string', description: 'Microsoft Excel access token' },
     spreadsheetId: { type: 'string', description: 'Spreadsheet identifier (canonical param)' },
     range: { type: 'string', description: 'Cell range' },
     tableName: { type: 'string', description: 'Table name' },
@@ -362,8 +351,6 @@ export const MicrosoftExcelV2Block: BlockConfig<MicrosoftExcelV2Response> = {
       id: 'credential',
       title: 'Microsoft Account',
       type: 'oauth-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'basic',
       serviceId: 'microsoft-excel',
       requiredScopes: [
         'openid',
@@ -376,15 +363,6 @@ export const MicrosoftExcelV2Block: BlockConfig<MicrosoftExcelV2Response> = {
       placeholder: 'Select Microsoft account',
       required: true,
     },
-    {
-      id: 'manualCredential',
-      title: 'Microsoft Account',
-      type: 'short-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'advanced',
-      placeholder: 'Enter credential ID',
-      required: true,
-    },
     // Spreadsheet Selector (basic mode)
     {
       id: 'spreadsheetId',
@@ -519,7 +497,7 @@ Return ONLY the JSON array - no explanations, no markdown, no extra text.`,
         fallbackToolId: 'microsoft_excel_read_v2',
       }),
       params: (params) => {
-        const { oauthCredential, values, spreadsheetId, sheetName, cellRange, ...rest } = params
+        const { credential, values, spreadsheetId, sheetName, cellRange, ...rest } = params
 
         const parsedValues = values ? JSON.parse(values as string) : undefined
 
@@ -541,14 +519,14 @@ Return ONLY the JSON array - no explanations, no markdown, no extra text.`,
           sheetName: effectiveSheetName,
           cellRange: cellRange ? (cellRange as string).trim() : undefined,
           values: parsedValues,
-          oauthCredential,
+          credential,
         }
       },
     },
   },
   inputs: {
     operation: { type: 'string', description: 'Operation to perform' },
-    oauthCredential: { type: 'string', description: 'Microsoft Excel access token' },
+    credential: { type: 'string', description: 'Microsoft Excel access token' },
     spreadsheetId: { type: 'string', description: 'Spreadsheet identifier (canonical param)' },
     sheetName: { type: 'string', description: 'Name of the sheet/tab (canonical param)' },
     cellRange: { type: 'string', description: 'Cell range (e.g., A1:D10)' },

apps/sim/blocks/blocks/microsoft_planner.ts

@@ -4,7 +4,7 @@ import { AuthMode } from '@/blocks/types'
 import type { MicrosoftPlannerResponse } from '@/tools/microsoft_planner/types'
 
 interface MicrosoftPlannerBlockParams {
-  oauthCredential: string
+  credential: string
   accessToken?: string
   planId?: string
   taskId?: string
@@ -61,8 +61,6 @@ export const MicrosoftPlannerBlock: BlockConfig<MicrosoftPlannerResponse> = {
       id: 'credential',
       title: 'Microsoft Account',
       type: 'oauth-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'basic',
       serviceId: 'microsoft-planner',
       requiredScopes: [
         'openid',
@@ -75,14 +73,6 @@ export const MicrosoftPlannerBlock: BlockConfig<MicrosoftPlannerResponse> = {
       ],
       placeholder: 'Select Microsoft account',
     },
-    {
-      id: 'manualCredential',
-      title: 'Microsoft Account',
-      type: 'short-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'advanced',
-      placeholder: 'Enter credential ID',
-    },
 
     // Plan ID - for various operations
     {
@@ -360,7 +350,7 @@ Return ONLY the timestamp string - no explanations, no quotes, no extra text.`,
       },
       params: (params) => {
         const {
-          oauthCredential,
+          credential,
           operation,
           groupId,
           planId,
@@ -385,7 +375,7 @@ Return ONLY the timestamp string - no explanations, no quotes, no extra text.`,
 
         const baseParams: MicrosoftPlannerBlockParams = {
           ...rest,
-          oauthCredential,
+          credential,
         }
 
         // Handle different task ID fields based on operation
@@ -570,7 +560,7 @@ Return ONLY the timestamp string - no explanations, no quotes, no extra text.`,
   },
   inputs: {
     operation: { type: 'string', description: 'Operation to perform' },
-    oauthCredential: { type: 'string', description: 'Microsoft account credential' },
+    credential: { type: 'string', description: 'Microsoft account credential' },
     groupId: { type: 'string', description: 'Microsoft 365 group ID' },
     planId: { type: 'string', description: 'Plan ID' },
     readTaskId: { type: 'string', description: 'Task ID for read operation' },

apps/sim/blocks/blocks/microsoft_teams.ts

@@ -44,8 +44,6 @@ export const MicrosoftTeamsBlock: BlockConfig<MicrosoftTeamsResponse> = {
       id: 'credential',
       title: 'Microsoft Account',
       type: 'oauth-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'basic',
       serviceId: 'microsoft-teams',
       requiredScopes: [
         'openid',
@@ -72,15 +70,6 @@ export const MicrosoftTeamsBlock: BlockConfig<MicrosoftTeamsResponse> = {
       placeholder: 'Select Microsoft account',
       required: true,
     },
-    {
-      id: 'manualCredential',
-      title: 'Microsoft Account',
-      type: 'short-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'advanced',
-      placeholder: 'Enter credential ID',
-      required: true,
-    },
     {
       id: 'teamSelector',
       title: 'Select Team',
@@ -332,7 +321,7 @@ export const MicrosoftTeamsBlock: BlockConfig<MicrosoftTeamsResponse> = {
       },
       params: (params) => {
         const {
-          oauthCredential,
+          credential,
           operation,
           teamId, // Canonical param from teamSelector (basic) or manualTeamId (advanced)
           chatId, // Canonical param from chatSelector (basic) or manualChatId (advanced)
@@ -350,7 +339,7 @@ export const MicrosoftTeamsBlock: BlockConfig<MicrosoftTeamsResponse> = {
 
         const baseParams: Record<string, any> = {
           ...rest,
-          oauthCredential,
+          credential,
         }
 
         if ((operation === 'read_chat' || operation === 'read_channel') && includeAttachments) {
@@ -430,7 +419,7 @@ export const MicrosoftTeamsBlock: BlockConfig<MicrosoftTeamsResponse> = {
   },
   inputs: {
     operation: { type: 'string', description: 'Operation to perform' },
-    oauthCredential: { type: 'string', description: 'Microsoft Teams access token' },
+    credential: { type: 'string', description: 'Microsoft Teams access token' },
     messageId: {
       type: 'string',
       description: 'Message identifier for update/delete/reply/reaction operations',

