Fix

apps/docs/components/icons.tsx

@@ -1157,21 +1157,6 @@ export function AirweaveIcon(props: SVGProps<SVGSVGElement>) {
   )
 }
 
-export function GoogleBooksIcon(props: SVGProps<SVGSVGElement>) {
-  return (
-    <svg {...props} xmlns='http://www.w3.org/2000/svg' viewBox='0 0 478.633 540.068'>
-      <path
-        fill='#1C51A4'
-        d='M449.059,218.231L245.519,99.538l-0.061,193.23c0.031,1.504-0.368,2.977-1.166,4.204c-0.798,1.258-1.565,1.995-2.915,2.547c-1.35,0.552-2.792,0.706-4.204,0.399c-1.412-0.307-2.7-1.043-3.713-2.117l-69.166-70.609l-69.381,70.179c-1.013,0.982-2.301,1.657-3.652,1.903c-1.381,0.246-2.792,0.092-4.081-0.491c-1.289-0.583-1.626-0.522-2.394-1.749c-0.767-1.197-1.197-2.608-1.197-4.081L85.031,6.007l-2.915-1.289C43.973-11.638,0,16.409,0,59.891v420.306c0,46.029,49.312,74.782,88.775,51.767l360.285-210.138C488.491,298.782,488.491,241.246,449.059,218.231z'
-      />
-      <path
-        fill='#80D7FB'
-        d='M88.805,8.124c-2.179-1.289-4.419-2.363-6.659-3.345l0.123,288.663c0,1.442,0.43,2.854,1.197,4.081c0.767,1.197,1.872,2.148,3.161,2.731c1.289,0.583,2.7,0.736,4.081,0.491c1.381-0.246,2.639-0.921,3.652-1.903l69.749-69.688l69.811,69.749c1.013,1.074,2.301,1.81,3.713,2.117c1.412,0.307,2.884,0.153,4.204-0.399c1.319-0.552,2.455-1.565,3.253-2.792c0.798-1.258,1.197-2.731,1.166-4.204V99.998L88.805,8.124z'
-      />
-    </svg>
-  )
-}
-
 export function GoogleDocsIcon(props: SVGProps<SVGSVGElement>) {
   return (
     <svg

apps/docs/components/ui/icon-mapping.ts

@@ -38,7 +38,6 @@ import {
   GithubIcon,
   GitLabIcon,
   GmailIcon,
-  GoogleBooksIcon,
   GoogleCalendarIcon,
   GoogleDocsIcon,
   GoogleDriveIcon,
@@ -173,7 +172,6 @@ export const blockTypeToIconMap: Record<string, IconComponent> = {
   github_v2: GithubIcon,
   gitlab: GitLabIcon,
   gmail_v2: GmailIcon,
-  google_books: GoogleBooksIcon,
   google_calendar_v2: GoogleCalendarIcon,
   google_docs: GoogleDocsIcon,
   google_drive: GoogleDriveIcon,

apps/docs/content/docs/en/tools/google_books.mdx

@@ -1,96 +0,0 @@
----
-title: Google Books
-description: Search and retrieve book information
----
-
-import { BlockInfoCard } from "@/components/ui/block-info-card"
-
-<BlockInfoCard 
-  type="google_books"
-  color="#FFFFFF"
-/>
-
-## Usage Instructions
-
-Search for books using the Google Books API. Find volumes by title, author, ISBN, or keywords, and retrieve detailed information about specific books including descriptions, ratings, and publication details.
-
-
-
-## Tools
-
-### `google_books_volume_search`
-
-Search for books using the Google Books API
-
-#### Input
-
-| Parameter | Type | Required | Description |
-| --------- | ---- | -------- | ----------- |
-| `apiKey` | string | Yes | Google Books API key |
-| `query` | string | Yes | Search query. Supports special keywords: intitle:, inauthor:, inpublisher:, subject:, isbn: |
-| `filter` | string | No | Filter results by availability \(partial, full, free-ebooks, paid-ebooks, ebooks\) |
-| `printType` | string | No | Restrict to print type \(all, books, magazines\) |
-| `orderBy` | string | No | Sort order \(relevance, newest\) |
-| `startIndex` | number | No | Index of the first result to return \(for pagination\) |
-| `maxResults` | number | No | Maximum number of results to return \(1-40\) |
-| `langRestrict` | string | No | Restrict results to a specific language \(ISO 639-1 code\) |
-
-#### Output
-
-| Parameter | Type | Description |
-| --------- | ---- | ----------- |
-| `totalItems` | number | Total number of matching results |
-| `volumes` | array | List of matching volumes |
-|   ↳ `id` | string | Volume ID |
-|   ↳ `title` | string | Book title |
-|   ↳ `subtitle` | string | Book subtitle |
-|   ↳ `authors` | array | List of authors |
-|   ↳ `publisher` | string | Publisher name |
-|   ↳ `publishedDate` | string | Publication date |
-|   ↳ `description` | string | Book description |
-|   ↳ `pageCount` | number | Number of pages |
-|   ↳ `categories` | array | Book categories |
-|   ↳ `averageRating` | number | Average rating \(1-5\) |
-|   ↳ `ratingsCount` | number | Number of ratings |
-|   ↳ `language` | string | Language code |
-|   ↳ `previewLink` | string | Link to preview on Google Books |
-|   ↳ `infoLink` | string | Link to info page |
-|   ↳ `thumbnailUrl` | string | Book cover thumbnail URL |
-|   ↳ `isbn10` | string | ISBN-10 identifier |
-|   ↳ `isbn13` | string | ISBN-13 identifier |
-
-### `google_books_volume_details`
-
-Get detailed information about a specific book volume
-
-#### Input
-
-| Parameter | Type | Required | Description |
-| --------- | ---- | -------- | ----------- |
-| `apiKey` | string | Yes | Google Books API key |
-| `volumeId` | string | Yes | The ID of the volume to retrieve |
-| `projection` | string | No | Projection level \(full, lite\) |
-
-#### Output
-
-| Parameter | Type | Description |
-| --------- | ---- | ----------- |
-| `id` | string | Volume ID |
-| `title` | string | Book title |
-| `subtitle` | string | Book subtitle |
-| `authors` | array | List of authors |
-| `publisher` | string | Publisher name |
-| `publishedDate` | string | Publication date |
-| `description` | string | Book description |
-| `pageCount` | number | Number of pages |
-| `categories` | array | Book categories |
-| `averageRating` | number | Average rating \(1-5\) |
-| `ratingsCount` | number | Number of ratings |
-| `language` | string | Language code |
-| `previewLink` | string | Link to preview on Google Books |
-| `infoLink` | string | Link to info page |
-| `thumbnailUrl` | string | Book cover thumbnail URL |
-| `isbn10` | string | ISBN-10 identifier |
-| `isbn13` | string | ISBN-13 identifier |
-
-

apps/docs/content/docs/en/tools/meta.json

@@ -33,7 +33,6 @@
     "github",
     "gitlab",
     "gmail",
-    "google_books",
     "google_calendar",
     "google_docs",
     "google_drive",

apps/sim/.env.example

@@ -13,7 +13,6 @@ BETTER_AUTH_URL=http://localhost:3000
 
 # NextJS (Required)
 NEXT_PUBLIC_APP_URL=http://localhost:3000
-# INTERNAL_API_BASE_URL=http://sim-app.default.svc.cluster.local:3000  # Optional: internal URL for server-side /api self-calls; defaults to NEXT_PUBLIC_APP_URL
 
 # Security (Required)
 ENCRYPTION_KEY=your_encryption_key  # Use `openssl rand -hex 32` to generate, used to encrypt environment variables

apps/sim/app/api/a2a/serve/[agentId]/utils.ts

@@ -1,7 +1,7 @@
 import type { Artifact, Message, PushNotificationConfig, Task, TaskState } from '@a2a-js/sdk'
 import { v4 as uuidv4 } from 'uuid'
 import { generateInternalToken } from '@/lib/auth/internal'
-import { getInternalApiBaseUrl } from '@/lib/core/utils/urls'
+import { getBaseUrl } from '@/lib/core/utils/urls'
 
 /** A2A v0.3 JSON-RPC method names */
 export const A2A_METHODS = {
@@ -118,7 +118,7 @@ export interface ExecuteRequestResult {
 export async function buildExecuteRequest(
   config: ExecuteRequestConfig
 ): Promise<ExecuteRequestResult> {
-  const url = `${getInternalApiBaseUrl()}/api/workflows/${config.workflowId}/execute`
+  const url = `${getBaseUrl()}/api/workflows/${config.workflowId}/execute`
   const headers: Record<string, string> = { 'Content-Type': 'application/json' }
   let useInternalAuth = false
 

apps/sim/app/api/attribution/route.ts

@@ -1,187 +0,0 @@
-/**
- * POST /api/attribution
- *
- * Automatic UTM-based referral attribution.
- *
- * Reads the `sim_utm` cookie (set by proxy on auth pages), matches a campaign
- * by UTM specificity, and atomically inserts an attribution record + applies
- * bonus credits.
- *
- * Idempotent — the unique constraint on `userId` prevents double-attribution.
- */
-
-import { db } from '@sim/db'
-import { referralAttribution, referralCampaigns, userStats } from '@sim/db/schema'
-import { createLogger } from '@sim/logger'
-import { eq } from 'drizzle-orm'
-import { nanoid } from 'nanoid'
-import { cookies } from 'next/headers'
-import { NextResponse } from 'next/server'
-import { z } from 'zod'
-import { getSession } from '@/lib/auth'
-import { applyBonusCredits } from '@/lib/billing/credits/bonus'
-
-const logger = createLogger('AttributionAPI')
-
-const COOKIE_NAME = 'sim_utm'
-
-const UtmCookieSchema = z.object({
-  utm_source: z.string().optional(),
-  utm_medium: z.string().optional(),
-  utm_campaign: z.string().optional(),
-  utm_content: z.string().optional(),
-  referrer_url: z.string().optional(),
-  landing_page: z.string().optional(),
-  created_at: z.string().optional(),
-})
-
-/**
- * Finds the most specific active campaign matching the given UTM params.
- * Null fields on a campaign act as wildcards. Ties broken by newest campaign.
- */
-async function findMatchingCampaign(utmData: z.infer<typeof UtmCookieSchema>) {
-  const campaigns = await db
-    .select()
-    .from(referralCampaigns)
-    .where(eq(referralCampaigns.isActive, true))
-
-  let bestMatch: (typeof campaigns)[number] | null = null
-  let bestScore = -1
-
-  for (const campaign of campaigns) {
-    let score = 0
-    let mismatch = false
-
-    const fields = [
-      { campaignVal: campaign.utmSource, utmVal: utmData.utm_source },
-      { campaignVal: campaign.utmMedium, utmVal: utmData.utm_medium },
-      { campaignVal: campaign.utmCampaign, utmVal: utmData.utm_campaign },
-      { campaignVal: campaign.utmContent, utmVal: utmData.utm_content },
-    ] as const
-
-    for (const { campaignVal, utmVal } of fields) {
-      if (campaignVal === null) continue
-      if (campaignVal === utmVal) {
-        score++
-      } else {
-        mismatch = true
-        break
-      }
-    }
-
-    if (!mismatch && score > 0) {
-      if (
-        score > bestScore ||
-        (score === bestScore &&
-          bestMatch &&
-          campaign.createdAt.getTime() > bestMatch.createdAt.getTime())
-      ) {
-        bestScore = score
-        bestMatch = campaign
-      }
-    }
-  }
-
-  return bestMatch
-}
-
-export async function POST() {
-  try {
-    const session = await getSession()
-    if (!session?.user?.id) {
-      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
-    }
-
-    const cookieStore = await cookies()
-    const utmCookie = cookieStore.get(COOKIE_NAME)
-    if (!utmCookie?.value) {
-      return NextResponse.json({ attributed: false, reason: 'no_utm_cookie' })
-    }
-
-    let utmData: z.infer<typeof UtmCookieSchema>
-    try {
-      let decoded: string
-      try {
-        decoded = decodeURIComponent(utmCookie.value)
-      } catch {
-        decoded = utmCookie.value
-      }
-      utmData = UtmCookieSchema.parse(JSON.parse(decoded))
-    } catch {
-      logger.warn('Failed to parse UTM cookie', { userId: session.user.id })
-      cookieStore.delete(COOKIE_NAME)
-      return NextResponse.json({ attributed: false, reason: 'invalid_cookie' })
-    }
-
-    const matchedCampaign = await findMatchingCampaign(utmData)
-    if (!matchedCampaign) {
-      cookieStore.delete(COOKIE_NAME)
-      return NextResponse.json({ attributed: false, reason: 'no_matching_campaign' })
-    }
-
-    const bonusAmount = Number(matchedCampaign.bonusCreditAmount)
-
-    let attributed = false
-    await db.transaction(async (tx) => {
-      const [existingStats] = await tx
-        .select({ id: userStats.id })
-        .from(userStats)
-        .where(eq(userStats.userId, session.user.id))
-        .limit(1)
-
-      if (!existingStats) {
-        await tx.insert(userStats).values({
-          id: nanoid(),
-          userId: session.user.id,
-        })
-      }
-
-      const result = await tx
-        .insert(referralAttribution)
-        .values({
-          id: nanoid(),
-          userId: session.user.id,
-          campaignId: matchedCampaign.id,
-          utmSource: utmData.utm_source || null,
-          utmMedium: utmData.utm_medium || null,
-          utmCampaign: utmData.utm_campaign || null,
-          utmContent: utmData.utm_content || null,
-          referrerUrl: utmData.referrer_url || null,
-          landingPage: utmData.landing_page || null,
-          bonusCreditAmount: bonusAmount.toString(),
-        })
-        .onConflictDoNothing({ target: referralAttribution.userId })
-        .returning({ id: referralAttribution.id })
-
-      if (result.length > 0) {
-        await applyBonusCredits(session.user.id, bonusAmount, tx)
-        attributed = true
-      }
-    })
-
-    if (attributed) {
-      logger.info('Referral attribution created and bonus credits applied', {
-        userId: session.user.id,
-        campaignId: matchedCampaign.id,
-        campaignName: matchedCampaign.name,
-        utmSource: utmData.utm_source,
-        utmCampaign: utmData.utm_campaign,
-        utmContent: utmData.utm_content,
-        bonusAmount,
-      })
-    } else {
-      logger.info('User already attributed, skipping', { userId: session.user.id })
-    }
-
-    cookieStore.delete(COOKIE_NAME)
-
-    return NextResponse.json({
-      attributed,
-      bonusAmount: attributed ? bonusAmount : undefined,
-      reason: attributed ? undefined : 'already_attributed',
-    })
-  } catch (error) {
-    logger.error('Attribution error', { error })
-    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })
-  }
-}

apps/sim/app/api/auth/accounts/route.ts

@@ -1,7 +1,7 @@
 import { db } from '@sim/db'
 import { account } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
-import { and, desc, eq } from 'drizzle-orm'
+import { and, eq } from 'drizzle-orm'
 import { type NextRequest, NextResponse } from 'next/server'
 import { getSession } from '@/lib/auth'
 
@@ -31,13 +31,15 @@ export async function GET(request: NextRequest) {
       })
       .from(account)
       .where(and(...whereConditions))
-      .orderBy(desc(account.updatedAt))
+
+    // Use the user's email as the display name (consistent with credential selector)
+    const userEmail = session.user.email
 
     const accountsWithDisplayName = accounts.map((acc) => ({
       id: acc.id,
       accountId: acc.accountId,
       providerId: acc.providerId,
-      displayName: acc.accountId || acc.providerId,
+      displayName: userEmail || acc.providerId,
     }))
 
     return NextResponse.json({ accounts: accountsWithDisplayName })

apps/sim/app/api/auth/oauth/credentials/route.ts

@@ -1,5 +1,5 @@
 import { db } from '@sim/db'
-import { account, credential, credentialMember, user } from '@sim/db/schema'
+import { account, user } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
 import { and, eq } from 'drizzle-orm'
 import { jwtDecode } from 'jwt-decode'
@@ -7,10 +7,8 @@ import { type NextRequest, NextResponse } from 'next/server'
 import { z } from 'zod'
 import { checkSessionOrInternalAuth } from '@/lib/auth/hybrid'
 import { generateRequestId } from '@/lib/core/utils/request'
-import { syncWorkspaceOAuthCredentialsForUser } from '@/lib/credentials/oauth'
 import { evaluateScopeCoverage, type OAuthProvider, parseProvider } from '@/lib/oauth'
 import { authorizeWorkflowByWorkspacePermission } from '@/lib/workflows/utils'
-import { checkWorkspaceAccess } from '@/lib/workspaces/permissions/utils'
 
 export const dynamic = 'force-dynamic'
 
@@ -20,7 +18,6 @@ const credentialsQuerySchema = z
   .object({
     provider: z.string().nullish(),
     workflowId: z.string().uuid('Workflow ID must be a valid UUID').nullish(),
-    workspaceId: z.string().uuid('Workspace ID must be a valid UUID').nullish(),
     credentialId: z
       .string()
       .min(1, 'Credential ID must not be empty')
@@ -38,79 +35,6 @@ interface GoogleIdToken {
   name?: string
 }
 
-function toCredentialResponse(
-  id: string,
-  displayName: string,
-  providerId: string,
-  updatedAt: Date,
-  scope: string | null
-) {
-  const storedScope = scope?.trim()
-  const grantedScopes = storedScope ? storedScope.split(/[\s,]+/).filter(Boolean) : []
-  const scopeEvaluation = evaluateScopeCoverage(providerId, grantedScopes)
-  const [_, featureType = 'default'] = providerId.split('-')
-
-  return {
-    id,
-    name: displayName,
-    provider: providerId,
-    lastUsed: updatedAt.toISOString(),
-    isDefault: featureType === 'default',
-    scopes: scopeEvaluation.grantedScopes,
-    canonicalScopes: scopeEvaluation.canonicalScopes,
-    missingScopes: scopeEvaluation.missingScopes,
-    extraScopes: scopeEvaluation.extraScopes,
-    requiresReauthorization: scopeEvaluation.requiresReauthorization,
-  }
-}
-
-async function getFallbackDisplayName(
-  requestId: string,
-  providerParam: string | null | undefined,
-  accountRow: {
-    idToken: string | null
-    accountId: string
-    userId: string
-  }
-) {
-  const providerForParse = (providerParam || 'google') as OAuthProvider
-  const { baseProvider } = parseProvider(providerForParse)
-
-  if (accountRow.idToken) {
-    try {
-      const decoded = jwtDecode<GoogleIdToken>(accountRow.idToken)
-      if (decoded.email) return decoded.email
-      if (decoded.name) return decoded.name
-    } catch (_error) {
-      logger.warn(`[${requestId}] Error decoding ID token`, {
-        accountId: accountRow.accountId,
-      })
-    }
-  }
-
-  if (baseProvider === 'github') {
-    return `${accountRow.accountId} (GitHub)`
-  }
-
-  try {
-    const userRecord = await db
-      .select({ email: user.email })
-      .from(user)
-      .where(eq(user.id, accountRow.userId))
-      .limit(1)
-
-    if (userRecord.length > 0) {
-      return userRecord[0].email
-    }
-  } catch (_error) {
-    logger.warn(`[${requestId}] Error fetching user email`, {
-      userId: accountRow.userId,
-    })
-  }
-
-  return `${accountRow.accountId} (${baseProvider})`
-}
-
 /**
  * Get credentials for a specific provider
  */
@@ -122,7 +46,6 @@ export async function GET(request: NextRequest) {
     const rawQuery = {
       provider: searchParams.get('provider'),
       workflowId: searchParams.get('workflowId'),
-      workspaceId: searchParams.get('workspaceId'),
       credentialId: searchParams.get('credentialId'),
     }
 
@@ -155,7 +78,7 @@ export async function GET(request: NextRequest) {
       )
     }
 
-    const { provider: providerParam, workflowId, workspaceId, credentialId } = parseResult.data
+    const { provider: providerParam, workflowId, credentialId } = parseResult.data
 
     // Authenticate requester (supports session and internal JWT)
     const authResult = await checkSessionOrInternalAuth(request)
@@ -165,7 +88,7 @@ export async function GET(request: NextRequest) {
     }
     const requesterUserId = authResult.userId
 
-    let effectiveWorkspaceId = workspaceId ?? undefined
+    const effectiveUserId = requesterUserId
     if (workflowId) {
       const workflowAuthorization = await authorizeWorkflowByWorkspacePermission({
         workflowId,
@@ -183,145 +106,101 @@ export async function GET(request: NextRequest) {
           { status: workflowAuthorization.status }
         )
       }
-      effectiveWorkspaceId = workflowAuthorization.workflow?.workspaceId || undefined
     }
 
-    if (effectiveWorkspaceId) {
+    // Parse the provider to get base provider and feature type (if provider is present)
-      const workspaceAccess = await checkWorkspaceAccess(effectiveWorkspaceId, requesterUserId)
+    const { baseProvider } = parseProvider((providerParam || 'google') as OAuthProvider)
-      if (!workspaceAccess.hasAccess) {
-        return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
-      }
-    }
 
     let accountsData
 
-    if (credentialId) {
-      const [platformCredential] = await db
-        .select({
-          id: credential.id,
-          workspaceId: credential.workspaceId,
-          type: credential.type,
-          displayName: credential.displayName,
-          providerId: credential.providerId,
-          accountId: credential.accountId,
-          accountProviderId: account.providerId,
-          accountScope: account.scope,
-          accountUpdatedAt: account.updatedAt,
-        })
-        .from(credential)
-        .leftJoin(account, eq(credential.accountId, account.id))
-        .where(eq(credential.id, credentialId))
-        .limit(1)
-
-      if (platformCredential) {
-        if (platformCredential.type !== 'oauth' || !platformCredential.accountId) {
-          return NextResponse.json({ credentials: [] }, { status: 200 })
-        }
-
-        if (workflowId) {
-          if (!effectiveWorkspaceId || platformCredential.workspaceId !== effectiveWorkspaceId) {
-            return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
-          }
-        } else {
-          const [membership] = await db
-            .select({ id: credentialMember.id })
-            .from(credentialMember)
-            .where(
-              and(
-                eq(credentialMember.credentialId, platformCredential.id),
-                eq(credentialMember.userId, requesterUserId),
-                eq(credentialMember.status, 'active')
-              )
-            )
-            .limit(1)
-
-          if (!membership) {
-            return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
-          }
-        }
-
-        if (!platformCredential.accountProviderId || !platformCredential.accountUpdatedAt) {
-          return NextResponse.json({ credentials: [] }, { status: 200 })
-        }
-
-        return NextResponse.json(
-          {
-            credentials: [
-              toCredentialResponse(
-                platformCredential.id,
-                platformCredential.displayName,
-                platformCredential.accountProviderId,
-                platformCredential.accountUpdatedAt,
-                platformCredential.accountScope
-              ),
-            ],
-          },
-          { status: 200 }
-        )
-      }
-    }
-
-    if (effectiveWorkspaceId && providerParam) {
-      await syncWorkspaceOAuthCredentialsForUser({
-        workspaceId: effectiveWorkspaceId,
-        userId: requesterUserId,
-      })
-
-      const credentialsData = await db
-        .select({
-          id: credential.id,
-          displayName: credential.displayName,
-          providerId: account.providerId,
-          scope: account.scope,
-          updatedAt: account.updatedAt,
-        })
-        .from(credential)
-        .innerJoin(account, eq(credential.accountId, account.id))
-        .innerJoin(
-          credentialMember,
-          and(
-            eq(credentialMember.credentialId, credential.id),
-            eq(credentialMember.userId, requesterUserId),
-            eq(credentialMember.status, 'active')
-          )
-        )
-        .where(
-          and(
-            eq(credential.workspaceId, effectiveWorkspaceId),
-            eq(credential.type, 'oauth'),
-            eq(account.providerId, providerParam)
-          )
-        )
-
-      return NextResponse.json(
-        {
-          credentials: credentialsData.map((row) =>
-            toCredentialResponse(row.id, row.displayName, row.providerId, row.updatedAt, row.scope)
-          ),
-        },
-        { status: 200 }
-      )
-    }
-
     if (credentialId && workflowId) {
+      // When both workflowId and credentialId are provided, fetch by ID only.
+      // Workspace authorization above already proves access; the credential
+      // may belong to another workspace member (e.g. for display name resolution).
       accountsData = await db.select().from(account).where(eq(account.id, credentialId))
     } else if (credentialId) {
       accountsData = await db
         .select()
         .from(account)
-        .where(and(eq(account.userId, requesterUserId), eq(account.id, credentialId)))
+        .where(and(eq(account.userId, effectiveUserId), eq(account.id, credentialId)))
     } else {
+      // Fetch all credentials for provider and effective user
       accountsData = await db
         .select()
         .from(account)
-        .where(and(eq(account.userId, requesterUserId), eq(account.providerId, providerParam!)))
+        .where(and(eq(account.userId, effectiveUserId), eq(account.providerId, providerParam!)))
     }
 
     // Transform accounts into credentials
     const credentials = await Promise.all(
       accountsData.map(async (acc) => {
-        const displayName = await getFallbackDisplayName(requestId, providerParam, acc)
+        // Extract the feature type from providerId (e.g., 'google-default' -> 'default')
-        return toCredentialResponse(acc.id, displayName, acc.providerId, acc.updatedAt, acc.scope)
+        const [_, featureType = 'default'] = acc.providerId.split('-')
+
+        // Try multiple methods to get a user-friendly display name
+        let displayName = ''
+
+        // Method 1: Try to extract email from ID token (works for Google, etc.)
+        if (acc.idToken) {
+          try {
+            const decoded = jwtDecode<GoogleIdToken>(acc.idToken)
+            if (decoded.email) {
+              displayName = decoded.email
+            } else if (decoded.name) {
+              displayName = decoded.name
+            }
+          } catch (_error) {
+            logger.warn(`[${requestId}] Error decoding ID token`, {
+              accountId: acc.id,
+            })
+          }
+        }
+
+        // Method 2: For GitHub, the accountId might be the username
+        if (!displayName && baseProvider === 'github') {
+          displayName = `${acc.accountId} (GitHub)`
+        }
+
+        // Method 3: Try to get the user's email from our database
+        if (!displayName) {
+          try {
+            const userRecord = await db
+              .select({ email: user.email })
+              .from(user)
+              .where(eq(user.id, acc.userId))
+              .limit(1)
+
+            if (userRecord.length > 0) {
+              displayName = userRecord[0].email
+            }
+          } catch (_error) {
+            logger.warn(`[${requestId}] Error fetching user email`, {
+              userId: acc.userId,
+            })
+          }
+        }
+
+        // Fallback: Use accountId with provider type as context
+        if (!displayName) {
+          displayName = `${acc.accountId} (${baseProvider})`
+        }
+
+        const storedScope = acc.scope?.trim()
+        const grantedScopes = storedScope ? storedScope.split(/[\s,]+/).filter(Boolean) : []
+        const scopeEvaluation = evaluateScopeCoverage(acc.providerId, grantedScopes)
+
+        return {
+          id: acc.id,
+          name: displayName,
+          provider: acc.providerId,
+          lastUsed: acc.updatedAt.toISOString(),
+          isDefault: featureType === 'default',
+          scopes: scopeEvaluation.grantedScopes,
+          canonicalScopes: scopeEvaluation.canonicalScopes,
+          missingScopes: scopeEvaluation.missingScopes,
+          extraScopes: scopeEvaluation.extraScopes,
+          requiresReauthorization: scopeEvaluation.requiresReauthorization,
+        }
       })
     )
 

apps/sim/app/api/auth/oauth/disconnect/route.ts

@@ -15,7 +15,6 @@ const logger = createLogger('OAuthDisconnectAPI')
 const disconnectSchema = z.object({
   provider: z.string({ required_error: 'Provider is required' }).min(1, 'Provider is required'),
   providerId: z.string().optional(),
-  accountId: z.string().optional(),
 })
 
 /**
@@ -51,20 +50,15 @@ export async function POST(request: NextRequest) {
       )
     }
 
-    const { provider, providerId, accountId } = parseResult.data
+    const { provider, providerId } = parseResult.data
 
     logger.info(`[${requestId}] Processing OAuth disconnect request`, {
       provider,
       hasProviderId: !!providerId,
     })
 
-    // If a specific account row ID is provided, delete that exact account
+    // If a specific providerId is provided, delete only that account
-    if (accountId) {
+    if (providerId) {
-      await db
-        .delete(account)
-        .where(and(eq(account.userId, session.user.id), eq(account.id, accountId)))
-    } else if (providerId) {
-      // If a specific providerId is provided, delete accounts for that provider ID
       await db
         .delete(account)
         .where(and(eq(account.userId, session.user.id), eq(account.providerId, providerId)))

apps/sim/app/api/auth/oauth/microsoft/file/route.ts

@@ -38,18 +38,13 @@ export async function GET(request: NextRequest) {
       return NextResponse.json({ error: authz.error || 'Unauthorized' }, { status })
     }
 
-    const resolvedCredentialId = authz.resolvedCredentialId || credentialId
+    const credential = await getCredential(requestId, credentialId, authz.credentialOwnerUserId)
-    const credential = await getCredential(
-      requestId,
-      resolvedCredentialId,
-      authz.credentialOwnerUserId
-    )
     if (!credential) {
       return NextResponse.json({ error: 'Credential not found' }, { status: 404 })
     }
 
     const accessToken = await refreshAccessTokenIfNeeded(
-      resolvedCredentialId,
+      credentialId,
       authz.credentialOwnerUserId,
       requestId
     )

apps/sim/app/api/auth/oauth/microsoft/files/route.ts

@@ -37,19 +37,14 @@ export async function GET(request: NextRequest) {
       return NextResponse.json({ error: authz.error || 'Unauthorized' }, { status })
     }
 
-    const resolvedCredentialId = authz.resolvedCredentialId || credentialId
+    const credential = await getCredential(requestId, credentialId, authz.credentialOwnerUserId)
-    const credential = await getCredential(
-      requestId,
-      resolvedCredentialId,
-      authz.credentialOwnerUserId
-    )
     if (!credential) {
       return NextResponse.json({ error: 'Credential not found' }, { status: 404 })
     }
 
     // Refresh access token if needed using the utility function
     const accessToken = await refreshAccessTokenIfNeeded(
-      resolvedCredentialId,
+      credentialId,
       authz.credentialOwnerUserId,
       requestId
     )

apps/sim/app/api/auth/oauth/token/route.test.ts

@@ -351,11 +351,10 @@ describe('OAuth Token API Routes', () => {
    */
   describe('GET handler', () => {
     it('should return access token successfully', async () => {
-      mockAuthorizeCredentialUse.mockResolvedValueOnce({
+      mockCheckSessionOrInternalAuth.mockResolvedValueOnce({
-        ok: true,
+        success: true,
         authType: 'session',
-        requesterUserId: 'test-user-id',
+        userId: 'test-user-id',
-        credentialOwnerUserId: 'test-user-id',
       })
       mockGetCredential.mockResolvedValueOnce({
         id: 'credential-id',
@@ -381,8 +380,8 @@ describe('OAuth Token API Routes', () => {
       expect(response.status).toBe(200)
       expect(data).toHaveProperty('accessToken', 'fresh-token')
 
-      expect(mockAuthorizeCredentialUse).toHaveBeenCalled()
+      expect(mockCheckSessionOrInternalAuth).toHaveBeenCalled()
-      expect(mockGetCredential).toHaveBeenCalled()
+      expect(mockGetCredential).toHaveBeenCalledWith(mockRequestId, 'credential-id', 'test-user-id')
       expect(mockRefreshTokenIfNeeded).toHaveBeenCalled()
     })
 
@@ -400,8 +399,8 @@ describe('OAuth Token API Routes', () => {
     })
 
     it('should handle authentication failure', async () => {
-      mockAuthorizeCredentialUse.mockResolvedValueOnce({
+      mockCheckSessionOrInternalAuth.mockResolvedValueOnce({
-        ok: false,
+        success: false,
         error: 'Authentication required',
       })
 
@@ -414,16 +413,15 @@ describe('OAuth Token API Routes', () => {
       const response = await GET(req as any)
       const data = await response.json()
 
-      expect(response.status).toBe(403)
+      expect(response.status).toBe(401)
       expect(data).toHaveProperty('error')
     })
 
     it('should handle credential not found', async () => {
-      mockAuthorizeCredentialUse.mockResolvedValueOnce({
+      mockCheckSessionOrInternalAuth.mockResolvedValueOnce({
-        ok: true,
+        success: true,
         authType: 'session',
-        requesterUserId: 'test-user-id',
+        userId: 'test-user-id',
-        credentialOwnerUserId: 'test-user-id',
       })
       mockGetCredential.mockResolvedValueOnce(undefined)
 
@@ -441,11 +439,10 @@ describe('OAuth Token API Routes', () => {
     })
 
     it('should handle missing access token', async () => {
-      mockAuthorizeCredentialUse.mockResolvedValueOnce({
+      mockCheckSessionOrInternalAuth.mockResolvedValueOnce({
-        ok: true,
+        success: true,
         authType: 'session',
-        requesterUserId: 'test-user-id',
+        userId: 'test-user-id',
-        credentialOwnerUserId: 'test-user-id',
       })
       mockGetCredential.mockResolvedValueOnce({
         id: 'credential-id',
@@ -468,11 +465,10 @@ describe('OAuth Token API Routes', () => {
     })
 
     it('should handle token refresh failure', async () => {
-      mockAuthorizeCredentialUse.mockResolvedValueOnce({
+      mockCheckSessionOrInternalAuth.mockResolvedValueOnce({
-        ok: true,
+        success: true,
         authType: 'session',
-        requesterUserId: 'test-user-id',
+        userId: 'test-user-id',
-        credentialOwnerUserId: 'test-user-id',
       })
       mockGetCredential.mockResolvedValueOnce({
         id: 'credential-id',

apps/sim/app/api/auth/oauth/token/route.ts

@@ -110,35 +110,23 @@ export async function POST(request: NextRequest) {
       return NextResponse.json({ error: 'Credential ID is required' }, { status: 400 })
     }
 
-    const callerUserId = new URL(request.url).searchParams.get('userId') || undefined
-
     const authz = await authorizeCredentialUse(request, {
       credentialId,
       workflowId: workflowId ?? undefined,
       requireWorkflowIdForInternal: false,
-      callerUserId,
     })
     if (!authz.ok || !authz.credentialOwnerUserId) {
       return NextResponse.json({ error: authz.error || 'Unauthorized' }, { status: 403 })
     }
 
-    const resolvedCredentialId = authz.resolvedCredentialId || credentialId
+    const credential = await getCredential(requestId, credentialId, authz.credentialOwnerUserId)
-    const credential = await getCredential(
-      requestId,
-      resolvedCredentialId,
-      authz.credentialOwnerUserId
-    )
 
     if (!credential) {
       return NextResponse.json({ error: 'Credential not found' }, { status: 404 })
     }
 
     try {
-      const { accessToken } = await refreshTokenIfNeeded(
+      const { accessToken } = await refreshTokenIfNeeded(requestId, credential, credentialId)
-        requestId,
-        credential,
-        resolvedCredentialId
-      )
 
       let instanceUrl: string | undefined
       if (credential.providerId === 'salesforce' && credential.scope) {
@@ -198,20 +186,13 @@ export async function GET(request: NextRequest) {
 
     const { credentialId } = parseResult.data
 
-    const authz = await authorizeCredentialUse(request, {
+    // For GET requests, we only support session-based authentication
-      credentialId,
+    const auth = await checkSessionOrInternalAuth(request, { requireWorkflowId: false })
-      requireWorkflowIdForInternal: false,
+    if (!auth.success || auth.authType !== 'session' || !auth.userId) {
-    })
+      return NextResponse.json({ error: 'User not authenticated' }, { status: 401 })
-    if (!authz.ok || authz.authType !== 'session' || !authz.credentialOwnerUserId) {
-      return NextResponse.json({ error: authz.error || 'Unauthorized' }, { status: 403 })
     }
 
-    const resolvedCredentialId = authz.resolvedCredentialId || credentialId
+    const credential = await getCredential(requestId, credentialId, auth.userId)
-    const credential = await getCredential(
-      requestId,
-      resolvedCredentialId,
-      authz.credentialOwnerUserId
-    )
 
     if (!credential) {
       return NextResponse.json({ error: 'Credential not found' }, { status: 404 })
@@ -223,11 +204,7 @@ export async function GET(request: NextRequest) {
     }
 
     try {
-      const { accessToken } = await refreshTokenIfNeeded(
+      const { accessToken } = await refreshTokenIfNeeded(requestId, credential, credentialId)
-        requestId,
-        credential,
-        resolvedCredentialId
-      )
 
       // For Salesforce, extract instanceUrl from the scope field
       let instanceUrl: string | undefined

apps/sim/app/api/auth/oauth/utils.test.ts

@@ -4,10 +4,20 @@
  * @vitest-environment node
  */
 
-import { databaseMock, loggerMock } from '@sim/testing'
+import { loggerMock } from '@sim/testing'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
-vi.mock('@sim/db', () => databaseMock)
+vi.mock('@sim/db', () => ({
+  db: {
+    select: vi.fn().mockReturnThis(),
+    from: vi.fn().mockReturnThis(),
+    where: vi.fn().mockReturnThis(),
+    limit: vi.fn().mockReturnValue([]),
+    update: vi.fn().mockReturnThis(),
+    set: vi.fn().mockReturnThis(),
+    orderBy: vi.fn().mockReturnThis(),
+  },
+}))
 
 vi.mock('@/lib/oauth/oauth', () => ({
   refreshOAuthToken: vi.fn(),
@@ -24,36 +34,13 @@ import {
   refreshTokenIfNeeded,
 } from '@/app/api/auth/oauth/utils'
 
-const mockDb = db as any
+const mockDbTyped = db as any
 const mockRefreshOAuthToken = refreshOAuthToken as any
 
-/**
- * Creates a chainable mock for db.select() calls.
- * Returns a nested chain: select() -> from() -> where() -> limit() / orderBy()
- */
-function mockSelectChain(limitResult: unknown[]) {
-  const mockLimit = vi.fn().mockReturnValue(limitResult)
-  const mockOrderBy = vi.fn().mockReturnValue(limitResult)
-  const mockWhere = vi.fn().mockReturnValue({ limit: mockLimit, orderBy: mockOrderBy })
-  const mockFrom = vi.fn().mockReturnValue({ where: mockWhere })
-  mockDb.select.mockReturnValueOnce({ from: mockFrom })
-  return { mockFrom, mockWhere, mockLimit }
-}
-
-/**
- * Creates a chainable mock for db.update() calls.
- * Returns a nested chain: update() -> set() -> where()
- */
-function mockUpdateChain() {
-  const mockWhere = vi.fn().mockResolvedValue({})
-  const mockSet = vi.fn().mockReturnValue({ where: mockWhere })
-  mockDb.update.mockReturnValueOnce({ set: mockSet })
-  return { mockSet, mockWhere }
-}
-
 describe('OAuth Utils', () => {
   beforeEach(() => {
     vi.clearAllMocks()
+    mockDbTyped.limit.mockReturnValue([])
   })
 
   afterEach(() => {
@@ -62,23 +49,21 @@ describe('OAuth Utils', () => {
 
   describe('getCredential', () => {
     it('should return credential when found', async () => {
-      const mockCredentialRow = { type: 'oauth', accountId: 'resolved-account-id' }
+      const mockCredential = { id: 'credential-id', userId: 'test-user-id' }
-      const mockAccountRow = { id: 'resolved-account-id', userId: 'test-user-id' }
+      mockDbTyped.limit.mockReturnValueOnce([mockCredential])
-
-      mockSelectChain([mockCredentialRow])
-      mockSelectChain([mockAccountRow])
 
       const credential = await getCredential('request-id', 'credential-id', 'test-user-id')
 
-      expect(mockDb.select).toHaveBeenCalledTimes(2)
+      expect(mockDbTyped.select).toHaveBeenCalled()
+      expect(mockDbTyped.from).toHaveBeenCalled()
+      expect(mockDbTyped.where).toHaveBeenCalled()
+      expect(mockDbTyped.limit).toHaveBeenCalledWith(1)
 
-      expect(credential).toMatchObject(mockAccountRow)
+      expect(credential).toEqual(mockCredential)
-      expect(credential).toMatchObject({ resolvedCredentialId: 'resolved-account-id' })
     })
 
     it('should return undefined when credential is not found', async () => {
-      mockSelectChain([])
+      mockDbTyped.limit.mockReturnValueOnce([])
-      mockSelectChain([])
 
       const credential = await getCredential('request-id', 'nonexistent-id', 'test-user-id')
 
@@ -117,12 +102,11 @@ describe('OAuth Utils', () => {
         refreshToken: 'new-refresh-token',
       })
 
-      mockUpdateChain()
-
       const result = await refreshTokenIfNeeded('request-id', mockCredential, 'credential-id')
 
       expect(mockRefreshOAuthToken).toHaveBeenCalledWith('google', 'refresh-token')
-      expect(mockDb.update).toHaveBeenCalled()
+      expect(mockDbTyped.update).toHaveBeenCalled()
+      expect(mockDbTyped.set).toHaveBeenCalled()
       expect(result).toEqual({ accessToken: 'new-token', refreshed: true })
     })
 
@@ -160,17 +144,15 @@ describe('OAuth Utils', () => {
 
   describe('refreshAccessTokenIfNeeded', () => {
     it('should return valid access token without refresh if not expired', async () => {
-      const mockCredentialRow = { type: 'oauth', accountId: 'account-id' }
+      const mockCredential = {
-      const mockAccountRow = {
+        id: 'credential-id',
-        id: 'account-id',
         accessToken: 'valid-token',
         refreshToken: 'refresh-token',
         accessTokenExpiresAt: new Date(Date.now() + 3600 * 1000),
         providerId: 'google',
         userId: 'test-user-id',
       }
-      mockSelectChain([mockCredentialRow])
+      mockDbTyped.limit.mockReturnValueOnce([mockCredential])
-      mockSelectChain([mockAccountRow])
 
       const token = await refreshAccessTokenIfNeeded('credential-id', 'test-user-id', 'request-id')
 
@@ -179,18 +161,15 @@ describe('OAuth Utils', () => {
     })
 
     it('should refresh token when expired', async () => {
-      const mockCredentialRow = { type: 'oauth', accountId: 'account-id' }
+      const mockCredential = {
-      const mockAccountRow = {
+        id: 'credential-id',
-        id: 'account-id',
         accessToken: 'expired-token',
         refreshToken: 'refresh-token',
         accessTokenExpiresAt: new Date(Date.now() - 3600 * 1000),
         providerId: 'google',
         userId: 'test-user-id',
       }
-      mockSelectChain([mockCredentialRow])
+      mockDbTyped.limit.mockReturnValueOnce([mockCredential])
-      mockSelectChain([mockAccountRow])
-      mockUpdateChain()
 
       mockRefreshOAuthToken.mockResolvedValueOnce({
         accessToken: 'new-token',
@@ -201,13 +180,13 @@ describe('OAuth Utils', () => {
       const token = await refreshAccessTokenIfNeeded('credential-id', 'test-user-id', 'request-id')
 
       expect(mockRefreshOAuthToken).toHaveBeenCalledWith('google', 'refresh-token')
-      expect(mockDb.update).toHaveBeenCalled()
+      expect(mockDbTyped.update).toHaveBeenCalled()
+      expect(mockDbTyped.set).toHaveBeenCalled()
       expect(token).toBe('new-token')
     })
 
     it('should return null if credential not found', async () => {
-      mockSelectChain([])
+      mockDbTyped.limit.mockReturnValueOnce([])
-      mockSelectChain([])
 
       const token = await refreshAccessTokenIfNeeded('nonexistent-id', 'test-user-id', 'request-id')
 
@@ -215,17 +194,15 @@ describe('OAuth Utils', () => {
     })
 
     it('should return null if refresh fails', async () => {
-      const mockCredentialRow = { type: 'oauth', accountId: 'account-id' }
+      const mockCredential = {
-      const mockAccountRow = {
+        id: 'credential-id',
-        id: 'account-id',
         accessToken: 'expired-token',
         refreshToken: 'refresh-token',
         accessTokenExpiresAt: new Date(Date.now() - 3600 * 1000),
         providerId: 'google',
         userId: 'test-user-id',
       }
-      mockSelectChain([mockCredentialRow])
+      mockDbTyped.limit.mockReturnValueOnce([mockCredential])
-      mockSelectChain([mockAccountRow])
 
       mockRefreshOAuthToken.mockResolvedValueOnce(null)
 

apps/sim/app/api/auth/oauth/utils.ts

@@ -1,5 +1,5 @@
 import { db } from '@sim/db'
-import { account, credential, credentialSetMember } from '@sim/db/schema'
+import { account, credentialSetMember } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
 import { and, desc, eq, inArray } from 'drizzle-orm'
 import { refreshOAuthToken } from '@/lib/oauth'
@@ -25,28 +25,6 @@ interface AccountInsertData {
   accessTokenExpiresAt?: Date
 }
 
-async function resolveOAuthAccountId(
-  credentialId: string
-): Promise<{ accountId: string; usedCredentialTable: boolean } | null> {
-  const [credentialRow] = await db
-    .select({
-      type: credential.type,
-      accountId: credential.accountId,
-    })
-    .from(credential)
-    .where(eq(credential.id, credentialId))
-    .limit(1)
-
-  if (credentialRow) {
-    if (credentialRow.type !== 'oauth' || !credentialRow.accountId) {
-      return null
-    }
-    return { accountId: credentialRow.accountId, usedCredentialTable: true }
-  }
-
-  return { accountId: credentialId, usedCredentialTable: false }
-}
-
 /**
  * Safely inserts an account record, handling duplicate constraint violations gracefully.
  * If a duplicate is detected (unique constraint violation), logs a warning and returns success.
@@ -74,16 +52,10 @@ export async function safeAccountInsert(
  * Get a credential by ID and verify it belongs to the user
  */
 export async function getCredential(requestId: string, credentialId: string, userId: string) {
-  const resolved = await resolveOAuthAccountId(credentialId)
-  if (!resolved) {
-    logger.warn(`[${requestId}] Credential is not an OAuth credential`)
-    return undefined
-  }
-
   const credentials = await db
     .select()
     .from(account)
-    .where(and(eq(account.id, resolved.accountId), eq(account.userId, userId)))
+    .where(and(eq(account.id, credentialId), eq(account.userId, userId)))
     .limit(1)
 
   if (!credentials.length) {
@@ -91,10 +63,7 @@ export async function getCredential(requestId: string, credentialId: string, use
     return undefined
   }
 
-  return {
+  return credentials[0]
-    ...credentials[0],
-    resolvedCredentialId: resolved.accountId,
-  }
 }
 
 export async function getOAuthToken(userId: string, providerId: string): Promise<string | null> {
@@ -269,9 +238,7 @@ export async function refreshAccessTokenIfNeeded(
       }
 
       // Update the token in the database
-      const resolvedCredentialId =
+      await db.update(account).set(updateData).where(eq(account.id, credentialId))
-        (credential as { resolvedCredentialId?: string }).resolvedCredentialId ?? credentialId
-      await db.update(account).set(updateData).where(eq(account.id, resolvedCredentialId))
 
       logger.info(`[${requestId}] Successfully refreshed access token for credential`)
       return refreshedToken.accessToken
@@ -307,8 +274,6 @@ export async function refreshTokenIfNeeded(
   credential: any,
   credentialId: string
 ): Promise<{ accessToken: string; refreshed: boolean }> {
-  const resolvedCredentialId = credential.resolvedCredentialId ?? credentialId
-
   // Decide if we should refresh: token missing OR expired
   const accessTokenExpiresAt = credential.accessTokenExpiresAt
   const refreshTokenExpiresAt = credential.refreshTokenExpiresAt
@@ -369,7 +334,7 @@ export async function refreshTokenIfNeeded(
       updateData.refreshTokenExpiresAt = getMicrosoftRefreshTokenExpiry()
     }
 
-    await db.update(account).set(updateData).where(eq(account.id, resolvedCredentialId))
+    await db.update(account).set(updateData).where(eq(account.id, credentialId))
 
     logger.info(`[${requestId}] Successfully refreshed access token`)
     return { accessToken: refreshedToken, refreshed: true }
@@ -378,7 +343,7 @@ export async function refreshTokenIfNeeded(
       `[${requestId}] Refresh attempt failed, checking if another concurrent request succeeded`
     )
 
-    const freshCredential = await getCredential(requestId, resolvedCredentialId, credential.userId)
+    const freshCredential = await getCredential(requestId, credentialId, credential.userId)
     if (freshCredential?.accessToken) {
       const freshExpiresAt = freshCredential.accessTokenExpiresAt
       const stillValid = !freshExpiresAt || freshExpiresAt > new Date()

apps/sim/app/api/auth/oauth2/shopify/store/route.ts

@@ -48,21 +48,16 @@ export async function GET(request: NextRequest) {
 
     const shopData = await shopResponse.json()
     const shopInfo = shopData.shop
-    const stableAccountId = shopInfo.id?.toString() || shopDomain
 
     const existing = await db.query.account.findFirst({
-      where: and(
+      where: and(eq(account.userId, session.user.id), eq(account.providerId, 'shopify')),
-        eq(account.userId, session.user.id),
-        eq(account.providerId, 'shopify'),
-        eq(account.accountId, stableAccountId)
-      ),
     })
 
     const now = new Date()
 
     const accountData = {
       accessToken: accessToken,
-      accountId: stableAccountId,
+      accountId: shopInfo.id?.toString() || shopDomain,
       scope: scope || '',
       updatedAt: now,
       idToken: shopDomain,

apps/sim/app/api/auth/trello/store/route.ts

@@ -52,11 +52,7 @@ export async function POST(request: NextRequest) {
     const trelloUser = await userResponse.json()
 
     const existing = await db.query.account.findFirst({
-      where: and(
+      where: and(eq(account.userId, session.user.id), eq(account.providerId, 'trello')),
-        eq(account.userId, session.user.id),
-        eq(account.providerId, 'trello'),
-        eq(account.accountId, trelloUser.id)
-      ),
     })
 
     const now = new Date()

apps/sim/app/api/copilot/checkpoints/revert/route.test.ts

@@ -18,9 +18,9 @@ describe('Copilot Checkpoints Revert API Route', () => {
     setupCommonApiMocks()
     mockCryptoUuid()
 