apps/sim/blocks/blocks/notion.ts

@@ -38,21 +38,10 @@ export const NotionBlock: BlockConfig<NotionResponse> = {
       id: 'credential',
       title: 'Notion Account',
       type: 'oauth-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'basic',
       serviceId: 'notion',
       placeholder: 'Select Notion account',
       required: true,
     },
-    {
-      id: 'manualCredential',
-      title: 'Notion Account',
-      type: 'short-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'advanced',
-      placeholder: 'Enter credential ID',
-      required: true,
-    },
     // Read/Write operation - Page ID
     {
       id: 'pageId',
@@ -313,7 +302,7 @@ export const NotionBlock: BlockConfig<NotionResponse> = {
         }
       },
       params: (params) => {
-        const { oauthCredential, operation, properties, filter, sorts, ...rest } = params
+        const { credential, operation, properties, filter, sorts, ...rest } = params
 
         // Parse properties from JSON string for create/add operations
         let parsedProperties
@@ -362,7 +351,7 @@ export const NotionBlock: BlockConfig<NotionResponse> = {
 
         return {
           ...rest,
-          oauthCredential,
+          credential,
           ...(parsedProperties ? { properties: parsedProperties } : {}),
           ...(parsedFilter ? { filter: JSON.stringify(parsedFilter) } : {}),
           ...(parsedSorts ? { sorts: JSON.stringify(parsedSorts) } : {}),
@@ -372,7 +361,7 @@ export const NotionBlock: BlockConfig<NotionResponse> = {
   },
   inputs: {
     operation: { type: 'string', description: 'Operation to perform' },
-    oauthCredential: { type: 'string', description: 'Notion access token' },
+    credential: { type: 'string', description: 'Notion access token' },
     pageId: { type: 'string', description: 'Page identifier' },
     content: { type: 'string', description: 'Page content' },
     // Create page inputs

apps/sim/blocks/blocks/onedrive.ts

@@ -39,8 +39,6 @@ export const OneDriveBlock: BlockConfig<OneDriveResponse> = {
       id: 'credential',
       title: 'Microsoft Account',
       type: 'oauth-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'basic',
       serviceId: 'onedrive',
       requiredScopes: [
         'openid',
@@ -52,14 +50,6 @@ export const OneDriveBlock: BlockConfig<OneDriveResponse> = {
       ],
       placeholder: 'Select Microsoft account',
     },
-    {
-      id: 'manualCredential',
-      title: 'Microsoft Account',
-      type: 'short-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'advanced',
-      placeholder: 'Enter credential ID',
-    },
     // Create File Fields
     {
       id: 'fileName',
@@ -365,7 +355,7 @@ export const OneDriveBlock: BlockConfig<OneDriveResponse> = {
       },
       params: (params) => {
         const {
-          oauthCredential,
+          credential,
           // Folder canonical params (per-operation)
           uploadFolderId,
           createFolderParentId,
@@ -415,7 +405,7 @@ export const OneDriveBlock: BlockConfig<OneDriveResponse> = {
         }
 
         return {
-          oauthCredential,
+          credential,
           ...rest,
           values: normalizedValues,
           file: normalizedFile,
@@ -430,7 +420,7 @@ export const OneDriveBlock: BlockConfig<OneDriveResponse> = {
   },
   inputs: {
     operation: { type: 'string', description: 'Operation to perform' },
-    oauthCredential: { type: 'string', description: 'Microsoft account credential' },
+    credential: { type: 'string', description: 'Microsoft account credential' },
     // Upload and Create operation inputs
     fileName: { type: 'string', description: 'File name' },
     file: { type: 'json', description: 'File to upload (UserFile object)' },

apps/sim/blocks/blocks/outlook.ts

@@ -39,8 +39,6 @@ export const OutlookBlock: BlockConfig<OutlookResponse> = {
       id: 'credential',
       title: 'Microsoft Account',
       type: 'oauth-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'basic',
       serviceId: 'outlook',
       requiredScopes: [
         'Mail.ReadWrite',
@@ -55,15 +53,6 @@ export const OutlookBlock: BlockConfig<OutlookResponse> = {
       placeholder: 'Select Microsoft account',
       required: true,
     },
-    {
-      id: 'manualCredential',
-      title: 'Microsoft Account',
-      type: 'short-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'advanced',
-      placeholder: 'Enter credential ID',
-      required: true,
-    },
     {
       id: 'to',
       title: 'To',
@@ -337,7 +326,7 @@ export const OutlookBlock: BlockConfig<OutlookResponse> = {
       },
       params: (params) => {
         const {
-          oauthCredential,
+          credential,
           folder,
           destinationId,
           copyDestinationId,
@@ -396,14 +385,14 @@ export const OutlookBlock: BlockConfig<OutlookResponse> = {
 
         return {
           ...rest,
-          oauthCredential,
+          credential,
         }
       },
     },
   },
   inputs: {
     operation: { type: 'string', description: 'Operation to perform' },
-    oauthCredential: { type: 'string', description: 'Outlook access token' },
+    credential: { type: 'string', description: 'Outlook access token' },
     // Send operation inputs
     to: { type: 'string', description: 'Recipient email address' },
     subject: { type: 'string', description: 'Email subject' },

apps/sim/blocks/blocks/pipedrive.ts

@@ -45,8 +45,6 @@ export const PipedriveBlock: BlockConfig<PipedriveResponse> = {
       id: 'credential',
       title: 'Pipedrive Account',
       type: 'oauth-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'basic',
       serviceId: 'pipedrive',
       requiredScopes: [
         'base',
@@ -60,15 +58,6 @@ export const PipedriveBlock: BlockConfig<PipedriveResponse> = {
       placeholder: 'Select Pipedrive account',
       required: true,
     },
-    {
-      id: 'manualCredential',
-      title: 'Pipedrive Account',
-      type: 'short-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'advanced',
-      placeholder: 'Enter credential ID',
-      required: true,
-    },
     {
       id: 'status',
       title: 'Status',
@@ -757,10 +746,10 @@ Return ONLY the date string in YYYY-MM-DD format - no explanations, no quotes, n
         }
       },
       params: (params) => {
-        const { oauthCredential, operation, ...rest } = params
+        const { credential, operation, ...rest } = params
 
         const cleanParams: Record<string, any> = {
-          oauthCredential,
+          credential,
         }
 