+    // Mock getBaseUrl to return localhost for tests
     vi.doMock('@/lib/core/utils/urls', () => ({
       getBaseUrl: vi.fn(() => 'http://localhost:3000'),
-      getInternalApiBaseUrl: vi.fn(() => 'http://localhost:3000'),
       getBaseDomain: vi.fn(() => 'localhost:3000'),
       getEmailDomain: vi.fn(() => 'localhost:3000'),
     }))

apps/sim/app/api/copilot/checkpoints/revert/route.ts

@@ -11,7 +11,7 @@ import {
   createRequestTracker,
   createUnauthorizedResponse,
 } from '@/lib/copilot/request-helpers'
-import { getInternalApiBaseUrl } from '@/lib/core/utils/urls'
+import { getBaseUrl } from '@/lib/core/utils/urls'
 import { authorizeWorkflowByWorkspacePermission } from '@/lib/workflows/utils'
 import { isUuidV4 } from '@/executor/constants'
 
@@ -99,7 +99,7 @@ export async function POST(request: NextRequest) {
     }
 
     const stateResponse = await fetch(
-      `${getInternalApiBaseUrl()}/api/workflows/${checkpoint.workflowId}/state`,
+      `${getBaseUrl()}/api/workflows/${checkpoint.workflowId}/state`,
       {
         method: 'PUT',
         headers: {

apps/sim/app/api/credentials/[id]/members/route.ts

@@ -1,226 +0,0 @@
-import { db } from '@sim/db'
-import { credential, credentialMember, user } from '@sim/db/schema'
-import { createLogger } from '@sim/logger'
-import { and, eq } from 'drizzle-orm'
-import { type NextRequest, NextResponse } from 'next/server'
-import { z } from 'zod'
-import { getSession } from '@/lib/auth'
-import { getUserEntityPermissions } from '@/lib/workspaces/permissions/utils'
-
-const logger = createLogger('CredentialMembersAPI')
-
-interface RouteContext {
-  params: Promise<{ id: string }>
-}
-
-async function requireWorkspaceAdminMembership(credentialId: string, userId: string) {
-  const [cred] = await db
-    .select({ id: credential.id, workspaceId: credential.workspaceId })
-    .from(credential)
-    .where(eq(credential.id, credentialId))
-    .limit(1)
-
-  if (!cred) return null
-
-  const perm = await getUserEntityPermissions(userId, 'workspace', cred.workspaceId)
-  if (perm === null) return null
-
-  const [membership] = await db
-    .select({ role: credentialMember.role, status: credentialMember.status })
-    .from(credentialMember)
-    .where(
-      and(eq(credentialMember.credentialId, credentialId), eq(credentialMember.userId, userId))
-    )
-    .limit(1)
-
-  if (!membership || membership.status !== 'active' || membership.role !== 'admin') {
-    return null
-  }
-  return membership
-}
-
-export async function GET(_request: NextRequest, context: RouteContext) {
-  try {
-    const session = await getSession()
-    if (!session?.user?.id) {
-      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
-    }
-
-    const { id: credentialId } = await context.params
-
-    const [cred] = await db
-      .select({ id: credential.id, workspaceId: credential.workspaceId })
-      .from(credential)
-      .where(eq(credential.id, credentialId))
-      .limit(1)
-
-    if (!cred) {
-      return NextResponse.json({ members: [] }, { status: 200 })
-    }
-
-    const callerPerm = await getUserEntityPermissions(
-      session.user.id,
-      'workspace',
-      cred.workspaceId
-    )
-    if (callerPerm === null) {
-      return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
-    }
-
-    const members = await db
-      .select({
-        id: credentialMember.id,
-        userId: credentialMember.userId,
-        role: credentialMember.role,
-        status: credentialMember.status,
-        joinedAt: credentialMember.joinedAt,
-        userName: user.name,
-        userEmail: user.email,
-      })
-      .from(credentialMember)
-      .innerJoin(user, eq(credentialMember.userId, user.id))
-      .where(eq(credentialMember.credentialId, credentialId))
-
-    return NextResponse.json({ members })
-  } catch (error) {
-    logger.error('Failed to fetch credential members', { error })
-    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })
-  }
-}
-
-const addMemberSchema = z.object({
-  userId: z.string().min(1),
-  role: z.enum(['admin', 'member']).default('member'),
-})
-
-export async function POST(request: NextRequest, context: RouteContext) {
-  try {
-    const session = await getSession()
-    if (!session?.user?.id) {
-      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
-    }
-
-    const { id: credentialId } = await context.params
-
-    const admin = await requireWorkspaceAdminMembership(credentialId, session.user.id)
-    if (!admin) {
-      return NextResponse.json({ error: 'Admin access required' }, { status: 403 })
-    }
-
-    const body = await request.json()
-    const parsed = addMemberSchema.safeParse(body)
-    if (!parsed.success) {
-      return NextResponse.json({ error: 'Invalid request body' }, { status: 400 })
-    }
-
-    const { userId, role } = parsed.data
-    const now = new Date()
-
-    const [existing] = await db
-      .select({ id: credentialMember.id, status: credentialMember.status })
-      .from(credentialMember)
-      .where(
-        and(eq(credentialMember.credentialId, credentialId), eq(credentialMember.userId, userId))
-      )
-      .limit(1)
-
-    if (existing) {
-      await db
-        .update(credentialMember)
-        .set({ role, status: 'active', updatedAt: now })
-        .where(eq(credentialMember.id, existing.id))
-      return NextResponse.json({ success: true })
-    }
-
-    await db.insert(credentialMember).values({
-      id: crypto.randomUUID(),
-      credentialId,
-      userId,
-      role,
-      status: 'active',
-      joinedAt: now,
-      invitedBy: session.user.id,
-      createdAt: now,
-      updatedAt: now,
-    })
-
-    return NextResponse.json({ success: true }, { status: 201 })
-  } catch (error) {
-    logger.error('Failed to add credential member', { error })
-    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })
-  }
-}
-
-export async function DELETE(request: NextRequest, context: RouteContext) {
-  try {
-    const session = await getSession()
-    if (!session?.user?.id) {
-      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
-    }
-
-    const { id: credentialId } = await context.params
-    const targetUserId = new URL(request.url).searchParams.get('userId')
-    if (!targetUserId) {
-      return NextResponse.json({ error: 'userId query parameter required' }, { status: 400 })
-    }
-
-    const admin = await requireWorkspaceAdminMembership(credentialId, session.user.id)
-    if (!admin) {
-      return NextResponse.json({ error: 'Admin access required' }, { status: 403 })
-    }
-
-    const [target] = await db
-      .select({
-        id: credentialMember.id,
-        role: credentialMember.role,
-      })
-      .from(credentialMember)
-      .where(
-        and(
-          eq(credentialMember.credentialId, credentialId),
-          eq(credentialMember.userId, targetUserId),
-          eq(credentialMember.status, 'active')
-        )
-      )
-      .limit(1)
-
-    if (!target) {
-      return NextResponse.json({ error: 'Member not found' }, { status: 404 })
-    }
-
-    const revoked = await db.transaction(async (tx) => {
-      if (target.role === 'admin') {
-        const activeAdmins = await tx
-          .select({ id: credentialMember.id })
-          .from(credentialMember)
-          .where(
-            and(
-              eq(credentialMember.credentialId, credentialId),
-              eq(credentialMember.role, 'admin'),
-              eq(credentialMember.status, 'active')
-            )
-          )
-
-        if (activeAdmins.length <= 1) {
-          return false
-        }
-      }
-
-      await tx
-        .update(credentialMember)
-        .set({ status: 'revoked', updatedAt: new Date() })
-        .where(eq(credentialMember.id, target.id))
-
-      return true
-    })
-
-    if (!revoked) {
-      return NextResponse.json({ error: 'Cannot remove the last admin' }, { status: 400 })
-    }
-
-    return NextResponse.json({ success: true })
-  } catch (error) {
-    logger.error('Failed to remove credential member', { error })
-    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })
-  }
-}

apps/sim/app/api/credentials/[id]/route.ts

@@ -1,251 +0,0 @@
-import { db } from '@sim/db'
-import { credential, credentialMember, environment, workspaceEnvironment } from '@sim/db/schema'
-import { createLogger } from '@sim/logger'
-import { and, eq } from 'drizzle-orm'
-import { type NextRequest, NextResponse } from 'next/server'
-import { z } from 'zod'
-import { getSession } from '@/lib/auth'
-import { getCredentialActorContext } from '@/lib/credentials/access'
-import {
-  syncPersonalEnvCredentialsForUser,
-  syncWorkspaceEnvCredentials,
-} from '@/lib/credentials/environment'
-
-const logger = createLogger('CredentialByIdAPI')
-
-const updateCredentialSchema = z
-  .object({
-    displayName: z.string().trim().min(1).max(255).optional(),
-    description: z.string().trim().max(500).nullish(),
-  })
-  .strict()
-  .refine((data) => data.displayName !== undefined || data.description !== undefined, {
-    message: 'At least one field must be provided',
-    path: ['displayName'],
-  })
-
-async function getCredentialResponse(credentialId: string, userId: string) {
-  const [row] = await db
-    .select({
-      id: credential.id,
-      workspaceId: credential.workspaceId,
-      type: credential.type,
-      displayName: credential.displayName,
-      description: credential.description,
-      providerId: credential.providerId,
-      accountId: credential.accountId,
-      envKey: credential.envKey,
-      envOwnerUserId: credential.envOwnerUserId,
-      createdBy: credential.createdBy,
-      createdAt: credential.createdAt,
-      updatedAt: credential.updatedAt,
-      role: credentialMember.role,
-      status: credentialMember.status,
-    })
-    .from(credential)
-    .innerJoin(
-      credentialMember,
-      and(eq(credentialMember.credentialId, credential.id), eq(credentialMember.userId, userId))
-    )
-    .where(eq(credential.id, credentialId))
-    .limit(1)
-
-  return row ?? null
-}
-
-export async function GET(request: NextRequest, { params }: { params: Promise<{ id: string }> }) {
-  const session = await getSession()
-  if (!session?.user?.id) {
-    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
-  }
-
-  const { id } = await params
-
-  try {
-    const access = await getCredentialActorContext(id, session.user.id)
-    if (!access.credential) {
-      return NextResponse.json({ error: 'Credential not found' }, { status: 404 })
-    }
-    if (!access.hasWorkspaceAccess || !access.member) {
-      return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
-    }
-
-    const row = await getCredentialResponse(id, session.user.id)
-    return NextResponse.json({ credential: row }, { status: 200 })
-  } catch (error) {
-    logger.error('Failed to fetch credential', error)
-    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })
-  }
-}
-
-export async function PUT(request: NextRequest, { params }: { params: Promise<{ id: string }> }) {
-  const session = await getSession()
-  if (!session?.user?.id) {
-    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
-  }
-
-  const { id } = await params
-
-  try {
-    const parseResult = updateCredentialSchema.safeParse(await request.json())
-    if (!parseResult.success) {
-      return NextResponse.json({ error: parseResult.error.errors[0]?.message }, { status: 400 })
-    }
-
-    const access = await getCredentialActorContext(id, session.user.id)
-    if (!access.credential) {
-      return NextResponse.json({ error: 'Credential not found' }, { status: 404 })
-    }
-    if (!access.hasWorkspaceAccess || !access.isAdmin) {
-      return NextResponse.json({ error: 'Credential admin permission required' }, { status: 403 })
-    }
-
-    const updates: Record<string, unknown> = {}
-
-    if (parseResult.data.description !== undefined) {
-      updates.description = parseResult.data.description ?? null
-    }
-
-    if (parseResult.data.displayName !== undefined && access.credential.type === 'oauth') {
-      updates.displayName = parseResult.data.displayName
-    }
-
-    if (Object.keys(updates).length === 0) {
-      if (access.credential.type === 'oauth') {
-        return NextResponse.json(
-          {
-            error: 'No updatable fields provided.',
-          },
-          { status: 400 }
-        )
-      }
-      return NextResponse.json(
-        {
-          error:
-            'Environment credentials cannot be updated via this endpoint. Use the environment value editor in credentials settings.',
-        },
-        { status: 400 }
-      )
-    }
-
-    updates.updatedAt = new Date()
-    await db.update(credential).set(updates).where(eq(credential.id, id))
-
-    const row = await getCredentialResponse(id, session.user.id)
-    return NextResponse.json({ credential: row }, { status: 200 })
-  } catch (error) {
-    logger.error('Failed to update credential', error)
-    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })
-  }
-}
-
-export async function DELETE(
-  request: NextRequest,
-  { params }: { params: Promise<{ id: string }> }
-) {
-  const session = await getSession()
-  if (!session?.user?.id) {
-    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
-  }
-
-  const { id } = await params
-
-  try {
-    const access = await getCredentialActorContext(id, session.user.id)
-    if (!access.credential) {
-      return NextResponse.json({ error: 'Credential not found' }, { status: 404 })
-    }
-    if (!access.hasWorkspaceAccess || !access.isAdmin) {
-      return NextResponse.json({ error: 'Credential admin permission required' }, { status: 403 })
-    }
-
-    if (access.credential.type === 'env_personal' && access.credential.envKey) {
-      const ownerUserId = access.credential.envOwnerUserId
-      if (!ownerUserId) {
-        return NextResponse.json({ error: 'Invalid personal secret owner' }, { status: 400 })
-      }
-
-      const [personalRow] = await db
-        .select({ variables: environment.variables })
-        .from(environment)
-        .where(eq(environment.userId, ownerUserId))
-        .limit(1)
-
-      const current = ((personalRow?.variables as Record<string, string> | null) ?? {}) as Record<
-        string,
-        string
-      >
-      if (access.credential.envKey in current) {
-        delete current[access.credential.envKey]
-      }
-
-      await db
-        .insert(environment)
-        .values({
-          id: ownerUserId,
-          userId: ownerUserId,
-          variables: current,
-          updatedAt: new Date(),
-        })
-        .onConflictDoUpdate({
-          target: [environment.userId],
-          set: { variables: current, updatedAt: new Date() },
-        })
-
-      await syncPersonalEnvCredentialsForUser({
-        userId: ownerUserId,
-        envKeys: Object.keys(current),
-      })
-
-      return NextResponse.json({ success: true }, { status: 200 })
-    }
-
-    if (access.credential.type === 'env_workspace' && access.credential.envKey) {
-      const [workspaceRow] = await db
-        .select({
-          id: workspaceEnvironment.id,
-          createdAt: workspaceEnvironment.createdAt,
-          variables: workspaceEnvironment.variables,
-        })
-        .from(workspaceEnvironment)
-        .where(eq(workspaceEnvironment.workspaceId, access.credential.workspaceId))
-        .limit(1)
-
-      const current = ((workspaceRow?.variables as Record<string, string> | null) ?? {}) as Record<
-        string,
-        string
-      >
-      if (access.credential.envKey in current) {
-        delete current[access.credential.envKey]
-      }
-
-      await db
-        .insert(workspaceEnvironment)
-        .values({
-          id: workspaceRow?.id || crypto.randomUUID(),
-          workspaceId: access.credential.workspaceId,
-          variables: current,
-          createdAt: workspaceRow?.createdAt || new Date(),
-          updatedAt: new Date(),
-        })
-        .onConflictDoUpdate({
-          target: [workspaceEnvironment.workspaceId],
-          set: { variables: current, updatedAt: new Date() },
-        })
-
-      await syncWorkspaceEnvCredentials({
-        workspaceId: access.credential.workspaceId,
-        envKeys: Object.keys(current),
-        actingUserId: session.user.id,
-      })
-
-      return NextResponse.json({ success: true }, { status: 200 })
-    }
-
-    await db.delete(credential).where(eq(credential.id, id))
-    return NextResponse.json({ success: true }, { status: 200 })
-  } catch (error) {
-    logger.error('Failed to delete credential', error)
-    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })
-  }
-}

apps/sim/app/api/credentials/draft/route.ts

@@ -1,116 +0,0 @@
-import { db } from '@sim/db'
-import { credential, credentialMember, pendingCredentialDraft } from '@sim/db/schema'
-import { createLogger } from '@sim/logger'
-import { and, eq, lt } from 'drizzle-orm'
-import { NextResponse } from 'next/server'
-import { z } from 'zod'
-import { getSession } from '@/lib/auth'
-import { checkWorkspaceAccess } from '@/lib/workspaces/permissions/utils'
-
-const logger = createLogger('CredentialDraftAPI')
-
-const DRAFT_TTL_MS = 15 * 60 * 1000
-
-const createDraftSchema = z.object({
-  workspaceId: z.string().min(1),
-  providerId: z.string().min(1),
-  displayName: z.string().min(1),
-  description: z.string().trim().max(500).optional(),
-  credentialId: z.string().min(1).optional(),
-})
-
-export async function POST(request: Request) {
-  try {
-    const session = await getSession()
-    if (!session?.user?.id) {
-      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
-    }
-
-    const body = await request.json()
-    const parsed = createDraftSchema.safeParse(body)
-    if (!parsed.success) {
-      return NextResponse.json({ error: 'Invalid request body' }, { status: 400 })
-    }
-
-    const { workspaceId, providerId, displayName, description, credentialId } = parsed.data
-    const userId = session.user.id
-
-    const workspaceAccess = await checkWorkspaceAccess(workspaceId, userId)
-    if (!workspaceAccess.canWrite) {
-      return NextResponse.json({ error: 'Write permission required' }, { status: 403 })
-    }
-
-    if (credentialId) {
-      const [membership] = await db
-        .select({ role: credentialMember.role, status: credentialMember.status })
-        .from(credentialMember)
-        .innerJoin(credential, eq(credential.id, credentialMember.credentialId))
-        .where(
-          and(
-            eq(credentialMember.credentialId, credentialId),
-            eq(credentialMember.userId, userId),
-            eq(credentialMember.status, 'active'),
-            eq(credentialMember.role, 'admin'),
-            eq(credential.workspaceId, workspaceId)
-          )
-        )
-        .limit(1)
-
-      if (!membership) {
-        return NextResponse.json(
-          { error: 'Admin access required on the target credential' },
-          { status: 403 }
-        )
-      }
-    }
-
-    const now = new Date()
-
-    await db
-      .delete(pendingCredentialDraft)
-      .where(
-        and(eq(pendingCredentialDraft.userId, userId), lt(pendingCredentialDraft.expiresAt, now))
-      )
-
-    await db
-      .insert(pendingCredentialDraft)
-      .values({
-        id: crypto.randomUUID(),
-        userId,
-        workspaceId,
-        providerId,
-        displayName,
-        description: description || null,
-        credentialId: credentialId || null,
-        expiresAt: new Date(now.getTime() + DRAFT_TTL_MS),
-        createdAt: now,
-      })
-      .onConflictDoUpdate({
-        target: [
-          pendingCredentialDraft.userId,
-          pendingCredentialDraft.providerId,
-          pendingCredentialDraft.workspaceId,
-        ],
-        set: {
-          displayName,
-          description: description || null,
-          credentialId: credentialId || null,
-          expiresAt: new Date(now.getTime() + DRAFT_TTL_MS),
-          createdAt: now,
-        },
-      })
-
-    logger.info('Credential draft saved', {
-      userId,
-      workspaceId,
-      providerId,
-      displayName,
-      credentialId: credentialId || null,
-    })
-
-    return NextResponse.json({ success: true }, { status: 200 })
-  } catch (error) {
-    logger.error('Failed to save credential draft', { error })
-    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })
-  }
-}

apps/sim/app/api/credentials/memberships/route.ts

@@ -1,112 +0,0 @@
-import { db } from '@sim/db'
-import { credential, credentialMember } from '@sim/db/schema'
-import { createLogger } from '@sim/logger'
-import { and, eq } from 'drizzle-orm'
-import { type NextRequest, NextResponse } from 'next/server'
-import { z } from 'zod'
-import { getSession } from '@/lib/auth'
-
-const logger = createLogger('CredentialMembershipsAPI')
-
-const leaveCredentialSchema = z.object({
-  credentialId: z.string().min(1),
-})
-
-export async function GET() {
-  const session = await getSession()
-  if (!session?.user?.id) {
-    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
-  }
-
-  try {
-    const memberships = await db
-      .select({
-        membershipId: credentialMember.id,
-        credentialId: credential.id,
-        workspaceId: credential.workspaceId,
-        type: credential.type,
-        displayName: credential.displayName,
-        providerId: credential.providerId,
-        role: credentialMember.role,
-        status: credentialMember.status,
-        joinedAt: credentialMember.joinedAt,
-      })
-      .from(credentialMember)
-      .innerJoin(credential, eq(credentialMember.credentialId, credential.id))
-      .where(eq(credentialMember.userId, session.user.id))
-
-    return NextResponse.json({ memberships }, { status: 200 })
-  } catch (error) {
-    logger.error('Failed to list credential memberships', error)
-    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })
-  }
-}
-
-export async function DELETE(request: NextRequest) {
-  const session = await getSession()
-  if (!session?.user?.id) {
-    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
-  }
-
-  try {
-    const parseResult = leaveCredentialSchema.safeParse({
-      credentialId: new URL(request.url).searchParams.get('credentialId'),
-    })
-    if (!parseResult.success) {
-      return NextResponse.json({ error: parseResult.error.errors[0]?.message }, { status: 400 })
-    }
-
-    const { credentialId } = parseResult.data
-    const [membership] = await db
-      .select()
-      .from(credentialMember)
-      .where(
-        and(
-          eq(credentialMember.credentialId, credentialId),
-          eq(credentialMember.userId, session.user.id)
-        )
-      )
-      .limit(1)
-
-    if (!membership) {
-      return NextResponse.json({ error: 'Membership not found' }, { status: 404 })
-    }
-
-    if (membership.status !== 'active') {
-      return NextResponse.json({ success: true }, { status: 200 })
-    }
-
-    if (membership.role === 'admin') {
-      const activeAdmins = await db
-        .select({ id: credentialMember.id })
-        .from(credentialMember)
-        .where(
-          and(
-            eq(credentialMember.credentialId, credentialId),
-            eq(credentialMember.role, 'admin'),
-            eq(credentialMember.status, 'active')
-          )
-        )
-
-      if (activeAdmins.length <= 1) {
-        return NextResponse.json(
-          { error: 'Cannot leave credential as the last active admin' },
-          { status: 400 }
-        )
-      }
-    }
-
-    await db
-      .update(credentialMember)
-      .set({
-        status: 'revoked',
-        updatedAt: new Date(),
-      })
-      .where(eq(credentialMember.id, membership.id))
-
-    return NextResponse.json({ success: true }, { status: 200 })
-  } catch (error) {
-    logger.error('Failed to leave credential', error)
-    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })
-  }
-}

apps/sim/app/api/credentials/route.ts

@@ -1,521 +0,0 @@
-import { db } from '@sim/db'
-import { account, credential, credentialMember, workspace } from '@sim/db/schema'
-import { createLogger } from '@sim/logger'
-import { and, eq } from 'drizzle-orm'
-import { type NextRequest, NextResponse } from 'next/server'
-import { z } from 'zod'
-import { getSession } from '@/lib/auth'
-import { generateRequestId } from '@/lib/core/utils/request'
-import { getWorkspaceMemberUserIds } from '@/lib/credentials/environment'
-import { syncWorkspaceOAuthCredentialsForUser } from '@/lib/credentials/oauth'
-import { getServiceConfigByProviderId } from '@/lib/oauth'
-import { checkWorkspaceAccess } from '@/lib/workspaces/permissions/utils'
-import { isValidEnvVarName } from '@/executor/constants'
-
-const logger = createLogger('CredentialsAPI')
-
-const credentialTypeSchema = z.enum(['oauth', 'env_workspace', 'env_personal'])
-
-function normalizeEnvKeyInput(raw: string): string {
-  const trimmed = raw.trim()
-  const wrappedMatch = /^\{\{\s*([A-Za-z0-9_]+)\s*\}\}$/.exec(trimmed)
-  return wrappedMatch ? wrappedMatch[1] : trimmed
-}
-
-const listCredentialsSchema = z.object({
-  workspaceId: z.string().uuid('Workspace ID must be a valid UUID'),
-  type: credentialTypeSchema.optional(),
-  providerId: z.string().optional(),
-  credentialId: z.string().optional(),
-})
-
-const createCredentialSchema = z
-  .object({
-    workspaceId: z.string().uuid('Workspace ID must be a valid UUID'),
-    type: credentialTypeSchema,
-    displayName: z.string().trim().min(1).max(255).optional(),
-    description: z.string().trim().max(500).optional(),
-    providerId: z.string().trim().min(1).optional(),
-    accountId: z.string().trim().min(1).optional(),
-    envKey: z.string().trim().min(1).optional(),
-    envOwnerUserId: z.string().trim().min(1).optional(),
-  })
-  .superRefine((data, ctx) => {
-    if (data.type === 'oauth') {
-      if (!data.accountId) {
-        ctx.addIssue({
-          code: z.ZodIssueCode.custom,
-          message: 'accountId is required for oauth credentials',
-          path: ['accountId'],
-        })
-      }
-      if (!data.providerId) {
-        ctx.addIssue({
-          code: z.ZodIssueCode.custom,
-          message: 'providerId is required for oauth credentials',
-          path: ['providerId'],
-        })
-      }
-      if (!data.displayName) {
-        ctx.addIssue({
-          code: z.ZodIssueCode.custom,
-          message: 'displayName is required for oauth credentials',
-          path: ['displayName'],
-        })
-      }
-      return
-    }
-
-    const normalizedEnvKey = data.envKey ? normalizeEnvKeyInput(data.envKey) : ''
-    if (!normalizedEnvKey) {
-      ctx.addIssue({
-        code: z.ZodIssueCode.custom,
-        message: 'envKey is required for env credentials',
-        path: ['envKey'],
-      })
-      return
-    }
-
-    if (!isValidEnvVarName(normalizedEnvKey)) {
-      ctx.addIssue({
-        code: z.ZodIssueCode.custom,
-        message: 'envKey must contain only letters, numbers, and underscores',
-        path: ['envKey'],
-      })
-    }
-  })
-
-interface ExistingCredentialSourceParams {
-  workspaceId: string
-  type: 'oauth' | 'env_workspace' | 'env_personal'
-  accountId?: string | null
-  envKey?: string | null
-  envOwnerUserId?: string | null
-}
-
-async function findExistingCredentialBySource(params: ExistingCredentialSourceParams) {
-  const { workspaceId, type, accountId, envKey, envOwnerUserId } = params
-
-  if (type === 'oauth' && accountId) {
-    const [row] = await db
-      .select()
-      .from(credential)
-      .where(
-        and(
-          eq(credential.workspaceId, workspaceId),
-          eq(credential.type, 'oauth'),
-          eq(credential.accountId, accountId)
-        )
-      )
-      .limit(1)
-    return row ?? null
-  }
-
-  if (type === 'env_workspace' && envKey) {
-    const [row] = await db
-      .select()
-      .from(credential)
-      .where(
-        and(
-          eq(credential.workspaceId, workspaceId),
-          eq(credential.type, 'env_workspace'),
-          eq(credential.envKey, envKey)
-        )
-      )
-      .limit(1)
-    return row ?? null
-  }
-
-  if (type === 'env_personal' && envKey && envOwnerUserId) {
-    const [row] = await db
-      .select()
-      .from(credential)
-      .where(
-        and(
-          eq(credential.workspaceId, workspaceId),
-          eq(credential.type, 'env_personal'),
-          eq(credential.envKey, envKey),
-          eq(credential.envOwnerUserId, envOwnerUserId)
-        )
-      )
-      .limit(1)
-    return row ?? null
-  }
-
-  return null
-}
-
-export async function GET(request: NextRequest) {
-  const requestId = generateRequestId()
-  const session = await getSession()
-
-  if (!session?.user?.id) {
-    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
-  }
-
-  try {
-    const { searchParams } = new URL(request.url)
-    const rawWorkspaceId = searchParams.get('workspaceId')
-    const rawType = searchParams.get('type')
-    const rawProviderId = searchParams.get('providerId')
-    const rawCredentialId = searchParams.get('credentialId')
-    const parseResult = listCredentialsSchema.safeParse({
-      workspaceId: rawWorkspaceId?.trim(),
-      type: rawType?.trim() || undefined,
-      providerId: rawProviderId?.trim() || undefined,
-      credentialId: rawCredentialId?.trim() || undefined,
-    })
-
-    if (!parseResult.success) {
-      logger.warn(`[${requestId}] Invalid credential list request`, {
-        workspaceId: rawWorkspaceId,
-        type: rawType,
-        providerId: rawProviderId,
-        errors: parseResult.error.errors,
-      })
-      return NextResponse.json({ error: parseResult.error.errors[0]?.message }, { status: 400 })
-    }
-
-    const { workspaceId, type, providerId, credentialId: lookupCredentialId } = parseResult.data
-    const workspaceAccess = await checkWorkspaceAccess(workspaceId, session.user.id)
-
-    if (!workspaceAccess.hasAccess) {
-      return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
-    }
-
-    if (lookupCredentialId) {
-      let [row] = await db
-        .select({
-          id: credential.id,
-          displayName: credential.displayName,
-          type: credential.type,
-          providerId: credential.providerId,
-        })
-        .from(credential)
-        .where(and(eq(credential.id, lookupCredentialId), eq(credential.workspaceId, workspaceId)))
-        .limit(1)
-
-      if (!row) {
-        ;[row] = await db
-          .select({
-            id: credential.id,
-            displayName: credential.displayName,
-            type: credential.type,
-            providerId: credential.providerId,
-          })
-          .from(credential)
-          .where(
-            and(
-              eq(credential.accountId, lookupCredentialId),
-              eq(credential.workspaceId, workspaceId)
-            )
-          )
-          .limit(1)
-      }
-
-      return NextResponse.json({ credential: row ?? null })
-    }
-
-    if (!type || type === 'oauth') {
-      await syncWorkspaceOAuthCredentialsForUser({ workspaceId, userId: session.user.id })
-    }
-
-    const whereClauses = [
-      eq(credential.workspaceId, workspaceId),
-      eq(credentialMember.userId, session.user.id),
-      eq(credentialMember.status, 'active'),
-    ]
-
-    if (type) {
-      whereClauses.push(eq(credential.type, type))
-    }
-    if (providerId) {
-      whereClauses.push(eq(credential.providerId, providerId))
-    }
-
-    const credentials = await db
-      .select({
-        id: credential.id,
-        workspaceId: credential.workspaceId,
-        type: credential.type,
-        displayName: credential.displayName,
-        description: credential.description,
-        providerId: credential.providerId,
-        accountId: credential.accountId,
-        envKey: credential.envKey,
-        envOwnerUserId: credential.envOwnerUserId,
-        createdBy: credential.createdBy,
-        createdAt: credential.createdAt,
-        updatedAt: credential.updatedAt,
-        role: credentialMember.role,
-      })
-      .from(credential)
-      .innerJoin(
-        credentialMember,
-        and(
-          eq(credentialMember.credentialId, credential.id),
-          eq(credentialMember.userId, session.user.id),
-          eq(credentialMember.status, 'active')
-        )
-      )
-      .where(and(...whereClauses))
-
-    return NextResponse.json({ credentials })
-  } catch (error) {
-    logger.error(`[${requestId}] Failed to list credentials`, error)
-    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })
-  }
-}
-
-export async function POST(request: NextRequest) {
-  const requestId = generateRequestId()
-  const session = await getSession()
-
-  if (!session?.user?.id) {
-    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
-  }
-
-  try {
-    const body = await request.json()
-    const parseResult = createCredentialSchema.safeParse(body)
-
-    if (!parseResult.success) {
-      return NextResponse.json({ error: parseResult.error.errors[0]?.message }, { status: 400 })
-    }
-
-    const {
-      workspaceId,
-      type,
-      displayName,
-      description,
-      providerId,
-      accountId,
-      envKey,
-      envOwnerUserId,
-    } = parseResult.data
-
-    const workspaceAccess = await checkWorkspaceAccess(workspaceId, session.user.id)
-    if (!workspaceAccess.canWrite) {
-      return NextResponse.json({ error: 'Write permission required' }, { status: 403 })
-    }
-
-    let resolvedDisplayName = displayName?.trim() ?? ''
-    const resolvedDescription = description?.trim() || null
-    let resolvedProviderId: string | null = providerId ?? null
-    let resolvedAccountId: string | null = accountId ?? null
-    const resolvedEnvKey: string | null = envKey ? normalizeEnvKeyInput(envKey) : null
-    let resolvedEnvOwnerUserId: string | null = null
-
-    if (type === 'oauth') {
-      const [accountRow] = await db
-        .select({
-          id: account.id,
-          userId: account.userId,
-          providerId: account.providerId,
-          accountId: account.accountId,
-        })
-        .from(account)
-        .where(eq(account.id, accountId!))
-        .limit(1)
-
-      if (!accountRow) {
-        return NextResponse.json({ error: 'OAuth account not found' }, { status: 404 })
-      }
-
-      if (accountRow.userId !== session.user.id) {
-        return NextResponse.json(
-          { error: 'Only account owners can create oauth credentials for an account' },
-          { status: 403 }
-        )
-      }
-
-      if (providerId !== accountRow.providerId) {
-        return NextResponse.json(
-          { error: 'providerId does not match the selected OAuth account' },
-          { status: 400 }
-        )
-      }
-      if (!resolvedDisplayName) {
-        resolvedDisplayName =
-          getServiceConfigByProviderId(accountRow.providerId)?.name || accountRow.providerId
-      }
-    } else if (type === 'env_personal') {
-      resolvedEnvOwnerUserId = envOwnerUserId ?? session.user.id
-      if (resolvedEnvOwnerUserId !== session.user.id) {
-        return NextResponse.json(
-          { error: 'Only the current user can create personal env credentials for themselves' },
-          { status: 403 }
-        )
-      }
-      resolvedProviderId = null
-      resolvedAccountId = null
-      resolvedDisplayName = resolvedEnvKey || ''
-    } else {
-      resolvedProviderId = null
-      resolvedAccountId = null
-      resolvedEnvOwnerUserId = null
-      resolvedDisplayName = resolvedEnvKey || ''
-    }
-
-    if (!resolvedDisplayName) {
-      return NextResponse.json({ error: 'Display name is required' }, { status: 400 })
-    }
-
-    const existingCredential = await findExistingCredentialBySource({
-      workspaceId,
-      type,
-      accountId: resolvedAccountId,
-      envKey: resolvedEnvKey,
-      envOwnerUserId: resolvedEnvOwnerUserId,
-    })
-
-    if (existingCredential) {
-      const [membership] = await db
-        .select({
-          id: credentialMember.id,
-          status: credentialMember.status,
-          role: credentialMember.role,
-        })
-        .from(credentialMember)
-        .where(
-          and(
-            eq(credentialMember.credentialId, existingCredential.id),
-            eq(credentialMember.userId, session.user.id)
-          )
-        )
-        .limit(1)
-
-      if (!membership || membership.status !== 'active') {
-        return NextResponse.json(
-          { error: 'A credential with this source already exists in this workspace' },
-          { status: 409 }
-        )
-      }
-
-      const canUpdateExistingCredential = membership.role === 'admin'
-      const shouldUpdateDisplayName =
-        type === 'oauth' &&
-        resolvedDisplayName &&
-        resolvedDisplayName !== existingCredential.displayName
-      const shouldUpdateDescription =
-        typeof description !== 'undefined' &&
-        (existingCredential.description ?? null) !== resolvedDescription
-
-      if (canUpdateExistingCredential && (shouldUpdateDisplayName || shouldUpdateDescription)) {
-        await db
-          .update(credential)
-          .set({
-            ...(shouldUpdateDisplayName ? { displayName: resolvedDisplayName } : {}),
-            ...(shouldUpdateDescription ? { description: resolvedDescription } : {}),
-            updatedAt: new Date(),
-          })
-          .where(eq(credential.id, existingCredential.id))
-
-        const [updatedCredential] = await db
-          .select()
-          .from(credential)
-          .where(eq(credential.id, existingCredential.id))
-          .limit(1)
-
-        return NextResponse.json(
-          { credential: updatedCredential ?? existingCredential },
-          { status: 200 }
-        )
-      }
-
-      return NextResponse.json({ credential: existingCredential }, { status: 200 })
-    }
-
-    const now = new Date()
-    const credentialId = crypto.randomUUID()
-    const [workspaceRow] = await db
-      .select({ ownerId: workspace.ownerId })
-      .from(workspace)
-      .where(eq(workspace.id, workspaceId))
-      .limit(1)
-
-    await db.transaction(async (tx) => {
-      await tx.insert(credential).values({
-        id: credentialId,
-        workspaceId,
-        type,
-        displayName: resolvedDisplayName,
-        description: resolvedDescription,
-        providerId: resolvedProviderId,
-        accountId: resolvedAccountId,
-        envKey: resolvedEnvKey,
-        envOwnerUserId: resolvedEnvOwnerUserId,
-        createdBy: session.user.id,
-        createdAt: now,
-        updatedAt: now,
-      })
-
-      if (type === 'env_workspace' && workspaceRow?.ownerId) {
-        const workspaceUserIds = await getWorkspaceMemberUserIds(workspaceId)
-        if (workspaceUserIds.length > 0) {
-          for (const memberUserId of workspaceUserIds) {
-            await tx.insert(credentialMember).values({
-              id: crypto.randomUUID(),
-              credentialId,
-              userId: memberUserId,
-              role: memberUserId === workspaceRow.ownerId ? 'admin' : 'member',
-              status: 'active',
-              joinedAt: now,
-              invitedBy: session.user.id,
-              createdAt: now,
-              updatedAt: now,
-            })
-          }
-        }
-      } else {
-        await tx.insert(credentialMember).values({
-          id: crypto.randomUUID(),
-          credentialId,
-          userId: session.user.id,
-          role: 'admin',
-          status: 'active',
-          joinedAt: now,
-          invitedBy: session.user.id,
-          createdAt: now,
-          updatedAt: now,
-        })
-      }
-    })
-
-    const [created] = await db
-      .select()
-      .from(credential)
-      .where(eq(credential.id, credentialId))
-      .limit(1)
-
-    return NextResponse.json({ credential: created }, { status: 201 })
-  } catch (error: any) {
-    if (error?.code === '23505') {
-      return NextResponse.json(
-        { error: 'A credential with this source already exists' },
-        { status: 409 }
-      )
-    }
-    if (error?.code === '23503') {
-      return NextResponse.json(
-        { error: 'Invalid credential reference or membership target' },
-        { status: 400 }
-      )
-    }
-    if (error?.code === '23514') {
-      return NextResponse.json(
-        { error: 'Credential source data failed validation checks' },
-        { status: 400 }
-      )
-    }
-    logger.error(`[${requestId}] Credential create failure details`, {
-      code: error?.code,
-      detail: error?.detail,
-      constraint: error?.constraint,
-      table: error?.table,
-      message: error?.message,
-    })
-    logger.error(`[${requestId}] Failed to create credential`, error)
-    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })
-  }
-}

apps/sim/app/api/environment/route.ts

@@ -7,7 +7,6 @@ import { z } from 'zod'
 import { getSession } from '@/lib/auth'
 import { decryptSecret, encryptSecret } from '@/lib/core/security/encryption'
 import { generateRequestId } from '@/lib/core/utils/request'
-import { syncPersonalEnvCredentialsForUser } from '@/lib/credentials/environment'
 import type { EnvironmentVariable } from '@/stores/settings/environment'
 
 const logger = createLogger('EnvironmentAPI')
@@ -54,11 +53,6 @@ export async function POST(req: NextRequest) {
           },
         })
 
-      await syncPersonalEnvCredentialsForUser({
-        userId: session.user.id,
-        envKeys: Object.keys(variables),
-      })
-
       return NextResponse.json({ success: true })
     } catch (validationError) {
       if (validationError instanceof z.ZodError) {

apps/sim/app/api/knowledge/search/utils.test.ts

@@ -4,12 +4,16 @@
  *
  * @vitest-environment node
  */
-import { createEnvMock, databaseMock, loggerMock } from '@sim/testing'
+import { createEnvMock, createMockLogger } from '@sim/testing'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
+const loggerMock = vi.hoisted(() => ({
+  createLogger: () => createMockLogger(),
+}))
+
 vi.mock('drizzle-orm')
 vi.mock('@sim/logger', () => loggerMock)
-vi.mock('@sim/db', () => databaseMock)
+vi.mock('@sim/db')
 vi.mock('@/lib/knowledge/documents/utils', () => ({
   retryWithExponentialBackoff: (fn: any) => fn(),
 }))

apps/sim/app/api/mcp/serve/[serverId]/route.test.ts

@@ -72,7 +72,6 @@ describe('MCP Serve Route', () => {
     }))
     vi.doMock('@/lib/core/utils/urls', () => ({
       getBaseUrl: () => 'http://localhost:3000',
-      getInternalApiBaseUrl: () => 'http://localhost:3000',
     }))
     vi.doMock('@/lib/core/execution-limits', () => ({
       getMaxExecutionTimeout: () => 10_000,

apps/sim/app/api/mcp/serve/[serverId]/route.ts

@@ -22,7 +22,7 @@ import { type NextRequest, NextResponse } from 'next/server'
 import { type AuthResult, checkHybridAuth } from '@/lib/auth/hybrid'
 import { generateInternalToken } from '@/lib/auth/internal'
 import { getMaxExecutionTimeout } from '@/lib/core/execution-limits'
-import { getInternalApiBaseUrl } from '@/lib/core/utils/urls'
+import { getBaseUrl } from '@/lib/core/utils/urls'
 import { getUserEntityPermissions } from '@/lib/workspaces/permissions/utils'
 
 const logger = createLogger('WorkflowMcpServeAPI')
@@ -285,7 +285,7 @@ async function handleToolsCall(
       )
     }
 
-    const executeUrl = `${getInternalApiBaseUrl()}/api/workflows/${tool.workflowId}/execute`
+    const executeUrl = `${getBaseUrl()}/api/workflows/${tool.workflowId}/execute`
     const headers: Record<string, string> = { 'Content-Type': 'application/json' }
 
     if (publicServerOwnerId) {

apps/sim/app/api/organizations/[id]/invitations/[invitationId]/route.ts

@@ -11,7 +11,6 @@ import {
   user,
   userStats,
   type WorkspaceInvitationStatus,
-  workspaceEnvironment,
   workspaceInvitation,
 } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
@@ -24,7 +23,6 @@ import { hasAccessControlAccess } from '@/lib/billing'
 import { syncUsageLimitsFromSubscription } from '@/lib/billing/core/usage'
 import { requireStripeClient } from '@/lib/billing/stripe-client'
 import { getBaseUrl } from '@/lib/core/utils/urls'
-import { syncWorkspaceEnvCredentials } from '@/lib/credentials/environment'
 import { sendEmail } from '@/lib/messaging/email/mailer'
 
 const logger = createLogger('OrganizationInvitation')
@@ -497,34 +495,6 @@ export async function PUT(
       }
     })
 
-    if (status === 'accepted') {
-      const acceptedWsInvitations = await db
-        .select({ workspaceId: workspaceInvitation.workspaceId })
-        .from(workspaceInvitation)
-        .where(
-          and(
-            eq(workspaceInvitation.orgInvitationId, invitationId),
-            eq(workspaceInvitation.status, 'accepted' as WorkspaceInvitationStatus)
-          )
-        )
-
-      for (const wsInv of acceptedWsInvitations) {
-        const [wsEnvRow] = await db
-          .select({ variables: workspaceEnvironment.variables })
-          .from(workspaceEnvironment)
-          .where(eq(workspaceEnvironment.workspaceId, wsInv.workspaceId))
-          .limit(1)
-        const wsEnvKeys = Object.keys((wsEnvRow?.variables as Record<string, string>) || {})
-        if (wsEnvKeys.length > 0) {
-          await syncWorkspaceEnvCredentials({
-            workspaceId: wsInv.workspaceId,
-            envKeys: wsEnvKeys,
-            actingUserId: session.user.id,
-          })
-        }
-      }
-    }
-
     // Handle Pro subscription cancellation after transaction commits
     if (personalProToCancel) {
       try {

apps/sim/app/api/referral-code/redeem/route.ts

@@ -1,170 +0,0 @@
-/**
- * POST /api/referral-code/redeem
- *
- * Redeem a referral/promo code to receive bonus credits.
- *
- * Body:
- *   - code: string — The referral code to redeem
- *
- * Response: { redeemed: boolean, bonusAmount?: number, error?: string }
- *
- * Constraints:
- *   - Enterprise users cannot redeem codes
- *   - One redemption per user, ever (unique constraint on userId)
- *   - One redemption per organization for team users (partial unique on organizationId)
- */
-
-import { db } from '@sim/db'
-import { referralAttribution, referralCampaigns, userStats } from '@sim/db/schema'
-import { createLogger } from '@sim/logger'
-import { and, eq } from 'drizzle-orm'
-import { nanoid } from 'nanoid'
-import { NextResponse } from 'next/server'
-import { z } from 'zod'
-import { getSession } from '@/lib/auth'
-import { getHighestPrioritySubscription } from '@/lib/billing/core/subscription'
-import { applyBonusCredits } from '@/lib/billing/credits/bonus'
-
-const logger = createLogger('ReferralCodeRedemption')
-
-const RedeemCodeSchema = z.object({
-  code: z.string().min(1, 'Code is required'),
-})
-
-export async function POST(request: Request) {
-  try {
-    const session = await getSession()
-    if (!session?.user?.id) {
-      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
-    }
-
-    const body = await request.json()
-    const { code } = RedeemCodeSchema.parse(body)
-
-    const subscription = await getHighestPrioritySubscription(session.user.id)
-
-    if (subscription?.plan === 'enterprise') {
-      return NextResponse.json({
-        redeemed: false,
-        error: 'Enterprise accounts cannot redeem referral codes',
-      })
-    }
-
-    const isTeam = subscription?.plan === 'team'
-    const orgId = isTeam ? subscription.referenceId : null
-
-    const normalizedCode = code.trim().toUpperCase()
-
-    const [campaign] = await db
-      .select()
-      .from(referralCampaigns)
-      .where(and(eq(referralCampaigns.code, normalizedCode), eq(referralCampaigns.isActive, true)))
-      .limit(1)
-
-    if (!campaign) {
-      logger.info('Invalid code redemption attempt', {
-        userId: session.user.id,
-        code: normalizedCode,
-      })
-      return NextResponse.json({ error: 'Invalid or expired code' }, { status: 404 })
-    }
-
-    const [existingUserAttribution] = await db
-      .select({ id: referralAttribution.id })
-      .from(referralAttribution)
-      .where(eq(referralAttribution.userId, session.user.id))
-      .limit(1)
-
-    if (existingUserAttribution) {
-      return NextResponse.json({
-        redeemed: false,
-        error: 'You have already redeemed a code',
-      })
-    }
-
-    if (orgId) {
-      const [existingOrgAttribution] = await db
-        .select({ id: referralAttribution.id })
-        .from(referralAttribution)
-        .where(eq(referralAttribution.organizationId, orgId))
-        .limit(1)
-
-      if (existingOrgAttribution) {
-        return NextResponse.json({
-          redeemed: false,
-          error: 'A code has already been redeemed for your organization',
-        })
-      }
-    }
-
-    const bonusAmount = Number(campaign.bonusCreditAmount)
-
-    let redeemed = false
-    await db.transaction(async (tx) => {
-      const [existingStats] = await tx
-        .select({ id: userStats.id })
-        .from(userStats)
-        .where(eq(userStats.userId, session.user.id))
-        .limit(1)
-
-      if (!existingStats) {
-        await tx.insert(userStats).values({
-          id: nanoid(),
-          userId: session.user.id,
-        })
-      }
-
-      const result = await tx
-        .insert(referralAttribution)
-        .values({
-          id: nanoid(),
-          userId: session.user.id,
-          organizationId: orgId,
-          campaignId: campaign.id,
-          utmSource: null,
-          utmMedium: null,
-          utmCampaign: null,
-          utmContent: null,
-          referrerUrl: null,
-          landingPage: null,
-          bonusCreditAmount: bonusAmount.toString(),
-        })
-        .onConflictDoNothing()
-        .returning({ id: referralAttribution.id })
-
-      if (result.length > 0) {
-        await applyBonusCredits(session.user.id, bonusAmount, tx)
-        redeemed = true
-      }
-    })
-
-    if (redeemed) {
-      logger.info('Referral code redeemed', {
-        userId: session.user.id,
-        organizationId: orgId,
-        code: normalizedCode,
-        campaignId: campaign.id,
-        campaignName: campaign.name,
-        bonusAmount,
-      })
-    }
-
-    if (!redeemed) {
-      return NextResponse.json({
-        redeemed: false,
-        error: 'You have already redeemed a code',
-      })
-    }
-
-    return NextResponse.json({
-      redeemed: true,
-      bonusAmount,
-    })
-  } catch (error) {
-    if (error instanceof z.ZodError) {
-      return NextResponse.json({ error: error.errors[0].message }, { status: 400 })
-    }
-    logger.error('Referral code redemption error', { error })
-    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })
-  }
-}

apps/sim/app/api/schedules/[id]/route.test.ts

@@ -3,14 +3,17 @@
  *
  * @vitest-environment node
  */
-import { databaseMock, loggerMock } from '@sim/testing'
+import { loggerMock } from '@sim/testing'
 import { NextRequest } from 'next/server'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
-const { mockGetSession, mockAuthorizeWorkflowByWorkspacePermission } = vi.hoisted(() => ({
+const { mockGetSession, mockAuthorizeWorkflowByWorkspacePermission, mockDbSelect, mockDbUpdate } =
+  vi.hoisted(() => ({
     mockGetSession: vi.fn(),
     mockAuthorizeWorkflowByWorkspacePermission: vi.fn(),
-}))
+    mockDbSelect: vi.fn(),
+    mockDbUpdate: vi.fn(),
+  }))
 
 vi.mock('@/lib/auth', () => ({
   getSession: mockGetSession,
@@ -20,7 +23,12 @@ vi.mock('@/lib/workflows/utils', () => ({
   authorizeWorkflowByWorkspacePermission: mockAuthorizeWorkflowByWorkspacePermission,
 }))
 
-vi.mock('@sim/db', () => databaseMock)
+vi.mock('@sim/db', () => ({
+  db: {
+    select: mockDbSelect,
+    update: mockDbUpdate,
+  },
+}))
 
 vi.mock('@sim/db/schema', () => ({
   workflow: { id: 'id', userId: 'userId', workspaceId: 'workspaceId' },
@@ -51,9 +59,6 @@ function createParams(id: string): { params: Promise<{ id: string }> } {
   return { params: Promise.resolve({ id }) }
 }
 