         Object.entries(rest).forEach(([key, value]) => {
@@ -775,7 +764,7 @@ Return ONLY the date string in YYYY-MM-DD format - no explanations, no quotes, n
   },
   inputs: {
     operation: { type: 'string', description: 'Operation to perform' },
-    oauthCredential: { type: 'string', description: 'Pipedrive access token' },
+    credential: { type: 'string', description: 'Pipedrive access token' },
     deal_id: { type: 'string', description: 'Deal ID' },
     title: { type: 'string', description: 'Title' },
     value: { type: 'string', description: 'Monetary value' },

apps/sim/blocks/blocks/reddit.ts

@@ -43,8 +43,6 @@ export const RedditBlock: BlockConfig<RedditResponse> = {
       title: 'Reddit Account',
       type: 'oauth-input',
       serviceId: 'reddit',
-      canonicalParamId: 'oauthCredential',
-      mode: 'basic',
       requiredScopes: [
         'identity',
         'read',
@@ -66,15 +64,6 @@ export const RedditBlock: BlockConfig<RedditResponse> = {
       placeholder: 'Select Reddit account',
       required: true,
     },
-    {
-      id: 'manualCredential',
-      title: 'Reddit Account',
-      type: 'short-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'advanced',
-      placeholder: 'Enter credential ID',
-      required: true,
-    },
 
     // Common fields - appear for all actions
     {
@@ -566,7 +555,7 @@ export const RedditBlock: BlockConfig<RedditResponse> = {
       },
       params: (inputs) => {
         const operation = inputs.operation || 'get_posts'
-        const { oauthCredential, ...rest } = inputs
+        const { credential, ...rest } = inputs
 
         if (operation === 'get_comments') {
           return {
@@ -574,7 +563,7 @@ export const RedditBlock: BlockConfig<RedditResponse> = {
             subreddit: rest.subreddit,
             sort: rest.commentSort,
             limit: rest.commentLimit ? Number.parseInt(rest.commentLimit) : undefined,
-            oauthCredential: oauthCredential,
+            credential: credential,
           }
         }
 
@@ -583,7 +572,7 @@ export const RedditBlock: BlockConfig<RedditResponse> = {
             subreddit: rest.subreddit,
             time: rest.controversialTime,
             limit: rest.controversialLimit ? Number.parseInt(rest.controversialLimit) : undefined,
-            oauthCredential: oauthCredential,
+            credential: credential,
           }
         }
 
@@ -594,7 +583,7 @@ export const RedditBlock: BlockConfig<RedditResponse> = {
             sort: rest.searchSort,
             time: rest.searchTime,
             limit: rest.searchLimit ? Number.parseInt(rest.searchLimit) : undefined,
-            oauthCredential: oauthCredential,
+            credential: credential,
           }
         }
 
@@ -606,7 +595,7 @@ export const RedditBlock: BlockConfig<RedditResponse> = {
             url: rest.postType === 'link' ? rest.url : undefined,
             nsfw: rest.nsfw === 'true',
             spoiler: rest.spoiler === 'true',
-            oauthCredential: oauthCredential,
+            credential: credential,
           }
         }
 
@@ -614,7 +603,7 @@ export const RedditBlock: BlockConfig<RedditResponse> = {
           return {
             id: rest.voteId,
             dir: Number.parseInt(rest.voteDirection),
-            oauthCredential: oauthCredential,
+            credential: credential,
           }
         }
 
@@ -622,14 +611,14 @@ export const RedditBlock: BlockConfig<RedditResponse> = {
           return {
             id: rest.saveId,
             category: rest.saveCategory,
-            oauthCredential: oauthCredential,
+            credential: credential,
           }
         }
 
         if (operation === 'unsave') {
           return {
             id: rest.saveId,
-            oauthCredential: oauthCredential,
+            credential: credential,
           }
         }
 
@@ -637,7 +626,7 @@ export const RedditBlock: BlockConfig<RedditResponse> = {
           return {
             parent_id: rest.replyParentId,
             text: rest.replyText,
-            oauthCredential: oauthCredential,
+            credential: credential,
           }
         }
 
@@ -645,14 +634,14 @@ export const RedditBlock: BlockConfig<RedditResponse> = {
           return {
             thing_id: rest.editThingId,
             text: rest.editText,
-            oauthCredential: oauthCredential,
+            credential: credential,
           }
         }
 
         if (operation === 'delete') {
           return {
             id: rest.deleteId,
-            oauthCredential: oauthCredential,
+            credential: credential,
           }
         }
 
@@ -660,7 +649,7 @@ export const RedditBlock: BlockConfig<RedditResponse> = {
           return {
             subreddit: rest.subscribeSubreddit,
             action: rest.subscribeAction,
-            oauthCredential: oauthCredential,
+            credential: credential,
           }
         }
 
@@ -669,14 +658,14 @@ export const RedditBlock: BlockConfig<RedditResponse> = {
           sort: rest.sort,
           limit: rest.limit ? Number.parseInt(rest.limit) : undefined,
           time: rest.sort === 'top' ? rest.time : undefined,
-          oauthCredential: oauthCredential,
+          credential: credential,
         }
       },
     },
   },
   inputs: {
     operation: { type: 'string', description: 'Operation to perform' },
-    oauthCredential: { type: 'string', description: 'Reddit access token' },
+    credential: { type: 'string', description: 'Reddit access token' },
     subreddit: { type: 'string', description: 'Subreddit name' },
     sort: { type: 'string', description: 'Sort order' },
     time: { type: 'string', description: 'Time filter' },