-const mockDbSelect = databaseMock.db.select as ReturnType<typeof vi.fn>
-const mockDbUpdate = databaseMock.db.update as ReturnType<typeof vi.fn>
-
 function mockDbChain(selectResults: unknown[][]) {
   let selectCallIndex = 0
   mockDbSelect.mockImplementation(() => ({

apps/sim/app/api/schedules/route.test.ts

@@ -3,14 +3,17 @@
  *
  * @vitest-environment node
  */
-import { databaseMock, loggerMock } from '@sim/testing'
+import { loggerMock } from '@sim/testing'
 import { NextRequest } from 'next/server'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
-const { mockGetSession, mockAuthorizeWorkflowByWorkspacePermission } = vi.hoisted(() => ({
+const { mockGetSession, mockAuthorizeWorkflowByWorkspacePermission, mockDbSelect } = vi.hoisted(
+  () => ({
     mockGetSession: vi.fn(),
     mockAuthorizeWorkflowByWorkspacePermission: vi.fn(),
-}))
+    mockDbSelect: vi.fn(),
+  })
+)
 
 vi.mock('@/lib/auth', () => ({
   getSession: mockGetSession,
@@ -20,7 +23,11 @@ vi.mock('@/lib/workflows/utils', () => ({
   authorizeWorkflowByWorkspacePermission: mockAuthorizeWorkflowByWorkspacePermission,
 }))
 
-vi.mock('@sim/db', () => databaseMock)
+vi.mock('@sim/db', () => ({
+  db: {
+    select: mockDbSelect,
+  },
+}))
 
 vi.mock('@sim/db/schema', () => ({
   workflow: { id: 'id', userId: 'userId', workspaceId: 'workspaceId' },
@@ -55,8 +62,6 @@ function createRequest(url: string): NextRequest {
   return new NextRequest(new URL(url), { method: 'GET' })
 }
 
-const mockDbSelect = databaseMock.db.select as ReturnType<typeof vi.fn>
-
 function mockDbChain(results: any[]) {
   let callIndex = 0
   mockDbSelect.mockImplementation(() => ({

apps/sim/app/api/templates/[id]/use/route.ts

@@ -6,7 +6,7 @@ import { type NextRequest, NextResponse } from 'next/server'
 import { v4 as uuidv4 } from 'uuid'
 import { getSession } from '@/lib/auth'
 import { generateRequestId } from '@/lib/core/utils/request'
-import { getInternalApiBaseUrl } from '@/lib/core/utils/urls'
+import { getBaseUrl } from '@/lib/core/utils/urls'
 import {
   type RegenerateStateInput,
   regenerateWorkflowStateIds,
@@ -115,9 +115,7 @@ export async function POST(request: NextRequest, { params }: { params: Promise<{
     // Step 3: Save the workflow state using the existing state endpoint (like imports do)
     // Ensure variables in state are remapped for the new workflow as well
     const workflowStateWithVariables = { ...workflowState, variables: remappedVariables }
-    const stateResponse = await fetch(
+    const stateResponse = await fetch(`${getBaseUrl()}/api/workflows/${newWorkflowId}/state`, {
-      `${getInternalApiBaseUrl()}/api/workflows/${newWorkflowId}/state`,
-      {
       method: 'PUT',
       headers: {
         'Content-Type': 'application/json',
@@ -125,8 +123,7 @@ export async function POST(request: NextRequest, { params }: { params: Promise<{
         cookie: request.headers.get('cookie') || '',
       },
       body: JSON.stringify(workflowStateWithVariables),
-      }
+    })
-    )
 
     if (!stateResponse.ok) {
       logger.error(`[${requestId}] Failed to save workflow state for template use`)

apps/sim/app/api/v1/admin/index.ts

@@ -66,12 +66,6 @@
  *   Credits:
  *   POST   /api/v1/admin/credits                            - Issue credits to user (by userId or email)
  *
- *   Referral Campaigns:
- *   GET    /api/v1/admin/referral-campaigns                 - List campaigns (?active=true/false)
- *   POST   /api/v1/admin/referral-campaigns                 - Create campaign
- *   GET    /api/v1/admin/referral-campaigns/:id             - Get campaign details
- *   PATCH  /api/v1/admin/referral-campaigns/:id             - Update campaign fields
- *
  *   Access Control (Permission Groups):
  *   GET    /api/v1/admin/access-control                     - List permission groups (?organizationId=X)
  *   DELETE /api/v1/admin/access-control                     - Delete permission groups for org (?organizationId=X)
@@ -103,7 +97,6 @@ export type {
   AdminOrganization,
   AdminOrganizationBillingSummary,
   AdminOrganizationDetail,
-  AdminReferralCampaign,
   AdminSeatAnalytics,
   AdminSingleResponse,
   AdminSubscription,
@@ -118,7 +111,6 @@ export type {
   AdminWorkspaceMember,
   DbMember,
   DbOrganization,
-  DbReferralCampaign,
   DbSubscription,
   DbUser,
   DbUserStats,
@@ -147,7 +139,6 @@ export {
   parseWorkflowVariables,
   toAdminFolder,
   toAdminOrganization,
-  toAdminReferralCampaign,
   toAdminSubscription,
   toAdminUser,
   toAdminWorkflow,

apps/sim/app/api/v1/admin/referral-campaigns/[id]/route.ts

@@ -1,142 +0,0 @@
-/**
- * GET   /api/v1/admin/referral-campaigns/:id
- *
- * Get a single referral campaign by ID.
- *
- * PATCH /api/v1/admin/referral-campaigns/:id
- *
- * Update campaign fields. All fields are optional.
- *
- * Body:
- *   - name: string (non-empty) - Campaign name
- *   - bonusCreditAmount: number (> 0) - Bonus credits in dollars
- *   - isActive: boolean - Enable/disable the campaign
- *   - code: string | null (min 6 chars, auto-uppercased, null to remove) - Redeemable code
- *   - utmSource: string | null - UTM source match (null = wildcard)
- *   - utmMedium: string | null - UTM medium match (null = wildcard)
- *   - utmCampaign: string | null - UTM campaign match (null = wildcard)
- *   - utmContent: string | null - UTM content match (null = wildcard)
- */
-
-import { db } from '@sim/db'
-import { referralCampaigns } from '@sim/db/schema'
-import { createLogger } from '@sim/logger'
-import { eq } from 'drizzle-orm'
-import { getBaseUrl } from '@/lib/core/utils/urls'
-import { withAdminAuthParams } from '@/app/api/v1/admin/middleware'
-import {
-  badRequestResponse,
-  internalErrorResponse,
-  notFoundResponse,
-  singleResponse,
-} from '@/app/api/v1/admin/responses'
-import { toAdminReferralCampaign } from '@/app/api/v1/admin/types'
-
-const logger = createLogger('AdminReferralCampaignDetailAPI')
-
-interface RouteParams {
-  id: string
-}
-
-export const GET = withAdminAuthParams<RouteParams>(async (_, context) => {
-  try {
-    const { id: campaignId } = await context.params
-
-    const [campaign] = await db
-      .select()
-      .from(referralCampaigns)
-      .where(eq(referralCampaigns.id, campaignId))
-      .limit(1)
-
-    if (!campaign) {
-      return notFoundResponse('Campaign')
-    }
-
-    logger.info(`Admin API: Retrieved referral campaign ${campaignId}`)
-
-    return singleResponse(toAdminReferralCampaign(campaign, getBaseUrl()))
-  } catch (error) {
-    logger.error('Admin API: Failed to get referral campaign', { error })
-    return internalErrorResponse('Failed to get referral campaign')
-  }
-})
-
-export const PATCH = withAdminAuthParams<RouteParams>(async (request, context) => {
-  try {
-    const { id: campaignId } = await context.params
-    const body = await request.json()
-
-    const [existing] = await db
-      .select()
-      .from(referralCampaigns)
-      .where(eq(referralCampaigns.id, campaignId))
-      .limit(1)
-
-    if (!existing) {
-      return notFoundResponse('Campaign')
-    }
-
-    const updateData: Record<string, unknown> = { updatedAt: new Date() }
-
-    if (body.name !== undefined) {
-      if (typeof body.name !== 'string' || body.name.trim().length === 0) {
-        return badRequestResponse('name must be a non-empty string')
-      }
-      updateData.name = body.name.trim()
-    }
-
-    if (body.bonusCreditAmount !== undefined) {
-      if (
-        typeof body.bonusCreditAmount !== 'number' ||
-        !Number.isFinite(body.bonusCreditAmount) ||
-        body.bonusCreditAmount <= 0
-      ) {
-        return badRequestResponse('bonusCreditAmount must be a positive number')
-      }
-      updateData.bonusCreditAmount = body.bonusCreditAmount.toString()
-    }
-
-    if (body.isActive !== undefined) {
-      if (typeof body.isActive !== 'boolean') {
-        return badRequestResponse('isActive must be a boolean')
-      }
-      updateData.isActive = body.isActive
-    }
-
-    if (body.code !== undefined) {
-      if (body.code !== null) {
-        if (typeof body.code !== 'string') {
-          return badRequestResponse('code must be a string or null')
-        }
-        if (body.code.trim().length < 6) {
-          return badRequestResponse('code must be at least 6 characters')
-        }
-      }
-      updateData.code = body.code ? body.code.trim().toUpperCase() : null
-    }
-
-    for (const field of ['utmSource', 'utmMedium', 'utmCampaign', 'utmContent'] as const) {
-      if (body[field] !== undefined) {
-        if (body[field] !== null && typeof body[field] !== 'string') {
-          return badRequestResponse(`${field} must be a string or null`)
-        }
-        updateData[field] = body[field] || null
-      }
-    }
-
-    const [updated] = await db
-      .update(referralCampaigns)
-      .set(updateData)
-      .where(eq(referralCampaigns.id, campaignId))
-      .returning()
-
-    logger.info(`Admin API: Updated referral campaign ${campaignId}`, {
-      fields: Object.keys(updateData).filter((k) => k !== 'updatedAt'),
-    })
-
-    return singleResponse(toAdminReferralCampaign(updated, getBaseUrl()))
-  } catch (error) {
-    logger.error('Admin API: Failed to update referral campaign', { error })
-    return internalErrorResponse('Failed to update referral campaign')
-  }
-})

apps/sim/app/api/v1/admin/referral-campaigns/route.ts

@@ -1,140 +0,0 @@
-/**
- * GET  /api/v1/admin/referral-campaigns
- *
- * List referral campaigns with optional filtering and pagination.
- *
- * Query Parameters:
- *   - active: string (optional) - Filter by active status ('true' or 'false')
- *   - limit: number (default: 50, max: 250)
- *   - offset: number (default: 0)
- *
- * POST /api/v1/admin/referral-campaigns
- *
- * Create a new referral campaign.
- *
- * Body:
- *   - name: string (required) - Campaign name
- *   - bonusCreditAmount: number (required, > 0) - Bonus credits in dollars
- *   - code: string | null (optional, min 6 chars, auto-uppercased) - Redeemable code
- *   - utmSource: string | null (optional) - UTM source match (null = wildcard)
- *   - utmMedium: string | null (optional) - UTM medium match (null = wildcard)
- *   - utmCampaign: string | null (optional) - UTM campaign match (null = wildcard)
- *   - utmContent: string | null (optional) - UTM content match (null = wildcard)
- */
-
-import { db } from '@sim/db'
-import { referralCampaigns } from '@sim/db/schema'
-import { createLogger } from '@sim/logger'
-import { count, eq, type SQL } from 'drizzle-orm'
-import { nanoid } from 'nanoid'
-import { getBaseUrl } from '@/lib/core/utils/urls'
-import { withAdminAuth } from '@/app/api/v1/admin/middleware'
-import {
-  badRequestResponse,
-  internalErrorResponse,
-  listResponse,
-  singleResponse,
-} from '@/app/api/v1/admin/responses'
-import {
-  type AdminReferralCampaign,
-  createPaginationMeta,
-  parsePaginationParams,
-  toAdminReferralCampaign,
-} from '@/app/api/v1/admin/types'
-
-const logger = createLogger('AdminReferralCampaignsAPI')
-
-export const GET = withAdminAuth(async (request) => {
-  const url = new URL(request.url)
-  const { limit, offset } = parsePaginationParams(url)
-  const activeFilter = url.searchParams.get('active')
-
-  try {
-    const conditions: SQL<unknown>[] = []
-    if (activeFilter === 'true') {
-      conditions.push(eq(referralCampaigns.isActive, true))
-    } else if (activeFilter === 'false') {
-      conditions.push(eq(referralCampaigns.isActive, false))
-    }
-
-    const whereClause = conditions.length > 0 ? conditions[0] : undefined
-    const baseUrl = getBaseUrl()
-
-    const [countResult, campaigns] = await Promise.all([
-      db.select({ total: count() }).from(referralCampaigns).where(whereClause),
-      db
-        .select()
-        .from(referralCampaigns)
-        .where(whereClause)
-        .orderBy(referralCampaigns.createdAt)
-        .limit(limit)
-        .offset(offset),
-    ])
-
-    const total = countResult[0].total
-    const data: AdminReferralCampaign[] = campaigns.map((c) => toAdminReferralCampaign(c, baseUrl))
-    const pagination = createPaginationMeta(total, limit, offset)
-
-    logger.info(`Admin API: Listed ${data.length} referral campaigns (total: ${total})`)
-
-    return listResponse(data, pagination)
-  } catch (error) {
-    logger.error('Admin API: Failed to list referral campaigns', { error })
-    return internalErrorResponse('Failed to list referral campaigns')
-  }
-})
-
-export const POST = withAdminAuth(async (request) => {
-  try {
-    const body = await request.json()
-    const { name, code, utmSource, utmMedium, utmCampaign, utmContent, bonusCreditAmount } = body
-
-    if (!name || typeof name !== 'string') {
-      return badRequestResponse('name is required and must be a string')
-    }
-
-    if (
-      typeof bonusCreditAmount !== 'number' ||
-      !Number.isFinite(bonusCreditAmount) ||
-      bonusCreditAmount <= 0
-    ) {
-      return badRequestResponse('bonusCreditAmount must be a positive number')
-    }
-
-    if (code !== undefined && code !== null) {
-      if (typeof code !== 'string') {
-        return badRequestResponse('code must be a string or null')
-      }
-      if (code.trim().length < 6) {
-        return badRequestResponse('code must be at least 6 characters')
-      }
-    }
-
-    const id = nanoid()
-
-    const [campaign] = await db
-      .insert(referralCampaigns)
-      .values({
-        id,
-        name,
-        code: code ? code.trim().toUpperCase() : null,
-        utmSource: utmSource || null,
-        utmMedium: utmMedium || null,
-        utmCampaign: utmCampaign || null,
-        utmContent: utmContent || null,
-        bonusCreditAmount: bonusCreditAmount.toString(),
-      })
-      .returning()
-
-    logger.info(`Admin API: Created referral campaign ${id}`, {
-      name,
-      code: campaign.code,
-      bonusCreditAmount,
-    })
-
-    return singleResponse(toAdminReferralCampaign(campaign, getBaseUrl()))
-  } catch (error) {
-    logger.error('Admin API: Failed to create referral campaign', { error })
-    return internalErrorResponse('Failed to create referral campaign')
-  }
-})

apps/sim/app/api/v1/admin/types.ts

@@ -8,7 +8,6 @@
 import type {
   member,
   organization,
-  referralCampaigns,
   subscription,
   user,
   userStats,
@@ -32,7 +31,6 @@ export type DbOrganization = InferSelectModel<typeof organization>
 export type DbSubscription = InferSelectModel<typeof subscription>
 export type DbMember = InferSelectModel<typeof member>
 export type DbUserStats = InferSelectModel<typeof userStats>
-export type DbReferralCampaign = InferSelectModel<typeof referralCampaigns>
 
 // =============================================================================
 // Pagination
@@ -648,49 +646,3 @@ export interface AdminDeployResult {
 export interface AdminUndeployResult {
   isDeployed: boolean
 }
-
-// =============================================================================
-// Referral Campaign Types
-// =============================================================================
-
-export interface AdminReferralCampaign {
-  id: string
-  name: string
-  code: string | null
-  utmSource: string | null
-  utmMedium: string | null
-  utmCampaign: string | null
-  utmContent: string | null
-  bonusCreditAmount: string
-  isActive: boolean
-  signupUrl: string | null
-  createdAt: string
-  updatedAt: string
-}
-
-export function toAdminReferralCampaign(
-  dbCampaign: DbReferralCampaign,
-  baseUrl: string
-): AdminReferralCampaign {
-  const utmParams = new URLSearchParams()
-  if (dbCampaign.utmSource) utmParams.set('utm_source', dbCampaign.utmSource)
-  if (dbCampaign.utmMedium) utmParams.set('utm_medium', dbCampaign.utmMedium)
-  if (dbCampaign.utmCampaign) utmParams.set('utm_campaign', dbCampaign.utmCampaign)
-  if (dbCampaign.utmContent) utmParams.set('utm_content', dbCampaign.utmContent)
-  const query = utmParams.toString()
-
-  return {
-    id: dbCampaign.id,
-    name: dbCampaign.name,
-    code: dbCampaign.code,
-    utmSource: dbCampaign.utmSource,
-    utmMedium: dbCampaign.utmMedium,
-    utmCampaign: dbCampaign.utmCampaign,
-    utmContent: dbCampaign.utmContent,
-    bonusCreditAmount: dbCampaign.bonusCreditAmount,
-    isActive: dbCampaign.isActive,
-    signupUrl: query ? `${baseUrl}/signup?${query}` : null,
-    createdAt: dbCampaign.createdAt.toISOString(),
-    updatedAt: dbCampaign.updatedAt.toISOString(),
-  }
-}

apps/sim/app/api/v1/admin/workspaces/[id]/members/[memberId]/route.ts

@@ -25,7 +25,6 @@ import { db } from '@sim/db'
 import { permissions, user, workspace } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
 import { and, eq } from 'drizzle-orm'
-import { revokeWorkspaceCredentialMemberships } from '@/lib/credentials/access'
 import { withAdminAuthParams } from '@/app/api/v1/admin/middleware'
 import {
   badRequestResponse,
@@ -216,8 +215,6 @@ export const DELETE = withAdminAuthParams<RouteParams>(async (_, context) => {
 
     await db.delete(permissions).where(eq(permissions.id, memberId))
 
-    await revokeWorkspaceCredentialMemberships(workspaceId, existingMember.userId)
-
     logger.info(`Admin API: Removed member ${memberId} from workspace ${workspaceId}`, {
       userId: existingMember.userId,
     })

apps/sim/app/api/v1/admin/workspaces/[id]/members/route.ts

@@ -32,10 +32,9 @@
 
 import crypto from 'crypto'
 import { db } from '@sim/db'
-import { permissions, user, workspace, workspaceEnvironment } from '@sim/db/schema'
+import { permissions, user, workspace } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
 import { and, count, eq } from 'drizzle-orm'
-import { syncWorkspaceEnvCredentials } from '@/lib/credentials/environment'
 import { withAdminAuthParams } from '@/app/api/v1/admin/middleware'
 import {
   badRequestResponse,
@@ -233,20 +232,6 @@ export const POST = withAdminAuthParams<RouteParams>(async (request, context) =>
       permissionId,
     })
 
-    const [wsEnvRow] = await db
-      .select({ variables: workspaceEnvironment.variables })
-      .from(workspaceEnvironment)
-      .where(eq(workspaceEnvironment.workspaceId, workspaceId))
-      .limit(1)
-    const wsEnvKeys = Object.keys((wsEnvRow?.variables as Record<string, string>) || {})
-    if (wsEnvKeys.length > 0) {
-      await syncWorkspaceEnvCredentials({
-        workspaceId,
-        envKeys: wsEnvKeys,
-        actingUserId: body.userId,
-      })
-    }
-
     return singleResponse({
       id: permissionId,
       workspaceId,

apps/sim/app/api/workflows/[id]/execute/route.ts

@@ -536,7 +536,6 @@ export async function POST(req: NextRequest, { params }: { params: Promise<{ id:
           useDraftState: shouldUseDraftState,
           startTime: new Date().toISOString(),
           isClientSession,
-          enforceCredentialAccess: useAuthenticatedUserAsActor,
           workflowStateOverride: effectiveWorkflowStateOverride,
         }
 
@@ -886,7 +885,6 @@ export async function POST(req: NextRequest, { params }: { params: Promise<{ id:
             useDraftState: shouldUseDraftState,
             startTime: new Date().toISOString(),
             isClientSession,
-            enforceCredentialAccess: useAuthenticatedUserAsActor,
             workflowStateOverride: effectiveWorkflowStateOverride,
           }
 

apps/sim/app/api/workflows/[id]/route.test.ts

@@ -5,7 +5,7 @@
  * @vitest-environment node
  */
 
-import { loggerMock, setupGlobalFetchMock } from '@sim/testing'
+import { loggerMock } from '@sim/testing'
 import { NextRequest } from 'next/server'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
@@ -284,7 +284,9 @@ describe('Workflow By ID API Route', () => {
         where: vi.fn().mockResolvedValue([{ id: 'workflow-123' }]),
       })
 
-      setupGlobalFetchMock({ ok: true })
+      global.fetch = vi.fn().mockResolvedValue({
+        ok: true,
+      })
 
       const req = new NextRequest('http://localhost:3000/api/workflows/workflow-123', {
         method: 'DELETE',
@@ -329,7 +331,9 @@ describe('Workflow By ID API Route', () => {
         where: vi.fn().mockResolvedValue([{ id: 'workflow-123' }]),
       })
 
-      setupGlobalFetchMock({ ok: true })
+      global.fetch = vi.fn().mockResolvedValue({
+        ok: true,
+      })
 
       const req = new NextRequest('http://localhost:3000/api/workflows/workflow-123', {
         method: 'DELETE',

apps/sim/app/api/workspaces/[id]/environment/route.ts

@@ -1,14 +1,12 @@
 import { db } from '@sim/db'
-import { workspaceEnvironment } from '@sim/db/schema'
+import { environment, workspaceEnvironment } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
 import { eq } from 'drizzle-orm'
 import { type NextRequest, NextResponse } from 'next/server'
 import { z } from 'zod'
 import { getSession } from '@/lib/auth'
-import { encryptSecret } from '@/lib/core/security/encryption'
+import { decryptSecret, encryptSecret } from '@/lib/core/security/encryption'
 import { generateRequestId } from '@/lib/core/utils/request'
-import { syncWorkspaceEnvCredentials } from '@/lib/credentials/environment'
-import { getPersonalAndWorkspaceEnv } from '@/lib/environment/utils'
 import { getUserEntityPermissions, getWorkspaceById } from '@/lib/workspaces/permissions/utils'
 
 const logger = createLogger('WorkspaceEnvironmentAPI')
@@ -46,10 +44,44 @@ export async function GET(request: NextRequest, { params }: { params: Promise<{
       return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
     }
 
-    const { workspaceDecrypted, personalDecrypted, conflicts } = await getPersonalAndWorkspaceEnv(
+    // Workspace env (encrypted)
-      userId,
+    const wsEnvRow = await db
-      workspaceId
+      .select()
-    )
+      .from(workspaceEnvironment)
+      .where(eq(workspaceEnvironment.workspaceId, workspaceId))
+      .limit(1)
+
+    const wsEncrypted: Record<string, string> = (wsEnvRow[0]?.variables as any) || {}
+
+    // Personal env (encrypted)
+    const personalRow = await db
+      .select()
+      .from(environment)
+      .where(eq(environment.userId, userId))
+      .limit(1)
+
+    const personalEncrypted: Record<string, string> = (personalRow[0]?.variables as any) || {}
+
+    // Decrypt both for UI
+    const decryptAll = async (src: Record<string, string>) => {
+      const out: Record<string, string> = {}
+      for (const [k, v] of Object.entries(src)) {
+        try {
+          const { decrypted } = await decryptSecret(v)
+          out[k] = decrypted
+        } catch {
+          out[k] = ''
+        }
+      }
+      return out
+    }
+
+    const [workspaceDecrypted, personalDecrypted] = await Promise.all([
+      decryptAll(wsEncrypted),
+      decryptAll(personalEncrypted),
+    ])
+
+    const conflicts = Object.keys(personalDecrypted).filter((k) => k in workspaceDecrypted)
 
     return NextResponse.json(
       {
@@ -124,12 +156,6 @@ export async function PUT(request: NextRequest, { params }: { params: Promise<{
         set: { variables: merged, updatedAt: new Date() },
       })
 
-    await syncWorkspaceEnvCredentials({
-      workspaceId,
-      envKeys: Object.keys(merged),
-      actingUserId: userId,
-    })
-
     return NextResponse.json({ success: true })
   } catch (error: any) {
     logger.error(`[${requestId}] Workspace env PUT error`, error)
@@ -196,12 +222,6 @@ export async function DELETE(
         set: { variables: current, updatedAt: new Date() },
       })
 
-    await syncWorkspaceEnvCredentials({
-      workspaceId,
-      envKeys: Object.keys(current),
-      actingUserId: userId,
-    })
-
     return NextResponse.json({ success: true })
   } catch (error: any) {
     logger.error(`[${requestId}] Workspace env DELETE error`, error)

apps/sim/app/api/workspaces/[id]/permissions/route.ts

@@ -1,12 +1,11 @@
 import crypto from 'crypto'
 import { db } from '@sim/db'
-import { permissions, workspace, workspaceEnvironment } from '@sim/db/schema'
+import { permissions, workspace } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
 import { and, eq } from 'drizzle-orm'
 import { type NextRequest, NextResponse } from 'next/server'
 import { z } from 'zod'
 import { getSession } from '@/lib/auth'
-import { syncWorkspaceEnvCredentials } from '@/lib/credentials/environment'
 import {
   getUsersWithPermissions,
   hasWorkspaceAdminAccess,
@@ -155,20 +154,6 @@ export async function PATCH(request: NextRequest, { params }: { params: Promise<
       }
     })
 
-    const [wsEnvRow] = await db
-      .select({ variables: workspaceEnvironment.variables })
-      .from(workspaceEnvironment)
-      .where(eq(workspaceEnvironment.workspaceId, workspaceId))
-      .limit(1)
-    const wsEnvKeys = Object.keys((wsEnvRow?.variables as Record<string, string>) || {})
-    if (wsEnvKeys.length > 0) {
-      await syncWorkspaceEnvCredentials({
-        workspaceId,
-        envKeys: wsEnvKeys,
-        actingUserId: session.user.id,
-      })
-    }
-
     const updatedUsers = await getUsersWithPermissions(workspaceId)
 
     return NextResponse.json({

apps/sim/app/api/workspaces/invitations/[invitationId]/route.test.ts

@@ -8,27 +8,15 @@ const mockHasWorkspaceAdminAccess = vi.fn()
 let dbSelectResults: any[] = []
 let dbSelectCallIndex = 0
 
-const mockDbSelect = vi.fn().mockImplementation(() => {
+const mockDbSelect = vi.fn().mockImplementation(() => ({
-  const makeThen = () =>
+  from: vi.fn().mockReturnThis(),
-    vi.fn().mockImplementation((callback: (rows: any[]) => any) => {
+  where: vi.fn().mockReturnThis(),
+  then: vi.fn().mockImplementation((callback: (rows: any[]) => any) => {
     const result = dbSelectResults[dbSelectCallIndex] || []
     dbSelectCallIndex++
     return Promise.resolve(callback ? callback(result) : result)
-    })
+  }),
-  const makeLimit = () =>
+}))
-    vi.fn().mockImplementation(() => {
-      const result = dbSelectResults[dbSelectCallIndex] || []
-      dbSelectCallIndex++
-      return Promise.resolve(result)
-    })
-
-  const chain: any = {}
-  chain.from = vi.fn().mockReturnValue(chain)
-  chain.where = vi.fn().mockReturnValue(chain)
-  chain.limit = makeLimit()
-  chain.then = makeThen()
-  return chain
-})
 
 const mockDbInsert = vi.fn().mockImplementation(() => ({
   values: vi.fn().mockResolvedValue(undefined),
@@ -65,10 +53,6 @@ vi.mock('@/lib/workspaces/permissions/utils', () => ({
     mockHasWorkspaceAdminAccess(userId, workspaceId),
 }))
 
-vi.mock('@/lib/credentials/environment', () => ({
-  syncWorkspaceEnvCredentials: vi.fn().mockResolvedValue(undefined),
-}))
-
 vi.mock('@sim/logger', () => loggerMock)
 
 vi.mock('@/lib/core/utils/urls', () => ({
@@ -111,10 +95,6 @@ vi.mock('@sim/db/schema', () => ({
     userId: 'userId',
     permissionType: 'permissionType',
   },
-  workspaceEnvironment: {
-    workspaceId: 'workspaceId',
-    variables: 'variables',
-  },
 }))
 
 vi.mock('drizzle-orm', () => ({
@@ -227,7 +207,6 @@ describe('Workspace Invitation [invitationId] API Route', () => {
         [mockWorkspace],
         [{ ...mockUser, email: 'invited@example.com' }],
         [],
-        [],
       ]
 
       const request = new NextRequest(
@@ -481,7 +460,6 @@ describe('Workspace Invitation [invitationId] API Route', () => {
         [mockWorkspace],
         [{ ...mockUser, email: 'invited@example.com' }],
         [],
-        [],
       ]
 
       const request2 = new NextRequest(

apps/sim/app/api/workspaces/invitations/[invitationId]/route.ts

@@ -6,7 +6,6 @@ import {
   user,
   type WorkspaceInvitationStatus,
   workspace,
-  workspaceEnvironment,
   workspaceInvitation,
 } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
@@ -15,7 +14,6 @@ import { type NextRequest, NextResponse } from 'next/server'
 import { WorkspaceInvitationEmail } from '@/components/emails'
 import { getSession } from '@/lib/auth'
 import { getBaseUrl } from '@/lib/core/utils/urls'
-import { syncWorkspaceEnvCredentials } from '@/lib/credentials/environment'
 import { sendEmail } from '@/lib/messaging/email/mailer'
 import { getFromEmailAddress } from '@/lib/messaging/email/utils'
 import { hasWorkspaceAdminAccess } from '@/lib/workspaces/permissions/utils'
@@ -164,20 +162,6 @@ export async function GET(
           .where(eq(workspaceInvitation.id, invitation.id))
       })
 
-      const [wsEnvRow] = await db
-        .select({ variables: workspaceEnvironment.variables })
-        .from(workspaceEnvironment)
-        .where(eq(workspaceEnvironment.workspaceId, invitation.workspaceId))
-        .limit(1)
-      const wsEnvKeys = Object.keys((wsEnvRow?.variables as Record<string, string>) || {})
-      if (wsEnvKeys.length > 0) {
-        await syncWorkspaceEnvCredentials({
-          workspaceId: invitation.workspaceId,
-          envKeys: wsEnvKeys,
-          actingUserId: session.user.id,
-        })
-      }
-
       return NextResponse.redirect(new URL(`/workspace/${invitation.workspaceId}/w`, getBaseUrl()))
     }
 

apps/sim/app/api/workspaces/members/[id]/route.ts

@@ -5,7 +5,6 @@ import { and, eq } from 'drizzle-orm'
 import { type NextRequest, NextResponse } from 'next/server'
 import { z } from 'zod'
 import { getSession } from '@/lib/auth'
-import { revokeWorkspaceCredentialMemberships } from '@/lib/credentials/access'
 import { hasWorkspaceAdminAccess } from '@/lib/workspaces/permissions/utils'
 
 const logger = createLogger('WorkspaceMemberAPI')
@@ -102,8 +101,6 @@ export async function DELETE(req: NextRequest, { params }: { params: Promise<{ i
         )
       )
 
-    await revokeWorkspaceCredentialMemberships(workspaceId, userId)
-
     return NextResponse.json({ success: true })
   } catch (error) {
     logger.error('Error removing workspace member:', error)

apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/deploy/hooks/use-deployment.ts

@@ -1,10 +1,7 @@
 import { useCallback, useState } from 'react'
 import { createLogger } from '@sim/logger'
-import { runPreDeployChecks } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/deploy/hooks/use-predeploy-checks'
 import { useNotificationStore } from '@/stores/notifications'
 import { useWorkflowRegistry } from '@/stores/workflows/registry/store'
-import { mergeSubblockState } from '@/stores/workflows/utils'
-import { useWorkflowStore } from '@/stores/workflows/workflow/store'
 
 const logger = createLogger('useDeployment')
 
@@ -38,24 +35,6 @@ export function useDeployment({
       return { success: true, shouldOpenModal: true }
     }
 
-    const { blocks, edges, loops, parallels } = useWorkflowStore.getState()
-    const liveBlocks = mergeSubblockState(blocks, workflowId)
-    const checkResult = runPreDeployChecks({
-      blocks: liveBlocks,
-      edges,
-      loops,
-      parallels,
-      workflowId,
-    })
-    if (!checkResult.passed) {
-      addNotification({
-        level: 'error',
-        message: checkResult.error || 'Pre-deploy validation failed',
-        workflowId,
-      })
-      return { success: false, shouldOpenModal: false }
-    }
-
     setIsDeploying(true)
     try {
       const response = await fetch(`/api/workflows/${workflowId}/deploy`, {

apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/credential-selector/components/oauth-required-modal.tsx

@@ -30,7 +30,6 @@ export interface OAuthRequiredModalProps {
   requiredScopes?: string[]
   serviceId: string
   newScopes?: string[]
-  onConnect?: () => Promise<void> | void
 }
 
 const SCOPE_DESCRIPTIONS: Record<string, string> = {
@@ -315,7 +314,6 @@ export function OAuthRequiredModal({
   requiredScopes = [],
   serviceId,
   newScopes = [],
-  onConnect,
 }: OAuthRequiredModalProps) {
   const [error, setError] = useState<string | null>(null)
   const { baseProvider } = parseProvider(provider)
@@ -361,12 +359,6 @@ export function OAuthRequiredModal({
     setError(null)
 
     try {
-      if (onConnect) {
-        await onConnect()
-        onClose()
-        return
-      }
-
       const providerId = getProviderIdFromServiceId(serviceId)
 
       logger.info('Linking OAuth2:', {

apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/credential-selector/credential-selector.tsx

@@ -1,13 +1,12 @@
 'use client'
 
 import { createElement, useCallback, useEffect, useMemo, useState } from 'react'
+import { createLogger } from '@sim/logger'
 import { ExternalLink, Users } from 'lucide-react'
-import { useParams } from 'next/navigation'
 import { Button, Combobox } from '@/components/emcn/components'
 import { getSubscriptionStatus } from '@/lib/billing/client'
 import { getEnv, isTruthy } from '@/lib/core/config/env'
 import { getPollingProviderFromOAuth } from '@/lib/credential-sets/providers'
-import { writePendingCredentialCreateRequest } from '@/lib/credentials/client-state'
 import {
   getCanonicalScopesForProvider,
   getProviderIdFromServiceId,
@@ -19,14 +18,15 @@ import { OAuthRequiredModal } from '@/app/workspace/[workspaceId]/w/[workflowId]
 import { useDependsOnGate } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/hooks/use-depends-on-gate'
 import { useSubBlockValue } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/hooks/use-sub-block-value'
 import type { SubBlockConfig } from '@/blocks/types'
-import { CREDENTIAL_SET } from '@/executor/constants'
+import { CREDENTIAL, CREDENTIAL_SET } from '@/executor/constants'
 import { useCredentialSets } from '@/hooks/queries/credential-sets'
-import { useOAuthCredentials } from '@/hooks/queries/oauth-credentials'
+import { useOAuthCredentialDetail, useOAuthCredentials } from '@/hooks/queries/oauth-credentials'
 import { useOrganizations } from '@/hooks/queries/organization'
 import { useSubscriptionData } from '@/hooks/queries/subscription'
 import { getMissingRequiredScopes } from '@/hooks/use-oauth-scope-status'
 import { useWorkflowRegistry } from '@/stores/workflows/registry/store'
 
+const logger = createLogger('CredentialSelector')
 const isBillingEnabled = isTruthy(getEnv('NEXT_PUBLIC_BILLING_ENABLED'))
 
 interface CredentialSelectorProps {
@@ -46,8 +46,6 @@ export function CredentialSelector({
   previewValue,
   previewContextValues,
 }: CredentialSelectorProps) {
-  const params = useParams()
-  const workspaceId = (params?.workspaceId as string) || ''
   const [showOAuthModal, setShowOAuthModal] = useState(false)
   const [editingValue, setEditingValue] = useState('')
   const [isEditing, setIsEditing] = useState(false)
@@ -98,64 +96,64 @@ export function CredentialSelector({
     data: credentials = [],
     isFetching: credentialsLoading,
     refetch: refetchCredentials,
-  } = useOAuthCredentials(effectiveProviderId, {
+  } = useOAuthCredentials(effectiveProviderId, Boolean(effectiveProviderId))
-    enabled: Boolean(effectiveProviderId),
-    workspaceId,
-    workflowId: activeWorkflowId || undefined,
-  })
 
   const selectedCredential = useMemo(
     () => credentials.find((cred) => cred.id === selectedId),
     [credentials, selectedId]
   )
 
+  const shouldFetchForeignMeta =
+    Boolean(selectedId) &&
+    !selectedCredential &&
+    Boolean(activeWorkflowId) &&
+    Boolean(effectiveProviderId)
+
+  const { data: foreignCredentials = [], isFetching: foreignMetaLoading } =
+    useOAuthCredentialDetail(
+      shouldFetchForeignMeta ? selectedId : undefined,
+      activeWorkflowId || undefined,
+      shouldFetchForeignMeta
+    )
+
+  const hasForeignMeta = foreignCredentials.length > 0
+  const isForeign = Boolean(selectedId && !selectedCredential && hasForeignMeta)
+
   const selectedCredentialSet = useMemo(
     () => credentialSets.find((cs) => cs.id === selectedCredentialSetId),
     [credentialSets, selectedCredentialSetId]
   )
 
-  const [inaccessibleCredentialName, setInaccessibleCredentialName] = useState<string | null>(null)
+  const isForeignCredentialSet = Boolean(isCredentialSetSelected && !selectedCredentialSet)
-
-  useEffect(() => {
-    if (!selectedId || selectedCredential || credentialsLoading || !workspaceId) {
-      setInaccessibleCredentialName(null)
-      return
-    }
-
-    let cancelled = false
-    ;(async () => {
-      try {
-        const response = await fetch(
-          `/api/credentials?workspaceId=${encodeURIComponent(workspaceId)}&credentialId=${encodeURIComponent(selectedId)}`
-        )
-        if (!response.ok || cancelled) return
-        const data = await response.json()
-        if (!cancelled && data.credential?.displayName) {
-          if (data.credential.id !== selectedId) {
-            setStoreValue(data.credential.id)
-          }
-          setInaccessibleCredentialName(data.credential.displayName)
-        }
-      } catch {
-        // Ignore fetch errors
-      }
-    })()
-
-    return () => {
-      cancelled = true
-    }
-  }, [selectedId, selectedCredential, credentialsLoading, workspaceId])
 
   const resolvedLabel = useMemo(() => {
     if (selectedCredentialSet) return selectedCredentialSet.name
+    if (isForeignCredentialSet) return CREDENTIAL.FOREIGN_LABEL
     if (selectedCredential) return selectedCredential.name
-    if (inaccessibleCredentialName) return inaccessibleCredentialName
+    if (isForeign) return CREDENTIAL.FOREIGN_LABEL
     return ''
-  }, [selectedCredentialSet, selectedCredential, inaccessibleCredentialName])
+  }, [selectedCredentialSet, isForeignCredentialSet, selectedCredential, isForeign])
 
   const displayValue = isEditing ? editingValue : resolvedLabel
 
-  useCredentialRefreshTriggers(refetchCredentials, effectiveProviderId, workspaceId)
+  const invalidSelection =
+    !isPreview &&
+    Boolean(selectedId) &&
+    !selectedCredential &&
+    !hasForeignMeta &&
+    !credentialsLoading &&
+    !foreignMetaLoading
+
+  useEffect(() => {
+    if (!invalidSelection) return
+    logger.info('Clearing invalid credential selection - credential was disconnected', {
+      selectedId,
+      provider: effectiveProviderId,
+    })
+    setStoreValue('')
+  }, [invalidSelection, selectedId, effectiveProviderId, setStoreValue])
+
+  useCredentialRefreshTriggers(refetchCredentials)
 
   const handleOpenChange = useCallback(
     (isOpen: boolean) => {
@@ -197,18 +195,8 @@ export function CredentialSelector({
   )
 
   const handleAddCredential = useCallback(() => {
-    writePendingCredentialCreateRequest({
+    setShowOAuthModal(true)
-      workspaceId,
+  }, [])
-      type: 'oauth',
-      providerId: effectiveProviderId,
-      displayName: '',
-      serviceId,
-      requiredScopes: getCanonicalScopesForProvider(effectiveProviderId),
-      requestedAt: Date.now(),
-    })
-
-    window.dispatchEvent(new CustomEvent('open-settings', { detail: { tab: 'credentials' } }))
-  }, [workspaceId, effectiveProviderId, serviceId])
 
   const getProviderIcon = useCallback((providerName: OAuthProvider) => {
     const { baseProvider } = parseProvider(providerName)
@@ -263,18 +251,23 @@ export function CredentialSelector({
         label: cred.name,
         value: cred.id,
       }))
-      credentialItems.push({
-        label:
-          credentials.length > 0
-            ? `Connect another ${getProviderName(provider)} account`
-            : `Connect ${getProviderName(provider)} account`,
-        value: '__connect_account__',
-      })
 
+      if (credentialItems.length > 0) {
         groups.push({
           section: 'Personal Credential',
           items: credentialItems,
         })
+      } else {
+        groups.push({
+          section: 'Personal Credential',
+          items: [
+            {
+              label: `Connect ${getProviderName(provider)} account`,
+              value: '__connect_account__',
+            },
+          ],
+        })
+      }
 
       return { comboboxOptions: [], comboboxGroups: groups }
     }
@@ -284,13 +277,12 @@ export function CredentialSelector({
       value: cred.id,
     }))
 
+    if (credentials.length === 0) {
       options.push({
-      label:
+        label: `Connect ${getProviderName(provider)} account`,
-        credentials.length > 0
-          ? `Connect another ${getProviderName(provider)} account`
-          : `Connect ${getProviderName(provider)} account`,
         value: '__connect_account__',
       })
+    }
 
     return { comboboxOptions: options, comboboxGroups: undefined }
   }, [
@@ -376,7 +368,7 @@ export function CredentialSelector({
         }
         disabled={effectiveDisabled}
         editable={true}
-        filterOptions={true}
+        filterOptions={!isForeign && !isForeignCredentialSet}
         isLoading={credentialsLoading}
         overlayContent={overlayContent}
         className={selectedId || isCredentialSetSelected ? 'pl-[28px]' : ''}
@@ -388,6 +380,7 @@ export function CredentialSelector({
             <span className='mr-[6px] inline-block h-[6px] w-[6px] rounded-[2px] bg-amber-500' />
             Additional permissions required
           </div>
+          {!isForeign && (
             <Button
               variant='active'
               onClick={() => setShowOAuthModal(true)}
@@ -395,6 +388,7 @@ export function CredentialSelector({
             >
               Update access
             </Button>
+          )}
         </div>
       )}
 
@@ -413,11 +407,7 @@ export function CredentialSelector({
   )
 }
 
-function useCredentialRefreshTriggers(
+function useCredentialRefreshTriggers(refetchCredentials: () => Promise<unknown>) {
-  refetchCredentials: () => Promise<unknown>,
-  providerId: string,
-  workspaceId: string
-) {
   useEffect(() => {
     const refresh = () => {
       void refetchCredentials()
@@ -435,29 +425,12 @@ function useCredentialRefreshTriggers(
       }
     }
 
-    const handleCredentialsUpdated = (
-      event: CustomEvent<{ providerId?: string; workspaceId?: string }>
-    ) => {
-      if (event.detail?.providerId && event.detail.providerId !== providerId) {
-        return
-      }
-      if (event.detail?.workspaceId && workspaceId && event.detail.workspaceId !== workspaceId) {
-        return
-      }
-      refresh()
-    }
-
     document.addEventListener('visibilitychange', handleVisibilityChange)
     window.addEventListener('pageshow', handlePageShow)
-    window.addEventListener('oauth-credentials-updated', handleCredentialsUpdated as EventListener)
 
     return () => {
       document.removeEventListener('visibilitychange', handleVisibilityChange)
       window.removeEventListener('pageshow', handlePageShow)
-      window.removeEventListener(
-        'oauth-credentials-updated',
-        handleCredentialsUpdated as EventListener
-      )
     }
-  }, [providerId, workspaceId, refetchCredentials])
+  }, [refetchCredentials])
 }

apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/env-var-dropdown.tsx

@@ -9,7 +9,6 @@ import {
   PopoverSection,
 } from '@/components/emcn'
 import { cn } from '@/lib/core/utils/cn'
-import { writePendingCredentialCreateRequest } from '@/lib/credentials/client-state'
 import {
   usePersonalEnvironment,
   useWorkspaceEnvironment,
@@ -169,15 +168,7 @@ export const EnvVarDropdown: React.FC<EnvVarDropdownProps> = ({
   }, [searchTerm])
 
   const openEnvironmentSettings = () => {
-    if (workspaceId) {
+    window.dispatchEvent(new CustomEvent('open-settings', { detail: { tab: 'environment' } }))
-      writePendingCredentialCreateRequest({
-        workspaceId,
-        type: 'env_personal',
-        envKey: searchTerm.trim(),
-        requestedAt: Date.now(),
-      })
-    }
-    window.dispatchEvent(new CustomEvent('open-settings', { detail: { tab: 'credentials' } }))
     onClose?.()
   }
 
@@ -311,7 +302,7 @@ export const EnvVarDropdown: React.FC<EnvVarDropdownProps> = ({
               }}
             >
               <Plus className='h-3 w-3' />
-              <span>Create Secret</span>
+              <span>Create environment variable</span>
             </PopoverItem>
           </PopoverScrollArea>
         ) : (

apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/file-selector/file-selector-input.tsx

@@ -7,6 +7,7 @@ import { getProviderIdFromServiceId } from '@/lib/oauth'
 import { buildCanonicalIndex, resolveDependencyValue } from '@/lib/workflows/subblocks/visibility'
 import { SelectorCombobox } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/selector-combobox/selector-combobox'
 import { useDependsOnGate } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/hooks/use-depends-on-gate'
+import { useForeignCredential } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/hooks/use-foreign-credential'
 import { useSubBlockValue } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/hooks/use-sub-block-value'
 import { resolvePreviewContextValue } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/utils'
 import { getBlock } from '@/blocks/registry'
@@ -124,6 +125,8 @@ export function FileSelectorInput({
   const serviceId = subBlock.serviceId || ''
   const effectiveProviderId = useMemo(() => getProviderIdFromServiceId(serviceId), [serviceId])
 
+  const { isForeignCredential } = useForeignCredential(effectiveProviderId, normalizedCredentialId)
+
   const selectorResolution = useMemo<SelectorResolution | null>(() => {
     return resolveSelectorForSubBlock(subBlock, {
       workflowId: workflowIdFromUrl,
@@ -165,6 +168,7 @@ export function FileSelectorInput({
 
   const disabledReason =
     finalDisabled ||
+    isForeignCredential ||
     missingCredential ||
     missingDomain ||
     missingProject ||

apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/folder-selector/components/folder-selector-input.tsx

@@ -4,6 +4,7 @@ import { useCallback, useEffect, useMemo, useState } from 'react'
 import { getProviderIdFromServiceId } from '@/lib/oauth'
 import { SelectorCombobox } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/selector-combobox/selector-combobox'
 import { useDependsOnGate } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/hooks/use-depends-on-gate'
+import { useForeignCredential } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/hooks/use-foreign-credential'
 import { useSubBlockValue } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/hooks/use-sub-block-value'
 import { resolvePreviewContextValue } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/utils'
 import type { SubBlockConfig } from '@/blocks/types'
@@ -46,6 +47,10 @@ export function FolderSelectorInput({
     subBlock.canonicalParamId === 'copyDestinationId' ||
     subBlock.id === 'copyDestinationFolder' ||
     subBlock.id === 'manualCopyDestinationFolder'
+  const { isForeignCredential } = useForeignCredential(
+    effectiveProviderId,
+    (connectedCredential as string) || ''
+  )
 
   // Central dependsOn gating
   const { finalDisabled } = useDependsOnGate(blockId, subBlock, {
@@ -114,7 +119,9 @@ export function FolderSelectorInput({
       selectorContext={
         selectorResolution?.context ?? { credentialId, workflowId: activeWorkflowId || '' }
       }
-      disabled={finalDisabled || missingCredential || !selectorResolution?.key}
+      disabled={
+        finalDisabled || isForeignCredential || missingCredential || !selectorResolution?.key
+      }
       isPreview={isPreview}
       previewValue={previewValue ?? null}
       placeholder={subBlock.placeholder || 'Select folder'}

apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/project-selector/project-selector-input.tsx

@@ -7,6 +7,7 @@ import { getProviderIdFromServiceId } from '@/lib/oauth'
 import { buildCanonicalIndex, resolveDependencyValue } from '@/lib/workflows/subblocks/visibility'
 import { SelectorCombobox } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/selector-combobox/selector-combobox'
 import { useDependsOnGate } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/hooks/use-depends-on-gate'
+import { useForeignCredential } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/hooks/use-foreign-credential'
 import { useSubBlockValue } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/hooks/use-sub-block-value'
 import { resolvePreviewContextValue } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/utils'
 import { getBlock } from '@/blocks/registry'
@@ -72,6 +73,11 @@ export function ProjectSelectorInput({
 
   const serviceId = subBlock.serviceId || ''
   const effectiveProviderId = useMemo(() => getProviderIdFromServiceId(serviceId), [serviceId])
+
+  const { isForeignCredential } = useForeignCredential(
+    effectiveProviderId,
+    (connectedCredential as string) || ''
+  )
   const workflowIdFromUrl = (params?.workflowId as string) || activeWorkflowId || ''
   const { finalDisabled } = useDependsOnGate(blockId, subBlock, {
     disabled,
@@ -117,7 +123,7 @@ export function ProjectSelectorInput({
               subBlock={subBlock}
               selectorKey={selectorResolution.key}
               selectorContext={selectorResolution.context}
-              disabled={finalDisabled || missingCredential}
+              disabled={finalDisabled || isForeignCredential || missingCredential}
               isPreview={isPreview}
               previewValue={previewValue ?? null}
               placeholder={subBlock.placeholder || 'Select project'}

apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/sheet-selector/sheet-selector-input.tsx