apps/sim/blocks/blocks/salesforce.ts

@@ -62,22 +62,11 @@ export const SalesforceBlock: BlockConfig<SalesforceResponse> = {
       id: 'credential',
       title: 'Salesforce Account',
       type: 'oauth-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'basic',
       serviceId: 'salesforce',
       requiredScopes: ['api', 'refresh_token', 'openid', 'offline_access'],
       placeholder: 'Select Salesforce account',
       required: true,
     },
-    {
-      id: 'manualCredential',
-      title: 'Salesforce Account',
-      type: 'short-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'advanced',
-      placeholder: 'Enter credential ID',
-      required: true,
-    },
     // Common fields for GET operations
     {
       id: 'fields',
@@ -625,8 +614,8 @@ Return ONLY the date string in YYYY-MM-DD format - no explanations, no quotes, n
         }
       },
       params: (params) => {
-        const { oauthCredential, operation, ...rest } = params
-        const cleanParams: Record<string, any> = { oauthCredential }
+        const { credential, operation, ...rest } = params
+        const cleanParams: Record<string, any> = { credential }
         Object.entries(rest).forEach(([key, value]) => {
           if (value !== undefined && value !== null && value !== '') {
             cleanParams[key] = value
@@ -638,7 +627,7 @@ Return ONLY the date string in YYYY-MM-DD format - no explanations, no quotes, n
   },
   inputs: {
     operation: { type: 'string', description: 'Operation to perform' },
-    oauthCredential: { type: 'string', description: 'Salesforce credential' },
+    credential: { type: 'string', description: 'Salesforce credential' },
   },
   outputs: {
     success: { type: 'boolean', description: 'Operation success status' },

apps/sim/blocks/blocks/schedule.ts

@@ -122,6 +122,25 @@ export const ScheduleBlock: BlockConfig = {
       required: true,
       mode: 'trigger',
       condition: { field: 'scheduleType', value: 'custom' },
+      wandConfig: {
+        enabled: true,
+        prompt: `You are an expert at writing cron expressions. Generate a valid cron expression based on the user's description.
+
+Cron format: minute hour day-of-month month day-of-week
+- minute: 0-59
+- hour: 0-23
+- day-of-month: 1-31
+- month: 1-12
+- day-of-week: 0-7 (0 and 7 are Sunday)
+
+Special characters: * (any), , (list), - (range), / (step)
+
+{context}
+
+Return ONLY the cron expression, nothing else. No explanation, no backticks, no quotes.`,
+        placeholder: 'Describe your schedule (e.g., "every weekday at 9am")',
+        generationType: 'cron-expression',
+      },
     },
 
     {

apps/sim/blocks/blocks/sharepoint.ts

@@ -38,8 +38,6 @@ export const SharepointBlock: BlockConfig<SharepointResponse> = {
       id: 'credential',
       title: 'Microsoft Account',
       type: 'oauth-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'basic',
       serviceId: 'sharepoint',
       requiredScopes: [
         'openid',
@@ -52,14 +50,6 @@ export const SharepointBlock: BlockConfig<SharepointResponse> = {
       ],
       placeholder: 'Select Microsoft account',
     },
-    {
-      id: 'manualCredential',
-      title: 'Microsoft Account',
-      type: 'short-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'advanced',
-      placeholder: 'Enter credential ID',
-    },
 
     {
       id: 'siteSelector',
@@ -413,7 +403,7 @@ Return ONLY the JSON object - no explanations, no markdown, no extra text.`,
         }
       },
       params: (params) => {
-        const { oauthCredential, siteId, mimeType, ...rest } = params
+        const { credential, siteId, mimeType, ...rest } = params
 
         // siteId is the canonical param from siteSelector (basic) or manualSiteId (advanced)
         const effectiveSiteId = siteId ? String(siteId).trim() : ''
@@ -471,7 +461,7 @@ Return ONLY the JSON object - no explanations, no markdown, no extra text.`,
         // Handle file upload files parameter using canonical param
         const normalizedFiles = normalizeFileInput(files)
         const baseParams: Record<string, any> = {
-          oauthCredential,
+          credential,
           siteId: effectiveSiteId || undefined,
           pageSize: others.pageSize ? Number.parseInt(others.pageSize as string, 10) : undefined,
           mimeType: mimeType,
@@ -497,7 +487,7 @@ Return ONLY the JSON object - no explanations, no markdown, no extra text.`,
   },
   inputs: {
     operation: { type: 'string', description: 'Operation to perform' },
-    oauthCredential: { type: 'string', description: 'Microsoft account credential' },
+    credential: { type: 'string', description: 'Microsoft account credential' },
     pageName: { type: 'string', description: 'Page name' },
     columnDefinitions: {
       type: 'string',

apps/sim/blocks/blocks/shopify.ts

@@ -61,8 +61,6 @@ export const ShopifyBlock: BlockConfig<ShopifyResponse> = {
       title: 'Shopify Account',
       type: 'oauth-input',
       serviceId: 'shopify',
-      canonicalParamId: 'oauthCredential',
-      mode: 'basic',
       requiredScopes: [
         'write_products',
         'write_orders',
@@ -74,15 +72,6 @@ export const ShopifyBlock: BlockConfig<ShopifyResponse> = {
       placeholder: 'Select Shopify account',
       required: true,
     },
-    {
-      id: 'manualCredential',
-      title: 'Shopify Account',
-      type: 'short-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'advanced',
-      placeholder: 'Enter credential ID',
-      required: true,
-    },
     {
       id: 'shopDomain',
       title: 'Shop Domain',
@@ -538,7 +527,7 @@ export const ShopifyBlock: BlockConfig<ShopifyResponse> = {
       },
       params: (params) => {
         const baseParams: Record<string, unknown> = {
-          oauthCredential: params.oauthCredential,
+          credential: params.credential,
           shopDomain: params.shopDomain?.trim(),
         }
 
@@ -785,7 +774,7 @@ export const ShopifyBlock: BlockConfig<ShopifyResponse> = {
   },
   inputs: {
     operation: { type: 'string', description: 'Operation to perform' },
-    oauthCredential: { type: 'string', description: 'Shopify access token' },
+    credential: { type: 'string', description: 'Shopify access token' },
     shopDomain: { type: 'string', description: 'Shopify store domain' },
     // Product inputs
     productId: { type: 'string', description: 'Product ID' },

apps/sim/blocks/blocks/slack.ts

@@ -69,8 +69,6 @@ export const SlackBlock: BlockConfig<SlackResponse> = {
       id: 'credential',
       title: 'Slack Account',
       type: 'oauth-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'basic',
       serviceId: 'slack',
       requiredScopes: [
         'channels:read',
@@ -96,20 +94,6 @@ export const SlackBlock: BlockConfig<SlackResponse> = {
       },
       required: true,
     },
-    {
-      id: 'manualCredential',
-      title: 'Slack Account',
-      type: 'short-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'advanced',
-      placeholder: 'Enter credential ID',
-      dependsOn: ['authMethod'],
-      condition: {
-        field: 'authMethod',
-        value: 'oauth',
-      },
-      required: true,
-    },
     {
       id: 'botToken',
       title: 'Bot Token',
@@ -563,7 +547,7 @@ Return ONLY the timestamp string - no explanations, no quotes, no extra text.`,
       },
       params: (params) => {
         const {
-          oauthCredential,
+          credential,
           authMethod,
           botToken,
           operation,
@@ -613,7 +597,7 @@ Return ONLY the timestamp string - no explanations, no quotes, no extra text.`,
           baseParams.accessToken = botToken
         } else {
           // Default to OAuth
-          baseParams.credential = oauthCredential
+          baseParams.credential = credential
         }
 
         switch (operation) {
@@ -717,7 +701,7 @@ Return ONLY the timestamp string - no explanations, no quotes, no extra text.`,
     operation: { type: 'string', description: 'Operation to perform' },
     authMethod: { type: 'string', description: 'Authentication method' },
     destinationType: { type: 'string', description: 'Destination type (channel or dm)' },
-    oauthCredential: { type: 'string', description: 'Slack access token' },
+    credential: { type: 'string', description: 'Slack access token' },
     botToken: { type: 'string', description: 'Bot token' },
     channel: { type: 'string', description: 'Channel identifier (canonical param)' },
     dmUserId: { type: 'string', description: 'User ID for DM recipient (canonical param)' },

apps/sim/blocks/blocks/spotify.ts

@@ -160,17 +160,6 @@ export const SpotifyBlock: BlockConfig<ToolResponse> = {
       title: 'Spotify Account',
       type: 'oauth-input',
       serviceId: 'spotify',
-      canonicalParamId: 'oauthCredential',
-      mode: 'basic',
-      required: true,
-    },
-    {
-      id: 'manualCredential',
-      title: 'Spotify Account',
-      type: 'short-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'advanced',
-      placeholder: 'Enter credential ID',
       required: true,
     },
 
@@ -807,7 +796,7 @@ export const SpotifyBlock: BlockConfig<ToolResponse> = {
   },
   inputs: {
     operation: { type: 'string', description: 'Operation to perform' },
-    oauthCredential: { type: 'string', description: 'Spotify OAuth credential' },
+    credential: { type: 'string', description: 'Spotify OAuth credential' },
     // Search
     query: { type: 'string', description: 'Search query' },
     type: { type: 'string', description: 'Search type' },

apps/sim/blocks/blocks/trello.ts

@@ -42,21 +42,10 @@ export const TrelloBlock: BlockConfig<ToolResponse> = {
       title: 'Trello Account',
       type: 'oauth-input',
       serviceId: 'trello',
-      canonicalParamId: 'oauthCredential',
-      mode: 'basic',
       requiredScopes: ['read', 'write'],
       placeholder: 'Select Trello account',
       required: true,
     },
-    {
-      id: 'manualCredential',
-      title: 'Trello Account',
-      type: 'short-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'advanced',
-      placeholder: 'Enter credential ID',
-      required: true,
-    },
 
     {
       id: 'boardId',
@@ -405,7 +394,7 @@ Return ONLY the date/timestamp string - no explanations, no quotes, no extra tex
   },
   inputs: {
     operation: { type: 'string', description: 'Trello operation to perform' },
-    oauthCredential: { type: 'string', description: 'Trello OAuth credential' },
+    credential: { type: 'string', description: 'Trello OAuth credential' },
     boardId: { type: 'string', description: 'Board ID' },
     listId: { type: 'string', description: 'List ID' },
     cardId: { type: 'string', description: 'Card ID' },

apps/sim/blocks/blocks/wealthbox.ts

@@ -33,22 +33,11 @@ export const WealthboxBlock: BlockConfig<WealthboxResponse> = {
       id: 'credential',
       title: 'Wealthbox Account',
       type: 'oauth-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'basic',
       serviceId: 'wealthbox',
       requiredScopes: ['login', 'data'],
       placeholder: 'Select Wealthbox account',
       required: true,
     },
-    {
-      id: 'manualCredential',
-      title: 'Wealthbox Account',
-      type: 'short-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'advanced',
-      placeholder: 'Enter credential ID',
-      required: true,
-    },
     {
       id: 'noteId',
       title: 'Note ID',
@@ -180,14 +169,14 @@ Return ONLY the date/time string - no explanations, no quotes, no extra text.`,
         }
       },
       params: (params) => {
-        const { oauthCredential, operation, contactId, taskId, ...rest } = params
+        const { credential, operation, contactId, taskId, ...rest } = params
 
         // contactId is the canonical param for both basic (file-selector) and advanced (manualContactId) modes
         const effectiveContactId = contactId ? String(contactId).trim() : ''
 
         const baseParams = {
           ...rest,
-          credential: oauthCredential,
+          credential,
         }
 
         if (operation === 'read_note' || operation === 'write_note') {
@@ -231,7 +220,7 @@ Return ONLY the date/time string - no explanations, no quotes, no extra text.`,
   },
   inputs: {
     operation: { type: 'string', description: 'Operation to perform' },
-    oauthCredential: { type: 'string', description: 'Wealthbox access token' },
+    credential: { type: 'string', description: 'Wealthbox access token' },
     noteId: { type: 'string', description: 'Note identifier' },
     contactId: { type: 'string', description: 'Contact identifier' },
     taskId: { type: 'string', description: 'Task identifier' },

apps/sim/blocks/blocks/webflow.ts

@@ -34,22 +34,11 @@ export const WebflowBlock: BlockConfig<WebflowResponse> = {
       id: 'credential',
       title: 'Webflow Account',
       type: 'oauth-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'basic',
       serviceId: 'webflow',
       requiredScopes: ['sites:read', 'sites:write', 'cms:read', 'cms:write'],
       placeholder: 'Select Webflow account',
       required: true,
     },
-    {
-      id: 'manualCredential',
-      title: 'Webflow Account',
-      type: 'short-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'advanced',
-      placeholder: 'Enter credential ID',
-      required: true,
-    },
     {
       id: 'siteSelector',
       title: 'Site',
@@ -167,7 +156,7 @@ export const WebflowBlock: BlockConfig<WebflowResponse> = {
       },
       params: (params) => {
         const {
-          oauthCredential,
+          credential,
           fieldData,
           siteId, // Canonical param from siteSelector (basic) or manualSiteId (advanced)
           collectionId, // Canonical param from collectionSelector (basic) or manualCollectionId (advanced)
@@ -189,7 +178,7 @@ export const WebflowBlock: BlockConfig<WebflowResponse> = {
         const effectiveItemId = itemId ? String(itemId).trim() : ''
 