@@ -7,6 +7,7 @@ import { getProviderIdFromServiceId } from '@/lib/oauth'
 import { buildCanonicalIndex, resolveDependencyValue } from '@/lib/workflows/subblocks/visibility'
 import { SelectorCombobox } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/selector-combobox/selector-combobox'
 import { useDependsOnGate } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/hooks/use-depends-on-gate'
+import { useForeignCredential } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/hooks/use-foreign-credential'
 import { resolvePreviewContextValue } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/utils'
 import { getBlock } from '@/blocks/registry'
 import type { SubBlockConfig } from '@/blocks/types'
@@ -86,6 +87,8 @@ export function SheetSelectorInput({
   const serviceId = subBlock.serviceId || ''
   const effectiveProviderId = useMemo(() => getProviderIdFromServiceId(serviceId), [serviceId])
 
+  const { isForeignCredential } = useForeignCredential(effectiveProviderId, normalizedCredentialId)
+
   const selectorResolution = useMemo<SelectorResolution | null>(() => {
     return resolveSelectorForSubBlock(subBlock, {
       workflowId: workflowIdFromUrl,
@@ -98,7 +101,11 @@ export function SheetSelectorInput({
   const missingSpreadsheet = !normalizedSpreadsheetId
 
   const disabledReason =
-    finalDisabled || missingCredential || missingSpreadsheet || !selectorResolution?.key
+    finalDisabled ||
+    isForeignCredential ||
+    missingCredential ||
+    missingSpreadsheet ||
+    !selectorResolution?.key
 
   if (!selectorResolution?.key) {
     return (

apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/slack-selector/slack-selector-input.tsx

@@ -6,6 +6,7 @@ import { Tooltip } from '@/components/emcn'
 import { getProviderIdFromServiceId } from '@/lib/oauth'
 import { SelectorCombobox } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/selector-combobox/selector-combobox'
 import { useDependsOnGate } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/hooks/use-depends-on-gate'
+import { useForeignCredential } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/hooks/use-foreign-credential'
 import { useSubBlockValue } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/hooks/use-sub-block-value'
 import { resolvePreviewContextValue } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/utils'
 import type { SubBlockConfig } from '@/blocks/types'
@@ -84,6 +85,11 @@ export function SlackSelectorInput({
       ? (effectiveBotToken as string) || ''
       : (effectiveCredential as string) || ''
 
+  const { isForeignCredential } = useForeignCredential(
+    effectiveProviderId,
+    (effectiveAuthMethod as string) === 'bot_token' ? '' : (effectiveCredential as string) || ''
+  )
+
   useEffect(() => {
     const val = isPreview && previewValue !== undefined ? previewValue : storeValue
     if (typeof val === 'string') {
@@ -93,7 +99,7 @@ export function SlackSelectorInput({
 
   const requiresCredential = dependsOn.includes('credential')
   const missingCredential = !credential || credential.trim().length === 0
-  const shouldForceDisable = requiresCredential && missingCredential
+  const shouldForceDisable = requiresCredential && (missingCredential || isForeignCredential)
 
   const context: SelectorContext = useMemo(
     () => ({
@@ -130,7 +136,7 @@ export function SlackSelectorInput({
             subBlock={subBlock}
             selectorKey={config.selectorKey}
             selectorContext={context}
-            disabled={finalDisabled || shouldForceDisable}
+            disabled={finalDisabled || shouldForceDisable || isForeignCredential}
             isPreview={isPreview}
             previewValue={previewValue ?? null}
             placeholder={subBlock.placeholder || config.placeholder}

apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/tool-input/components/tool-credential-selector.tsx

@@ -1,19 +1,17 @@
 import { createElement, useCallback, useEffect, useMemo, useState } from 'react'
 import { ExternalLink } from 'lucide-react'
-import { useParams } from 'next/navigation'
 import { Button, Combobox } from '@/components/emcn/components'
-import { writePendingCredentialCreateRequest } from '@/lib/credentials/client-state'
 import {
   getCanonicalScopesForProvider,
   getProviderIdFromServiceId,
-  getServiceConfigByProviderId,
   OAUTH_PROVIDERS,
   type OAuthProvider,
   type OAuthService,
   parseProvider,
 } from '@/lib/oauth'
 import { OAuthRequiredModal } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/credential-selector/components/oauth-required-modal'
-import { useOAuthCredentials } from '@/hooks/queries/oauth-credentials'
+import { CREDENTIAL } from '@/executor/constants'
+import { useOAuthCredentialDetail, useOAuthCredentials } from '@/hooks/queries/oauth-credentials'
 import { getMissingRequiredScopes } from '@/hooks/use-oauth-scope-status'
 import { useWorkflowRegistry } from '@/stores/workflows/registry/store'
 
@@ -28,11 +26,6 @@ const getProviderIcon = (providerName: OAuthProvider) => {
 }
 
 const getProviderName = (providerName: OAuthProvider) => {
-  const serviceConfig = getServiceConfigByProviderId(providerName)
-  if (serviceConfig) {
-    return serviceConfig.name
-  }
-
   const { baseProvider } = parseProvider(providerName)
   const baseProviderConfig = OAUTH_PROVIDERS[baseProvider]
 
@@ -61,19 +54,16 @@ export function ToolCredentialSelector({
   onChange,
   provider,
   requiredScopes = [],
-  label,
+  label = 'Select account',
   serviceId,
   disabled = false,
 }: ToolCredentialSelectorProps) {
-  const params = useParams()
-  const workspaceId = (params?.workspaceId as string) || ''
   const [showOAuthModal, setShowOAuthModal] = useState(false)
   const [editingInputValue, setEditingInputValue] = useState('')
   const [isEditing, setIsEditing] = useState(false)
   const { activeWorkflowId } = useWorkflowRegistry()
 
   const selectedId = value || ''
-  const effectiveLabel = label || `Select ${getProviderName(provider)} account`
 
   const effectiveProviderId = useMemo(() => getProviderIdFromServiceId(serviceId), [serviceId])
 
@@ -81,58 +71,50 @@ export function ToolCredentialSelector({
     data: credentials = [],
     isFetching: credentialsLoading,
     refetch: refetchCredentials,
-  } = useOAuthCredentials(effectiveProviderId, {
+  } = useOAuthCredentials(effectiveProviderId, Boolean(effectiveProviderId))
-    enabled: Boolean(effectiveProviderId),
-    workspaceId,
-    workflowId: activeWorkflowId || undefined,
-  })
 
   const selectedCredential = useMemo(
     () => credentials.find((cred) => cred.id === selectedId),
     [credentials, selectedId]
   )
 
-  const [inaccessibleCredentialName, setInaccessibleCredentialName] = useState<string | null>(null)
+  const shouldFetchForeignMeta =
+    Boolean(selectedId) &&
+    !selectedCredential &&
+    Boolean(activeWorkflowId) &&
+    Boolean(effectiveProviderId)
 
-  useEffect(() => {
+  const { data: foreignCredentials = [], isFetching: foreignMetaLoading } =
-    if (!selectedId || selectedCredential || credentialsLoading || !workspaceId) {
+    useOAuthCredentialDetail(
-      setInaccessibleCredentialName(null)
+      shouldFetchForeignMeta ? selectedId : undefined,
-      return
+      activeWorkflowId || undefined,
-    }
+      shouldFetchForeignMeta
-
-    let cancelled = false
-    ;(async () => {
-      try {
-        const response = await fetch(
-          `/api/credentials?workspaceId=${encodeURIComponent(workspaceId)}&credentialId=${encodeURIComponent(selectedId)}`
     )
-        if (!response.ok || cancelled) return
-        const data = await response.json()
-        if (!cancelled && data.credential?.displayName) {
-          if (data.credential.id !== selectedId) {
-            onChange(data.credential.id)
-          }
-          setInaccessibleCredentialName(data.credential.displayName)
-        }
-      } catch {
-        // Ignore fetch errors
-      }
-    })()
 
-    return () => {
+  const hasForeignMeta = foreignCredentials.length > 0
-      cancelled = true
+  const isForeign = Boolean(selectedId && !selectedCredential && hasForeignMeta)
-    }
-  }, [selectedId, selectedCredential, credentialsLoading, workspaceId])
 
   const resolvedLabel = useMemo(() => {
     if (selectedCredential) return selectedCredential.name
-    if (inaccessibleCredentialName) return inaccessibleCredentialName
+    if (isForeign) return CREDENTIAL.FOREIGN_LABEL
     return ''
-  }, [selectedCredential, inaccessibleCredentialName])
+  }, [selectedCredential, isForeign])
 
   const inputValue = isEditing ? editingInputValue : resolvedLabel
 
-  useCredentialRefreshTriggers(refetchCredentials, effectiveProviderId, workspaceId)
+  const invalidSelection =
+    Boolean(selectedId) &&
+    !selectedCredential &&
+    !hasForeignMeta &&
+    !credentialsLoading &&
+    !foreignMetaLoading
+
+  useEffect(() => {
+    if (!invalidSelection) return
+    onChange('')
+  }, [invalidSelection, onChange])
+
+  useCredentialRefreshTriggers(refetchCredentials)
 
   const handleOpenChange = useCallback(
     (isOpen: boolean) => {
@@ -160,18 +142,8 @@ export function ToolCredentialSelector({
   )
 
   const handleAddCredential = useCallback(() => {
-    writePendingCredentialCreateRequest({
+    setShowOAuthModal(true)
-      workspaceId,
+  }, [])
-      type: 'oauth',
-      providerId: effectiveProviderId,
-      displayName: '',
-      serviceId,
-      requiredScopes: getCanonicalScopesForProvider(effectiveProviderId),
-      requestedAt: Date.now(),
-    })
-
-    window.dispatchEvent(new CustomEvent('open-settings', { detail: { tab: 'credentials' } }))
-  }, [workspaceId, effectiveProviderId, serviceId])
 
   const comboboxOptions = useMemo(() => {
     const options = credentials.map((cred) => ({
@@ -179,13 +151,12 @@ export function ToolCredentialSelector({
       value: cred.id,
     }))
 
+    if (credentials.length === 0) {
       options.push({
-      label:
+        label: `Connect ${getProviderName(provider)} account`,
-        credentials.length > 0
-          ? `Connect another ${getProviderName(provider)} account`
-          : `Connect ${getProviderName(provider)} account`,
         value: '__connect_account__',
       })
+    }
 
     return options
   }, [credentials, provider])
@@ -232,10 +203,10 @@ export function ToolCredentialSelector({
         selectedValue={selectedId}
         onChange={handleComboboxChange}
         onOpenChange={handleOpenChange}
-        placeholder={effectiveLabel}
+        placeholder={label}
         disabled={disabled}
         editable={true}
-        filterOptions={true}
+        filterOptions={!isForeign}
         isLoading={credentialsLoading}
         overlayContent={overlayContent}
         className={selectedId ? 'pl-[28px]' : ''}
@@ -247,6 +218,7 @@ export function ToolCredentialSelector({
             <span className='mr-[6px] inline-block h-[6px] w-[6px] rounded-[2px] bg-amber-500' />
             Additional permissions required
           </div>
+          {!isForeign && (
             <Button
               variant='active'
               onClick={() => setShowOAuthModal(true)}
@@ -254,6 +226,7 @@ export function ToolCredentialSelector({
             >
               Update access
             </Button>
+          )}
         </div>
       )}
 
@@ -272,11 +245,7 @@ export function ToolCredentialSelector({
   )
 }
 
-function useCredentialRefreshTriggers(
+function useCredentialRefreshTriggers(refetchCredentials: () => Promise<unknown>) {
-  refetchCredentials: () => Promise<unknown>,
-  providerId: string,
-  workspaceId: string
-) {
   useEffect(() => {
     const refresh = () => {
       void refetchCredentials()
@@ -294,29 +263,12 @@ function useCredentialRefreshTriggers(
       }
     }
 
-    const handleCredentialsUpdated = (
-      event: CustomEvent<{ providerId?: string; workspaceId?: string }>
-    ) => {
-      if (event.detail?.providerId && event.detail.providerId !== providerId) {
-        return
-      }
-      if (event.detail?.workspaceId && workspaceId && event.detail.workspaceId !== workspaceId) {
-        return
-      }
-      refresh()
-    }
-
     document.addEventListener('visibilitychange', handleVisibilityChange)
     window.addEventListener('pageshow', handlePageShow)
-    window.addEventListener('oauth-credentials-updated', handleCredentialsUpdated as EventListener)
 
     return () => {
       document.removeEventListener('visibilitychange', handleVisibilityChange)
       window.removeEventListener('pageshow', handlePageShow)
-      window.removeEventListener(
-        'oauth-credentials-updated',
-        handleCredentialsUpdated as EventListener
-      )
     }
-  }, [providerId, workspaceId, refetchCredentials])
+  }, [refetchCredentials])
 }

apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/tool-input/components/tools/parameter.tsx

@@ -1,186 +0,0 @@
-'use client'
-
-import type React from 'react'
-import { useRef, useState } from 'react'
-import { ArrowLeftRight, ArrowUp } from 'lucide-react'
-import { Button, Input, Label, Tooltip } from '@/components/emcn'
-import { cn } from '@/lib/core/utils/cn'
-import type { WandControlHandlers } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/sub-block'
-
-/**
- * Props for a generic parameter with label component
- */
-export interface ParameterWithLabelProps {
-  paramId: string
-  title: string
-  isRequired: boolean
-  visibility: string
-  wandConfig?: {
-    enabled: boolean
-    prompt?: string
-    placeholder?: string
-  }
-  canonicalToggle?: {
-    mode: 'basic' | 'advanced'
-    disabled?: boolean
-    onToggle?: () => void
-  }
-  disabled: boolean
-  isPreview: boolean
-  children: (wandControlRef: React.MutableRefObject<WandControlHandlers | null>) => React.ReactNode
-}
-
-/**
- * Generic wrapper component for parameters that manages wand state and renders label + input
- */
-export function ParameterWithLabel({
-  paramId,
-  title,
-  isRequired,
-  visibility,
-  wandConfig,
-  canonicalToggle,
-  disabled,
-  isPreview,
-  children,
-}: ParameterWithLabelProps) {
-  const [isSearchActive, setIsSearchActive] = useState(false)
-  const [searchQuery, setSearchQuery] = useState('')
-  const searchInputRef = useRef<HTMLInputElement>(null)
-  const wandControlRef = useRef<WandControlHandlers | null>(null)
-
-  const isWandEnabled = wandConfig?.enabled ?? false
-  const showWand = isWandEnabled && !isPreview && !disabled
-
-  const handleSearchClick = (): void => {
-    setIsSearchActive(true)
-    setTimeout(() => {
-      searchInputRef.current?.focus()
-    }, 0)
-  }
-
-  const handleSearchBlur = (): void => {
-    if (!searchQuery.trim() && !wandControlRef.current?.isWandStreaming) {
-      setIsSearchActive(false)
-    }
-  }
-
-  const handleSearchChange = (value: string): void => {
-    setSearchQuery(value)
-  }
-
-  const handleSearchSubmit = (): void => {
-    if (searchQuery.trim() && wandControlRef.current) {
-      wandControlRef.current.onWandTrigger(searchQuery)
-      setSearchQuery('')
-      setIsSearchActive(false)
-    }
-  }
-
-  const handleSearchCancel = (): void => {
-    setSearchQuery('')
-    setIsSearchActive(false)
-  }
-
-  const isStreaming = wandControlRef.current?.isWandStreaming ?? false
-
-  return (
-    <div key={paramId} className='relative min-w-0 space-y-[6px]'>
-      <div className='flex items-center justify-between gap-[6px] pl-[2px]'>
-        <Label className='flex items-baseline gap-[6px] whitespace-nowrap font-medium text-[13px] text-[var(--text-primary)]'>
-          {title}
-          {isRequired && visibility === 'user-only' && <span className='ml-0.5'>*</span>}
-        </Label>
-        <div className='flex min-w-0 flex-1 items-center justify-end gap-[6px]'>
-          {showWand &&
-            (!isSearchActive ? (
-              <Button
-                variant='active'
-                className='-my-1 h-5 px-2 py-0 text-[11px]'
-                onClick={handleSearchClick}
-              >
-                Generate
-              </Button>
-            ) : (
-              <div className='-my-1 flex min-w-[120px] max-w-[280px] flex-1 items-center gap-[4px]'>
-                <Input
-                  ref={searchInputRef}
-                  value={isStreaming ? 'Generating...' : searchQuery}
-                  onChange={(e: React.ChangeEvent<HTMLInputElement>) =>
-                    handleSearchChange(e.target.value)
-                  }
-                  onBlur={(e: React.FocusEvent<HTMLInputElement>) => {
-                    const relatedTarget = e.relatedTarget as HTMLElement | null
-                    if (relatedTarget?.closest('button')) return
-                    handleSearchBlur()
-                  }}
-                  onKeyDown={(e: React.KeyboardEvent<HTMLInputElement>) => {
-                    if (e.key === 'Enter' && searchQuery.trim() && !isStreaming) {
-                      handleSearchSubmit()
-                    } else if (e.key === 'Escape') {
-                      handleSearchCancel()
-                    }
-                  }}
-                  disabled={isStreaming}
-                  className={cn(
-                    'h-5 min-w-[80px] flex-1 text-[11px]',
-                    isStreaming && 'text-muted-foreground'
-                  )}
-                  placeholder='Generate with AI...'
-                />
-                <Button
-                  variant='tertiary'
-                  disabled={!searchQuery.trim() || isStreaming}
-                  onMouseDown={(e: React.MouseEvent) => {
-                    e.preventDefault()
-                    e.stopPropagation()
-                  }}
-                  onClick={(e: React.MouseEvent) => {
-                    e.stopPropagation()
-                    handleSearchSubmit()
-                  }}
-                  className='h-[20px] w-[20px] flex-shrink-0 p-0'
-                >
-                  <ArrowUp className='h-[12px] w-[12px]' />
-                </Button>
-              </div>
-            ))}
-          {canonicalToggle && !isPreview && (
-            <Tooltip.Root>
-              <Tooltip.Trigger asChild>
-                <button
-                  type='button'
-                  className='flex h-[12px] w-[12px] flex-shrink-0 items-center justify-center bg-transparent p-0 disabled:cursor-not-allowed disabled:opacity-50'
-                  onClick={canonicalToggle.onToggle}
-                  disabled={canonicalToggle.disabled || disabled}
-                  aria-label={
-                    canonicalToggle.mode === 'advanced'
-                      ? 'Switch to selector'
-                      : 'Switch to manual ID'
-                  }
-                >
-                  <ArrowLeftRight
-                    className={cn(
-                      '!h-[12px] !w-[12px]',
-                      canonicalToggle.mode === 'advanced'
-                        ? 'text-[var(--text-primary)]'
-                        : 'text-[var(--text-secondary)]'
-                    )}
-                  />
-                </button>
-              </Tooltip.Trigger>
-              <Tooltip.Content side='top'>
-                <p>
-                  {canonicalToggle.mode === 'advanced'
-                    ? 'Switch to selector'
-                    : 'Switch to manual ID'}
-                </p>
-              </Tooltip.Content>
-            </Tooltip.Root>
-          )}
-        </div>
-      </div>
-      <div className='relative w-full min-w-0'>{children(wandControlRef)}</div>
-    </div>
-  )
-}

apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/tool-input/components/tools/sub-block-renderer.tsx

@@ -1,114 +0,0 @@
-'use client'
-
-import { useEffect, useRef } from 'react'
-import { useSubBlockValue } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/hooks/use-sub-block-value'
-import { SubBlock } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/sub-block'
-import type { SubBlockConfig as BlockSubBlockConfig } from '@/blocks/types'
-
-interface ToolSubBlockRendererProps {
-  blockId: string
-  subBlockId: string
-  toolIndex: number
-  subBlock: BlockSubBlockConfig
-  effectiveParamId: string
-  toolParams: Record<string, string> | undefined
-  onParamChange: (toolIndex: number, paramId: string, value: string) => void
-  disabled: boolean
-  canonicalToggle?: {
-    mode: 'basic' | 'advanced'
-    disabled?: boolean
-    onToggle?: () => void
-  }
-}
-
-/**
- * SubBlock types whose store values are objects/arrays/non-strings.
- * tool.params stores strings (via JSON.stringify), so when syncing
- * back to the store we parse them to restore the native shape.
- */
-const OBJECT_SUBBLOCK_TYPES = new Set(['file-upload', 'table', 'grouped-checkbox-list'])
-
-/**
- * Bridges the subblock store with StoredTool.params via a synthetic store key,
- * then delegates all rendering to SubBlock for full parity.
- */
-export function ToolSubBlockRenderer({
-  blockId,
-  subBlockId,
-  toolIndex,
-  subBlock,
-  effectiveParamId,
-  toolParams,
-  onParamChange,
-  disabled,
-  canonicalToggle,
-}: ToolSubBlockRendererProps) {
-  const syntheticId = `${subBlockId}-tool-${toolIndex}-${effectiveParamId}`
-  const [storeValue, setStoreValue] = useSubBlockValue(blockId, syntheticId)
-
-  const toolParamValue = toolParams?.[effectiveParamId] ?? ''
-  const isObjectType = OBJECT_SUBBLOCK_TYPES.has(subBlock.type)
-
-  const lastPushedToStoreRef = useRef<string | null>(null)
-  const lastPushedToParamsRef = useRef<string | null>(null)
-
-  useEffect(() => {
-    if (!toolParamValue && lastPushedToStoreRef.current === null) {
-      lastPushedToStoreRef.current = toolParamValue
-      lastPushedToParamsRef.current = toolParamValue
-      return
-    }
-    if (toolParamValue !== lastPushedToStoreRef.current) {
-      lastPushedToStoreRef.current = toolParamValue
-      lastPushedToParamsRef.current = toolParamValue
-
-      if (isObjectType && typeof toolParamValue === 'string' && toolParamValue) {
-        try {
-          const parsed = JSON.parse(toolParamValue)
-          if (typeof parsed === 'object' && parsed !== null) {
-            setStoreValue(parsed)
-            return
-          }
-        } catch {
-          // Not valid JSON — fall through to set as string
-        }
-      }
-      setStoreValue(toolParamValue)
-    }
-  }, [toolParamValue, setStoreValue, isObjectType])
-
-  useEffect(() => {
-    if (storeValue == null && lastPushedToParamsRef.current === null) return
-    const stringValue =
-      storeValue == null
-        ? ''
-        : typeof storeValue === 'string'
-          ? storeValue
-          : JSON.stringify(storeValue)
-    if (stringValue !== lastPushedToParamsRef.current) {
-      lastPushedToParamsRef.current = stringValue
-      lastPushedToStoreRef.current = stringValue
-      onParamChange(toolIndex, effectiveParamId, stringValue)
-    }
-  }, [storeValue, toolIndex, effectiveParamId, onParamChange])
-
-  const visibility = subBlock.paramVisibility ?? 'user-or-llm'
-  const isOptionalForUser = visibility !== 'user-only'
-
-  const config = {
-    ...subBlock,
-    id: syntheticId,
-    ...(isOptionalForUser && { required: false }),
-  }
-
-  return (
-    <SubBlock
-      blockId={blockId}
-      config={config}
-      isPreview={false}
-      disabled={disabled}
-      canonicalToggle={canonicalToggle}
-      dependencyContext={toolParams}
-    />
-  )
-}

apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/tool-input/tool-input.test.ts

@@ -2,12 +2,37 @@
  * @vitest-environment node
  */
 import { describe, expect, it } from 'vitest'
-import type { StoredTool } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/tool-input/types'
+
-import {
+interface StoredTool {
-  isCustomToolAlreadySelected,
+  type: string
-  isMcpToolAlreadySelected,
+  title?: string
-  isWorkflowAlreadySelected,
+  toolId?: string
-} from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/tool-input/utils'
+  params?: Record<string, string>
+  customToolId?: string
+  schema?: any
+  code?: string
+  operation?: string
+  usageControl?: 'auto' | 'force' | 'none'
+}
+
+const isMcpToolAlreadySelected = (selectedTools: StoredTool[], mcpToolId: string): boolean => {
+  return selectedTools.some((tool) => tool.type === 'mcp' && tool.toolId === mcpToolId)
+}
+
+const isCustomToolAlreadySelected = (
+  selectedTools: StoredTool[],
+  customToolId: string
+): boolean => {
+  return selectedTools.some(
+    (tool) => tool.type === 'custom-tool' && tool.customToolId === customToolId
+  )
+}
+
+const isWorkflowAlreadySelected = (selectedTools: StoredTool[], workflowId: string): boolean => {
+  return selectedTools.some(
+    (tool) => tool.type === 'workflow_input' && tool.params?.workflowId === workflowId
+  )
+}
 
 describe('isMcpToolAlreadySelected', () => {
   describe('basic functionality', () => {

apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/tool-input/types.ts

@@ -1,31 +0,0 @@
-/**
- * Represents a tool selected and configured in the workflow
- *
- * @remarks
- * For custom tools (new format), we only store: type, customToolId, usageControl, isExpanded.
- * Everything else (title, schema, code) is loaded dynamically from the database.
- * Legacy custom tools with inline schema/code are still supported for backwards compatibility.
- */
-export interface StoredTool {
-  /** Block type identifier */
-  type: string
-  /** Display title for the tool (optional for new custom tool format) */
-  title?: string
-  /** Direct tool ID for execution (optional for new custom tool format) */
-  toolId?: string
-  /** Parameter values configured by the user (optional for new custom tool format) */
-  params?: Record<string, string>
-  /** Whether the tool details are expanded in UI */
-  isExpanded?: boolean
-  /** Database ID for custom tools (new format - reference only) */
-  customToolId?: string
-  /** Tool schema for custom tools (legacy format - inline JSON schema) */
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
-  schema?: Record<string, any>
-  /** Implementation code for custom tools (legacy format - inline) */
-  code?: string
-  /** Selected operation for multi-operation tools */
-  operation?: string
-  /** Tool usage control mode for LLM */
-  usageControl?: 'auto' | 'force' | 'none'
-}

apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/tool-input/utils.ts

@@ -1,32 +0,0 @@
-import type { StoredTool } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/tool-input/types'
-
-/**
- * Checks if an MCP tool is already selected.
- */
-export function isMcpToolAlreadySelected(selectedTools: StoredTool[], mcpToolId: string): boolean {
-  return selectedTools.some((tool) => tool.type === 'mcp' && tool.toolId === mcpToolId)
-}
-
-/**
- * Checks if a custom tool is already selected.
- */
-export function isCustomToolAlreadySelected(
-  selectedTools: StoredTool[],
-  customToolId: string
-): boolean {
-  return selectedTools.some(
-    (tool) => tool.type === 'custom-tool' && tool.customToolId === customToolId
-  )
-}
-
-/**
- * Checks if a workflow is already selected.
- */
-export function isWorkflowAlreadySelected(
-  selectedTools: StoredTool[],
-  workflowId: string
-): boolean {
-  return selectedTools.some(
-    (tool) => tool.type === 'workflow_input' && tool.params?.workflowId === workflowId
-  )
-}

apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/hooks/use-foreign-credential.ts