         const baseParams = {
-          credential: oauthCredential,
+          credential,
           siteId: effectiveSiteId,
           collectionId: effectiveCollectionId,
           ...rest,
@@ -214,7 +203,7 @@ export const WebflowBlock: BlockConfig<WebflowResponse> = {
   },
   inputs: {
     operation: { type: 'string', description: 'Operation to perform' },
-    oauthCredential: { type: 'string', description: 'Webflow OAuth access token' },
+    credential: { type: 'string', description: 'Webflow OAuth access token' },
     siteId: { type: 'string', description: 'Webflow site identifier' },
     collectionId: { type: 'string', description: 'Webflow collection identifier' },
     itemId: { type: 'string', description: 'Item identifier' },

apps/sim/blocks/blocks/wordpress.ts

@@ -65,22 +65,11 @@ export const WordPressBlock: BlockConfig<WordPressResponse> = {
       id: 'credential',
       title: 'WordPress Account',
       type: 'oauth-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'basic',
       serviceId: 'wordpress',
       requiredScopes: ['global'],
       placeholder: 'Select WordPress account',
       required: true,
     },
-    {
-      id: 'manualCredential',
-      title: 'WordPress Account',
-      type: 'short-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'advanced',
-      placeholder: 'Enter credential ID',
-      required: true,
-    },
 
     // Site ID for WordPress.com (required for OAuth)
     {
@@ -678,7 +667,7 @@ export const WordPressBlock: BlockConfig<WordPressResponse> = {
       params: (params) => {
         // OAuth authentication for WordPress.com
         const baseParams: Record<string, any> = {
-          credential: params.oauthCredential,
+          credential: params.credential,
           siteId: params.siteId,
         }
 
@@ -901,7 +890,6 @@ export const WordPressBlock: BlockConfig<WordPressResponse> = {
   },
   inputs: {
     operation: { type: 'string', description: 'Operation to perform' },
-    oauthCredential: { type: 'string', description: 'WordPress OAuth credential' },
     siteId: { type: 'string', description: 'WordPress.com site ID or domain' },
     // Post inputs
     postId: { type: 'number', description: 'Post ID' },

apps/sim/blocks/blocks/x.ts

@@ -32,19 +32,9 @@ export const XBlock: BlockConfig<XResponse> = {
       title: 'X Account',
       type: 'oauth-input',
       serviceId: 'x',
-      canonicalParamId: 'oauthCredential',
-      mode: 'basic',
       requiredScopes: ['tweet.read', 'tweet.write', 'users.read', 'offline.access'],
       placeholder: 'Select X account',
     },
-    {
-      id: 'manualCredential',
-      title: 'X Account',
-      type: 'short-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'advanced',
-      placeholder: 'Enter credential ID',
-    },
     {
       id: 'text',
       title: 'Tweet Text',
@@ -181,10 +171,10 @@ Return ONLY the timestamp string - no explanations, no quotes, no extra text.`,
         }
       },
       params: (params) => {
-        const { oauthCredential, ...rest } = params
+        const { credential, ...rest } = params
 
         const parsedParams: Record<string, any> = {
-          credential: oauthCredential,
+          credential: credential,
         }
 
         Object.keys(rest).forEach((key) => {
@@ -210,7 +200,7 @@ Return ONLY the timestamp string - no explanations, no quotes, no extra text.`,
   },
   inputs: {
     operation: { type: 'string', description: 'Operation to perform' },
-    oauthCredential: { type: 'string', description: 'X account credential' },
+    credential: { type: 'string', description: 'X account credential' },
     text: { type: 'string', description: 'Tweet text content' },
     replyTo: { type: 'string', description: 'Reply to tweet ID' },
     mediaIds: { type: 'string', description: 'Media identifiers' },

apps/sim/blocks/blocks/zoom.ts

@@ -38,8 +38,6 @@ export const ZoomBlock: BlockConfig<ZoomResponse> = {
       title: 'Zoom Account',
       type: 'oauth-input',
       serviceId: 'zoom',
-      canonicalParamId: 'oauthCredential',
-      mode: 'basic',
       requiredScopes: [
         'user:read:user',
         'meeting:write:meeting',
@@ -56,15 +54,6 @@ export const ZoomBlock: BlockConfig<ZoomResponse> = {
       placeholder: 'Select Zoom account',
       required: true,
     },
-    {
-      id: 'manualCredential',
-      title: 'Zoom Account',
-      type: 'short-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'advanced',
-      placeholder: 'Enter credential ID',
-      required: true,
-    },
     // User ID for create/list operations
     {
       id: 'userId',
@@ -424,7 +413,7 @@ Return ONLY the date string - no explanations, no quotes, no extra text.`,
       },
       params: (params) => {
         const baseParams: Record<string, any> = {
-          credential: params.oauthCredential,
+          credential: params.credential,
         }
 
         switch (params.operation) {
@@ -569,7 +558,7 @@ Return ONLY the date string - no explanations, no quotes, no extra text.`,
   },
   inputs: {
     operation: { type: 'string', description: 'Operation to perform' },
-    oauthCredential: { type: 'string', description: 'Zoom access token' },
+    credential: { type: 'string', description: 'Zoom access token' },
     userId: { type: 'string', description: 'User ID or email (use "me" for authenticated user)' },
     meetingId: { type: 'string', description: 'Meeting ID' },
     topic: { type: 'string', description: 'Meeting topic' },

apps/sim/blocks/types.ts

@@ -40,6 +40,7 @@ export type GenerationType =
   | 'neo4j-parameters'
   | 'timestamp'
   | 'timezone'
+  | 'cron-expression'
 
 export type SubBlockType =
   | 'short-input' // Single line input

apps/sim/executor/constants.ts

@@ -205,6 +205,10 @@ export const CREDENTIAL_SET = {
   PREFIX: 'credentialSet:',
 } as const
 
+export const CREDENTIAL = {
+  FOREIGN_LABEL: 'Saved by collaborator',
+} as const
+
 export function isCredentialSetValue(value: string | null | undefined): boolean {
   return typeof value === 'string' && value.startsWith(CREDENTIAL_SET.PREFIX)
 }

apps/sim/executor/execution/executor.ts

@@ -264,7 +264,6 @@ export class DAGExecutor {
       executionId: this.contextExtensions.executionId,
       userId: this.contextExtensions.userId,
       isDeployedContext: this.contextExtensions.isDeployedContext,
-      enforceCredentialAccess: this.contextExtensions.enforceCredentialAccess,
       blockStates: state.getBlockStates(),
       blockLogs: overrides?.runFromBlockContext ? [] : (snapshotState?.blockLogs ?? []),
       metadata: {

apps/sim/executor/execution/types.ts

@@ -16,7 +16,6 @@ export interface ExecutionMetadata {
   useDraftState: boolean
   startTime: string
   isClientSession?: boolean
-  enforceCredentialAccess?: boolean
   pendingBlocks?: string[]
   resumeFromSnapshot?: boolean
   credentialAccountUserId?: string
@@ -81,7 +80,6 @@ export interface ContextExtensions {
   selectedOutputs?: string[]
   edges?: Array<{ source: string; target: string }>
   isDeployedContext?: boolean
-  enforceCredentialAccess?: boolean
   isChildExecution?: boolean
   resumeFromSnapshot?: boolean
   resumePendingQueue?: string[]

apps/sim/executor/handlers/agent/agent-handler.ts

@@ -336,7 +336,6 @@ export class AgentBlockHandler implements BlockHandler {
               workspaceId: ctx.workspaceId,
               userId: ctx.userId,
               isDeployedContext: ctx.isDeployedContext,
-              enforceCredentialAccess: ctx.enforceCredentialAccess,
             },
           },
           false,

apps/sim/executor/handlers/api/api-handler.ts

@@ -74,7 +74,6 @@ export class ApiBlockHandler implements BlockHandler {
             executionId: ctx.executionId,
             userId: ctx.userId,
             isDeployedContext: ctx.isDeployedContext,
-            enforceCredentialAccess: ctx.enforceCredentialAccess,
           },
         },
         false,

apps/sim/executor/handlers/condition/condition-handler.ts

@@ -50,7 +50,6 @@ export async function evaluateConditionExpression(
           workspaceId: ctx.workspaceId,
           userId: ctx.userId,
           isDeployedContext: ctx.isDeployedContext,
-          enforceCredentialAccess: ctx.enforceCredentialAccess,
         },
       },
       false,

apps/sim/executor/handlers/function/function-handler.ts

@@ -41,7 +41,6 @@ export class FunctionBlockHandler implements BlockHandler {
           workspaceId: ctx.workspaceId,
           userId: ctx.userId,
           isDeployedContext: ctx.isDeployedContext,
-          enforceCredentialAccess: ctx.enforceCredentialAccess,
         },
       },
       false,

apps/sim/executor/handlers/generic/generic-handler.ts

@@ -68,7 +68,6 @@ export class GenericBlockHandler implements BlockHandler {
             executionId: ctx.executionId,
             userId: ctx.userId,
             isDeployedContext: ctx.isDeployedContext,
-            enforceCredentialAccess: ctx.enforceCredentialAccess,
           },
         },
         false,

apps/sim/executor/handlers/human-in-the-loop/human-in-the-loop-handler.ts

@@ -607,7 +607,6 @@ export class HumanInTheLoopBlockHandler implements BlockHandler {
             workspaceId: ctx.workspaceId,
             userId: ctx.userId,
             isDeployedContext: ctx.isDeployedContext,
-            enforceCredentialAccess: ctx.enforceCredentialAccess,
           },
           blockData: blockDataWithPause,
           blockNameMapping: blockNameMappingWithPause,

apps/sim/executor/handlers/workflow/workflow-handler.ts

@@ -123,7 +123,6 @@ export class WorkflowBlockHandler implements BlockHandler {
         contextExtensions: {
           isChildExecution: true,
           isDeployedContext: ctx.isDeployedContext === true,
-          enforceCredentialAccess: ctx.enforceCredentialAccess,
           workspaceId: ctx.workspaceId,
           userId: ctx.userId,
           executionId: ctx.executionId,

apps/sim/executor/types.ts

@@ -168,7 +168,6 @@ export interface ExecutionContext {
   executionId?: string
   userId?: string
   isDeployedContext?: boolean
-  enforceCredentialAccess?: boolean
 
   permissionConfig?: PermissionGroupConfig | null
   permissionConfigLoaded?: boolean

apps/sim/hooks/queries/credentials.ts

@@ -1,272 +0,0 @@
-'use client'
-
-import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query'
-import { environmentKeys } from '@/hooks/queries/environment'
-import { fetchJson } from '@/hooks/selectors/helpers'
-
-export type WorkspaceCredentialType = 'oauth' | 'env_workspace' | 'env_personal'
-export type WorkspaceCredentialRole = 'admin' | 'member'
-export type WorkspaceCredentialMemberStatus = 'active' | 'pending' | 'revoked'
-
-export interface WorkspaceCredential {
-  id: string
-  workspaceId: string
-  type: WorkspaceCredentialType
-  displayName: string
-  description: string | null
-  providerId: string | null
-  accountId: string | null
-  envKey: string | null
-  envOwnerUserId: string | null
-  createdBy: string
-  createdAt: string
-  updatedAt: string
-  role?: WorkspaceCredentialRole
-  status?: WorkspaceCredentialMemberStatus
-}
-
-export interface WorkspaceCredentialMember {
-  id: string
-  userId: string
-  role: WorkspaceCredentialRole
-  status: WorkspaceCredentialMemberStatus
-  joinedAt: string | null
-  invitedBy: string | null
-  createdAt: string
-  updatedAt: string
-  userName: string | null
-  userEmail: string | null
-  userImage: string | null
-}
-
-interface CredentialListResponse {
-  credentials?: WorkspaceCredential[]
-}
-
-interface CredentialResponse {
-  credential?: WorkspaceCredential | null
-}
-
-interface MembersResponse {
-  members?: WorkspaceCredentialMember[]
-}
-
-export const workspaceCredentialKeys = {
-  all: ['workspaceCredentials'] as const,
-  list: (workspaceId?: string, type?: string, providerId?: string) =>
-    ['workspaceCredentials', workspaceId ?? 'none', type ?? 'all', providerId ?? 'all'] as const,
-  detail: (credentialId?: string) =>
-    ['workspaceCredentials', 'detail', credentialId ?? 'none'] as const,
-  members: (credentialId?: string) =>
-    ['workspaceCredentials', 'detail', credentialId ?? 'none', 'members'] as const,
-}
-
-export function useWorkspaceCredentials(params: {
-  workspaceId?: string
-  type?: WorkspaceCredentialType
-  providerId?: string
-  enabled?: boolean
-}) {
-  const { workspaceId, type, providerId, enabled = true } = params
-
-  return useQuery<WorkspaceCredential[]>({
-    queryKey: workspaceCredentialKeys.list(workspaceId, type, providerId),
-    queryFn: async () => {
-      if (!workspaceId) return []
-      const data = await fetchJson<CredentialListResponse>('/api/credentials', {
-        searchParams: {
-          workspaceId,
-          type,
-          providerId,
-        },
-      })
-      return data.credentials ?? []
-    },
-    enabled: Boolean(workspaceId) && enabled,
-    staleTime: 60 * 1000,
-  })
-}
-
-export function useWorkspaceCredential(credentialId?: string, enabled = true) {
-  return useQuery<WorkspaceCredential | null>({
-    queryKey: workspaceCredentialKeys.detail(credentialId),
-    queryFn: async () => {
-      if (!credentialId) return null
-      const data = await fetchJson<CredentialResponse>(`/api/credentials/${credentialId}`)
-      return data.credential ?? null
-    },
-    enabled: Boolean(credentialId) && enabled,
-    staleTime: 60 * 1000,
-  })
-}
-
-export function useCreateWorkspaceCredential() {
-  const queryClient = useQueryClient()
-
-  return useMutation({
-    mutationFn: async (payload: {
-      workspaceId: string
-      type: WorkspaceCredentialType
-      displayName?: string
-      description?: string
-      providerId?: string
-      accountId?: string
-      envKey?: string
-      envOwnerUserId?: string
-    }) => {
-      const response = await fetch('/api/credentials', {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify(payload),
-      })
-
-      if (!response.ok) {
-        const data = await response.json()
-        throw new Error(data.error || 'Failed to create credential')
-      }
-
-      return response.json()
-    },
-    onSuccess: (_data, variables) => {
-      queryClient.invalidateQueries({
-        queryKey: workspaceCredentialKeys.list(variables.workspaceId),
-      })
-      queryClient.invalidateQueries({
-        queryKey: workspaceCredentialKeys.all,
-      })
-    },
-  })
-}
-
-export function useUpdateWorkspaceCredential() {
-  const queryClient = useQueryClient()
-
-  return useMutation({
-    mutationFn: async (payload: {
-      credentialId: string
-      displayName?: string
-      description?: string | null
-      accountId?: string
-    }) => {
-      const response = await fetch(`/api/credentials/${payload.credentialId}`, {
-        method: 'PUT',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({
-          displayName: payload.displayName,
-          description: payload.description,
-          accountId: payload.accountId,
-        }),
-      })
-      if (!response.ok) {
-        const data = await response.json()
-        throw new Error(data.error || 'Failed to update credential')
-      }
-      return response.json()
-    },
-    onSuccess: (_data, variables) => {
-      queryClient.invalidateQueries({
-        queryKey: workspaceCredentialKeys.detail(variables.credentialId),
-      })
-      queryClient.invalidateQueries({
-        queryKey: workspaceCredentialKeys.all,
-      })
-    },
-  })
-}
-
-export function useDeleteWorkspaceCredential() {
-  const queryClient = useQueryClient()
-
-  return useMutation({
-    mutationFn: async (credentialId: string) => {
-      const response = await fetch(`/api/credentials/${credentialId}`, {
-        method: 'DELETE',
-      })
-      if (!response.ok) {
-        const data = await response.json()
-        throw new Error(data.error || 'Failed to delete credential')
-      }
-      return response.json()
-    },
-    onSuccess: (_data, credentialId) => {
-      queryClient.invalidateQueries({ queryKey: workspaceCredentialKeys.detail(credentialId) })
-      queryClient.invalidateQueries({ queryKey: workspaceCredentialKeys.all })
-      queryClient.invalidateQueries({ queryKey: environmentKeys.all })
-    },
-  })
-}
-
-export function useWorkspaceCredentialMembers(credentialId?: string) {
-  return useQuery<WorkspaceCredentialMember[]>({
-    queryKey: workspaceCredentialKeys.members(credentialId),
-    queryFn: async () => {
-      if (!credentialId) return []
-      const data = await fetchJson<MembersResponse>(`/api/credentials/${credentialId}/members`)
-      return data.members ?? []
-    },
-    enabled: Boolean(credentialId),
-    staleTime: 30 * 1000,
-  })
-}
-
-export function useUpsertWorkspaceCredentialMember() {
-  const queryClient = useQueryClient()
-
-  return useMutation({
-    mutationFn: async (payload: {
-      credentialId: string
-      userId: string
-      role: WorkspaceCredentialRole
-    }) => {
-      const response = await fetch(`/api/credentials/${payload.credentialId}/members`, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({
-          userId: payload.userId,
-          role: payload.role,
-        }),
-      })
-      if (!response.ok) {
-        const data = await response.json()
-        throw new Error(data.error || 'Failed to update credential member')
-      }
-      return response.json()
-    },
-    onSuccess: (_data, variables) => {
-      queryClient.invalidateQueries({
-        queryKey: workspaceCredentialKeys.members(variables.credentialId),
-      })
-      queryClient.invalidateQueries({
-        queryKey: workspaceCredentialKeys.detail(variables.credentialId),
-      })
-      queryClient.invalidateQueries({ queryKey: workspaceCredentialKeys.all })
-    },
-  })
-}
-
-export function useRemoveWorkspaceCredentialMember() {
-  const queryClient = useQueryClient()
-
-  return useMutation({
-    mutationFn: async (payload: { credentialId: string; userId: string }) => {
-      const response = await fetch(
-        `/api/credentials/${payload.credentialId}/members?userId=${encodeURIComponent(payload.userId)}`,
-        { method: 'DELETE' }
-      )
-      if (!response.ok) {
-        const data = await response.json()
-        throw new Error(data.error || 'Failed to remove credential member')
-      }
-      return response.json()
-    },
-    onSuccess: (_data, variables) => {
-      queryClient.invalidateQueries({
-        queryKey: workspaceCredentialKeys.members(variables.credentialId),
-      })
-      queryClient.invalidateQueries({
-        queryKey: workspaceCredentialKeys.detail(variables.credentialId),
-      })
-      queryClient.invalidateQueries({ queryKey: workspaceCredentialKeys.all })
-    },
-  })
-}