@@ -0,0 +1,50 @@
+import { useEffect, useMemo, useState } from 'react'
+
+export function useForeignCredential(
+  provider: string | undefined,
+  credentialId: string | undefined
+) {
+  const [isForeign, setIsForeign] = useState<boolean>(false)
+  const [loading, setLoading] = useState<boolean>(false)
+  const [error, setError] = useState<string | null>(null)
+
+  const normalizedProvider = useMemo(() => (provider || '').toString(), [provider])
+  const normalizedCredentialId = useMemo(() => credentialId || '', [credentialId])
+
+  useEffect(() => {
+    let cancelled = false
+    async function check() {
+      setLoading(true)
+      setError(null)
+      try {
+        if (!normalizedProvider || !normalizedCredentialId) {
+          if (!cancelled) setIsForeign(false)
+          return
+        }
+        const res = await fetch(
+          `/api/auth/oauth/credentials?provider=${encodeURIComponent(normalizedProvider)}`
+        )
+        if (!res.ok) {
+          if (!cancelled) setIsForeign(true)
+          return
+        }
+        const data = await res.json()
+        const isOwn = (data.credentials || []).some((c: any) => c.id === normalizedCredentialId)
+        if (!cancelled) setIsForeign(!isOwn)
+      } catch (e) {
+        if (!cancelled) {
+          setIsForeign(true)
+          setError((e as Error).message)
+        }
+      } finally {
+        if (!cancelled) setLoading(false)
+      }
+    }
+    void check()
+    return () => {
+      cancelled = true
+    }
+  }, [normalizedProvider, normalizedCredentialId])
+
+  return { isForeignCredential: isForeign, loading, error }
+}

apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/sub-block.tsx

@@ -3,6 +3,7 @@ import { isEqual } from 'lodash'
 import { AlertTriangle, ArrowLeftRight, ArrowUp, Check, Clipboard } from 'lucide-react'
 import { Button, Input, Label, Tooltip } from '@/components/emcn/components'
 import { cn } from '@/lib/core/utils/cn'
+import type { FieldDiffStatus } from '@/lib/workflows/diff/types'
 import {
   CheckboxList,
   Code,
@@ -68,15 +69,13 @@ interface SubBlockProps {
   isPreview?: boolean
   subBlockValues?: Record<string, any>
   disabled?: boolean
+  fieldDiffStatus?: FieldDiffStatus
   allowExpandInPreview?: boolean
   canonicalToggle?: {
     mode: 'basic' | 'advanced'
     disabled?: boolean
     onToggle?: () => void
   }
-  labelSuffix?: React.ReactNode
-  /** Provides sibling values for dependency resolution in non-preview contexts (e.g. tool-input) */
-  dependencyContext?: Record<string, unknown>
 }
 
 /**
@@ -163,14 +162,16 @@ const getPreviewValue = (
 /**
  * Renders the label with optional validation and description tooltips.
  *
+ * @remarks
+ * Handles JSON validation indicators for code blocks and required field markers.
+ * Includes inline AI generate button when wand is enabled.
+ *
  * @param config - The sub-block configuration defining the label content
  * @param isValidJson - Whether the JSON content is valid (for code blocks)
  * @param subBlockValues - Current values of all subblocks for evaluating conditional requirements
- * @param wandState - State and handlers for the inline AI generate feature
+ * @param wandState - Optional state and handlers for the AI wand feature
- * @param canonicalToggle - Metadata and handlers for the basic/advanced mode toggle
+ * @param canonicalToggle - Optional canonical toggle metadata and handlers
- * @param canonicalToggleIsDisabled - Whether the canonical toggle is disabled (includes dependsOn gating)
+ * @param canonicalToggleIsDisabled - Whether the canonical toggle is disabled
- * @param copyState - State and handler for the copy-to-clipboard button
- * @param labelSuffix - Additional content rendered after the label text
  * @returns The label JSX element, or `null` for switch types or when no title is defined
  */
 const renderLabel = (
@@ -201,8 +202,7 @@ const renderLabel = (
     showCopyButton: boolean
     copied: boolean
     onCopy: () => void
-  },
+  }
-  labelSuffix?: React.ReactNode
 ): JSX.Element | null => {
   if (config.type === 'switch') return null
   if (!config.title) return null
@@ -215,10 +215,9 @@ const renderLabel = (
 
   return (
     <div className='flex items-center justify-between gap-[6px] pl-[2px]'>
-      <Label className='flex items-baseline gap-[6px] whitespace-nowrap'>
+      <Label className='flex items-center gap-[6px] whitespace-nowrap'>
         {config.title}
         {required && <span className='ml-0.5'>*</span>}
-        {labelSuffix}
         {config.type === 'code' &&
           config.language === 'json' &&
           !isValidJson &&
@@ -384,25 +383,28 @@ const arePropsEqual = (prevProps: SubBlockProps, nextProps: SubBlockProps): bool
     prevProps.isPreview === nextProps.isPreview &&
     valueEqual &&
     prevProps.disabled === nextProps.disabled &&
+    prevProps.fieldDiffStatus === nextProps.fieldDiffStatus &&
     prevProps.allowExpandInPreview === nextProps.allowExpandInPreview &&
-    canonicalToggleEqual &&
+    canonicalToggleEqual
-    prevProps.labelSuffix === nextProps.labelSuffix &&
-    prevProps.dependencyContext === nextProps.dependencyContext
   )
 }
 
 /**
  * Renders a single workflow sub-block input based on config.type.
  *
+ * @remarks
+ * Supports multiple input types including short-input, long-input, dropdown,
+ * combobox, slider, table, code, switch, tool-input, and many more.
+ * Handles preview mode, disabled states, and AI wand generation.
+ *
  * @param blockId - The parent block identifier
  * @param config - Configuration defining the input type and properties
  * @param isPreview - Whether to render in preview mode
  * @param subBlockValues - Current values of all subblocks
  * @param disabled - Whether the input is disabled
+ * @param fieldDiffStatus - Optional diff status for visual indicators
  * @param allowExpandInPreview - Whether to allow expanding in preview mode
- * @param canonicalToggle - Metadata and handlers for the basic/advanced mode toggle
+ * @returns The rendered sub-block input component
- * @param labelSuffix - Additional content rendered after the label text
- * @param dependencyContext - Sibling values for dependency resolution in non-preview contexts (e.g. tool-input)
  */
 function SubBlockComponent({
   blockId,
@@ -410,10 +412,9 @@ function SubBlockComponent({
   isPreview = false,
   subBlockValues,
   disabled = false,
+  fieldDiffStatus,
   allowExpandInPreview,
   canonicalToggle,
-  labelSuffix,
-  dependencyContext,
 }: SubBlockProps): JSX.Element {
   const [isValidJson, setIsValidJson] = useState(true)
   const [isSearchActive, setIsSearchActive] = useState(false)
@@ -422,6 +423,7 @@ function SubBlockComponent({
   const searchInputRef = useRef<HTMLInputElement>(null)
   const wandControlRef = useRef<WandControlHandlers | null>(null)
 
+  // Use webhook management hook when config has useWebhookUrl enabled
   const webhookManagement = useWebhookManagement({
     blockId,
     triggerId: undefined,
@@ -508,12 +510,10 @@ function SubBlockComponent({
     | null
     | undefined
 
-  const contextValues = dependencyContext ?? (isPreview ? subBlockValues : undefined)
-
   const { finalDisabled: gatedDisabled } = useDependsOnGate(blockId, config, {
     disabled,
     isPreview,
-    previewContextValues: contextValues,
+    previewContextValues: isPreview ? subBlockValues : undefined,
   })
 
   const isDisabled = gatedDisabled
@@ -797,7 +797,7 @@ function SubBlockComponent({
             disabled={isDisabled}
             isPreview={isPreview}
             previewValue={previewValue}
-            previewContextValues={contextValues}
+            previewContextValues={isPreview ? subBlockValues : undefined}
           />
         )
 
@@ -809,7 +809,7 @@ function SubBlockComponent({
             disabled={isDisabled}
             isPreview={isPreview}
             previewValue={previewValue}
-            previewContextValues={contextValues}
+            previewContextValues={isPreview ? subBlockValues : undefined}
           />
         )
 
@@ -821,7 +821,7 @@ function SubBlockComponent({
             disabled={isDisabled}
             isPreview={isPreview}
             previewValue={previewValue}
-            previewContextValues={contextValues}
+            previewContextValues={isPreview ? subBlockValues : undefined}
           />
         )
 
@@ -833,7 +833,7 @@ function SubBlockComponent({
             disabled={isDisabled}
             isPreview={isPreview}
             previewValue={previewValue}
-            previewContextValues={contextValues}
+            previewContextValues={isPreview ? subBlockValues : undefined}
           />
         )
 
@@ -845,7 +845,7 @@ function SubBlockComponent({
             disabled={isDisabled}
             isPreview={isPreview}
             previewValue={previewValue}
-            previewContextValues={contextValues}
+            previewContextValues={isPreview ? subBlockValues : undefined}
           />
         )
 
@@ -868,7 +868,7 @@ function SubBlockComponent({
             disabled={isDisabled}
             isPreview={isPreview}
             previewValue={previewValue as any}
-            previewContextValues={contextValues}
+            previewContextValues={isPreview ? subBlockValues : undefined}
           />
         )
 
@@ -880,7 +880,7 @@ function SubBlockComponent({
             disabled={isDisabled}
             isPreview={isPreview}
             previewValue={previewValue as any}
-            previewContextValues={contextValues}
+            previewContextValues={isPreview ? subBlockValues : undefined}
           />
         )
 
@@ -892,7 +892,7 @@ function SubBlockComponent({
             disabled={isDisabled}
             isPreview={isPreview}
             previewValue={previewValue as any}
-            previewContextValues={contextValues}
+            previewContextValues={isPreview ? subBlockValues : undefined}
           />
         )
 
@@ -917,7 +917,7 @@ function SubBlockComponent({
             isPreview={isPreview}
             previewValue={previewValue as any}
             disabled={isDisabled}
-            previewContextValues={contextValues}
+            previewContextValues={isPreview ? subBlockValues : undefined}
           />
         )
 
@@ -953,7 +953,7 @@ function SubBlockComponent({
             disabled={isDisabled}
             isPreview={isPreview}
             previewValue={previewValue}
-            previewContextValues={contextValues}
+            previewContextValues={isPreview ? subBlockValues : undefined}
           />
         )
 
@@ -987,7 +987,7 @@ function SubBlockComponent({
             disabled={isDisabled}
             isPreview={isPreview}
             previewValue={previewValue as any}
-            previewContextValues={contextValues}
+            previewContextValues={isPreview ? subBlockValues : undefined}
           />
         )
 
@@ -999,7 +999,7 @@ function SubBlockComponent({
             disabled={isDisabled}
             isPreview={isPreview}
             previewValue={previewValue}
-            previewContextValues={contextValues}
+            previewContextValues={isPreview ? subBlockValues : undefined}
           />
         )
 
@@ -1059,8 +1059,7 @@ function SubBlockComponent({
           showCopyButton: Boolean(config.showCopyButton && config.useWebhookUrl),
           copied,
           onCopy: handleCopy,
-        },
+        }
-        labelSuffix
       )}
       {renderInput()}
     </div>

apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/editor.tsx

@@ -571,6 +571,7 @@ export function Editor() {
                           isPreview={false}
                           subBlockValues={subBlockState}
                           disabled={!canEditBlock}
+                          fieldDiffStatus={undefined}
                           allowExpandInPreview={false}
                           canonicalToggle={
                             isCanonicalSwap && canonicalMode && canonicalId
@@ -634,6 +635,7 @@ export function Editor() {
                           isPreview={false}
                           subBlockValues={subBlockState}
                           disabled={!canEditBlock}
+                          fieldDiffStatus={undefined}
                           allowExpandInPreview={false}
                         />
                         {index < advancedOnlySubBlocks.length - 1 && (

apps/sim/app/workspace/[workspaceId]/w/[workflowId]/workflow.tsx

@@ -255,69 +255,6 @@ const WorkflowContent = React.memo(() => {
 
   const addNotification = useNotificationStore((state) => state.addNotification)
 
-  useEffect(() => {
-    const OAUTH_CONNECT_PENDING_KEY = 'sim.oauth-connect-pending'
-    const pending = window.sessionStorage.getItem(OAUTH_CONNECT_PENDING_KEY)
-    if (!pending) return
-    window.sessionStorage.removeItem(OAUTH_CONNECT_PENDING_KEY)
-
-    ;(async () => {
-      try {
-        const {
-          displayName,
-          providerId,
-          preCount,
-          workspaceId: wsId,
-          reconnect,
-        } = JSON.parse(pending) as {
-          displayName: string
-          providerId: string
-          preCount: number
-          workspaceId: string
-          reconnect?: boolean
-        }
-
-        if (reconnect) {
-          addNotification({
-            level: 'info',
-            message: `"${displayName}" reconnected successfully.`,
-          })
-          window.dispatchEvent(
-            new CustomEvent('oauth-credentials-updated', {
-              detail: { providerId, workspaceId: wsId },
-            })
-          )
-          return
-        }
-
-        const response = await fetch(
-          `/api/credentials?workspaceId=${encodeURIComponent(wsId)}&type=oauth`
-        )
-        const data = response.ok ? await response.json() : { credentials: [] }
-        const oauthCredentials = (data.credentials ?? []) as Array<{
-          displayName: string
-          providerId: string | null
-        }>
-
-        if (oauthCredentials.length > preCount) {
-          addNotification({
-            level: 'info',
-            message: `"${displayName}" credential connected successfully.`,
-          })
-        } else {
-          const existing = oauthCredentials.find((c) => c.providerId === providerId)
-          const existingName = existing?.displayName || displayName
-          addNotification({
-            level: 'info',
-            message: `This account is already connected as "${existingName}".`,
-          })
-        }
-      } catch {
-        // Ignore malformed sessionStorage data
-      }
-    })()
-  }, [])
-
   const {
     workflows,
     activeWorkflowId,

apps/sim/app/workspace/[workspaceId]/w/components/preview/components/preview-editor/preview-editor.tsx

@@ -473,7 +473,7 @@ function ConnectionsSection({
           </div>
         )}
 
-        {/* Secrets */}
+        {/* Environment Variables */}
         {envVars.length > 0 && (
           <div className='mb-[2px] last:mb-0'>
             <div
@@ -489,7 +489,7 @@ function ConnectionsSection({
                   'text-[var(--text-secondary)] group-hover:text-[var(--text-primary)]'
                 )}
               >
-                Secrets
+                Environment Variables
               </span>
               <ChevronDownIcon
                 className={cn(

apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/settings-modal/components/api-keys/api-keys.tsx

@@ -31,9 +31,10 @@ const logger = createLogger('ApiKeys')
 
 interface ApiKeysProps {
   onOpenChange?: (open: boolean) => void
+  registerCloseHandler?: (handler: (open: boolean) => void) => void
 }
 
-export function ApiKeys({ onOpenChange }: ApiKeysProps) {
+export function ApiKeys({ onOpenChange, registerCloseHandler }: ApiKeysProps) {
   const { data: session } = useSession()
   const userId = session?.user?.id
   const params = useParams()
@@ -117,6 +118,12 @@ export function ApiKeys({ onOpenChange }: ApiKeysProps) {
     onOpenChange?.(open)
   }
 
+  useEffect(() => {
+    if (registerCloseHandler) {
+      registerCloseHandler(handleModalClose)
+    }
+  }, [registerCloseHandler])
+
   useEffect(() => {
     if (shouldScrollToBottom && scrollContainerRef.current) {
       scrollContainerRef.current.scrollTo({

apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/settings-modal/components/credentials/credentials.tsx

@@ -1,15 +0,0 @@
-'use client'
-
-import { CredentialsManager } from '@/app/workspace/[workspaceId]/w/components/sidebar/components/settings-modal/components/credentials/credentials-manager'
-
-interface CredentialsProps {
-  onOpenChange?: (open: boolean) => void
-}
-
-export function Credentials(_props: CredentialsProps) {
-  return (
-    <div className='h-full min-h-0'>
-      <CredentialsManager />
-    </div>
-  )
-}

apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/settings-modal/components/environment/environment.tsx

@@ -0,0 +1,864 @@
+'use client'
+
+import { useCallback, useEffect, useMemo, useRef, useState } from 'react'
+import { createLogger } from '@sim/logger'
+import { Plus, Search, Share2, Undo2 } from 'lucide-react'
+import { useParams } from 'next/navigation'
+import {
+  Button,
+  Input as EmcnInput,
+  Modal,
+  ModalBody,
+  ModalContent,
+  ModalFooter,
+  ModalHeader,
+  Tooltip,
+} from '@/components/emcn'
+import { Trash } from '@/components/emcn/icons/trash'
+import { Input, Skeleton } from '@/components/ui'
+import { isValidEnvVarName } from '@/executor/constants'
+import {
+  usePersonalEnvironment,
+  useRemoveWorkspaceEnvironment,
+  useSavePersonalEnvironment,
+  useUpsertWorkspaceEnvironment,
+  useWorkspaceEnvironment,
+  type WorkspaceEnvironmentData,
+} from '@/hooks/queries/environment'
+
+const logger = createLogger('EnvironmentVariables')
+
+const GRID_COLS = 'grid grid-cols-[minmax(0,1fr)_8px_minmax(0,1fr)_auto] items-center'
+
+const generateRowId = (() => {
+  let counter = 0
+  return () => {
+    counter += 1
+    return Date.now() + counter
+  }
+})()
+
+const createEmptyEnvVar = (): UIEnvironmentVariable => ({
+  key: '',
+  value: '',
+  id: generateRowId(),
+})
+
+interface UIEnvironmentVariable {
+  key: string
+  value: string
+  id?: number
+}
+
+/**
+ * Validates an environment variable key.
+ * Returns an error message if invalid, undefined if valid.
+ */
+function validateEnvVarKey(key: string): string | undefined {
+  if (!key) return undefined
+  if (key.includes(' ')) return 'Spaces are not allowed'
+  if (!isValidEnvVarName(key)) return 'Only letters, numbers, and underscores allowed'
+  return undefined
+}
+
+interface EnvironmentVariablesProps {
+  registerBeforeLeaveHandler?: (handler: (onProceed: () => void) => void) => void
+}
+
+interface WorkspaceVariableRowProps {
+  envKey: string
+  value: string
+  renamingKey: string | null
+  pendingKeyValue: string
+  isNewlyPromoted: boolean
+  onRenameStart: (key: string) => void
+  onPendingKeyChange: (value: string) => void
+  onRenameEnd: (key: string, value: string) => void
+  onDelete: (key: string) => void
+  onDemote: (key: string, value: string) => void
+}
+
+function WorkspaceVariableRow({
+  envKey,
+  value,
+  renamingKey,
+  pendingKeyValue,
+  isNewlyPromoted,
+  onRenameStart,
+  onPendingKeyChange,
+  onRenameEnd,
+  onDelete,
+  onDemote,
+}: WorkspaceVariableRowProps) {
+  return (
+    <div className={GRID_COLS}>
+      <EmcnInput
+        value={renamingKey === envKey ? pendingKeyValue : envKey}
+        onChange={(e) => {
+          if (renamingKey !== envKey) onRenameStart(envKey)
+          onPendingKeyChange(e.target.value)
+        }}
+        onBlur={() => onRenameEnd(envKey, value)}
+        name={`workspace_env_key_${envKey}_${Math.random()}`}
+        autoComplete='off'
+        autoCapitalize='off'
+        spellCheck='false'
+        readOnly
+        onFocus={(e) => e.target.removeAttribute('readOnly')}
+        className='h-9'
+      />
+      <div />
+      <EmcnInput
+        value={value ? '•'.repeat(value.length) : ''}
+        readOnly
+        autoComplete='off'
+        autoCorrect='off'
+        autoCapitalize='off'
+        spellCheck='false'
+        className='h-9'
+      />
+      <div className='ml-[8px] flex'>
+        {isNewlyPromoted && (
+          <Tooltip.Root>
+            <Tooltip.Trigger asChild>
+              <Button variant='ghost' onClick={() => onDemote(envKey, value)} className='h-9 w-9'>
+                <Undo2 className='h-3.5 w-3.5' />
+              </Button>
+            </Tooltip.Trigger>
+            <Tooltip.Content>Change to personal scope</Tooltip.Content>
+          </Tooltip.Root>
+        )}
+        <Tooltip.Root>
+          <Tooltip.Trigger asChild>
+            <Button variant='ghost' onClick={() => onDelete(envKey)} className='h-9 w-9'>
+              <Trash />
+            </Button>
+          </Tooltip.Trigger>
+          <Tooltip.Content>Delete environment variable</Tooltip.Content>
+        </Tooltip.Root>
+      </div>
+    </div>
+  )
+}
+
+export function EnvironmentVariables({ registerBeforeLeaveHandler }: EnvironmentVariablesProps) {
+  const params = useParams()
+  const workspaceId = (params?.workspaceId as string) || ''
+
+  const { data: personalEnvData, isLoading: isPersonalLoading } = usePersonalEnvironment()
+  const { data: workspaceEnvData, isLoading: isWorkspaceLoading } = useWorkspaceEnvironment(
+    workspaceId,
+    {
+      select: useCallback(
+        (data: WorkspaceEnvironmentData): WorkspaceEnvironmentData => ({
+          workspace: data.workspace || {},
+          personal: data.personal || {},
+          conflicts: data.conflicts || [],
+        }),
+        []
+      ),
+    }
+  )
+  const savePersonalMutation = useSavePersonalEnvironment()
+  const upsertWorkspaceMutation = useUpsertWorkspaceEnvironment()
+  const removeWorkspaceMutation = useRemoveWorkspaceEnvironment()
+
+  const isLoading = isPersonalLoading || isWorkspaceLoading
+  const variables = useMemo(() => personalEnvData || {}, [personalEnvData])
+
+  const [envVars, setEnvVars] = useState<UIEnvironmentVariable[]>([])
+  const [searchTerm, setSearchTerm] = useState('')
+  const [focusedValueIndex, setFocusedValueIndex] = useState<number | null>(null)
+  const [showUnsavedChanges, setShowUnsavedChanges] = useState(false)
+  const [shouldScrollToBottom, setShouldScrollToBottom] = useState(false)
+  const [workspaceVars, setWorkspaceVars] = useState<Record<string, string>>({})
+  const [conflicts, setConflicts] = useState<string[]>([])
+  const [renamingKey, setRenamingKey] = useState<string | null>(null)
+  const [pendingKeyValue, setPendingKeyValue] = useState<string>('')
+  const [changeToken, setChangeToken] = useState(0)
+
+  const initialWorkspaceVarsRef = useRef<Record<string, string>>({})
+  const scrollContainerRef = useRef<HTMLDivElement>(null)
+  const pendingProceedCallback = useRef<(() => void) | null>(null)
+  const initialVarsRef = useRef<UIEnvironmentVariable[]>([])
+  const hasChangesRef = useRef(false)
+  const hasSavedRef = useRef(false)
+
+  const filteredEnvVars = useMemo(() => {
+    const mapped = envVars.map((envVar, index) => ({ envVar, originalIndex: index }))
+    if (!searchTerm.trim()) return mapped
+    const term = searchTerm.toLowerCase()
+    return mapped.filter(({ envVar }) => envVar.key.toLowerCase().includes(term))
+  }, [envVars, searchTerm])
+
+  const filteredWorkspaceEntries = useMemo(() => {
+    const entries = Object.entries(workspaceVars)
+    if (!searchTerm.trim()) return entries
+    const term = searchTerm.toLowerCase()
+    return entries.filter(([key]) => key.toLowerCase().includes(term))
+  }, [workspaceVars, searchTerm])
+
+  const hasChanges = useMemo(() => {
+    const initialVars = initialVarsRef.current.filter((v) => v.key || v.value)
+    const currentVars = envVars.filter((v) => v.key || v.value)
+    const initialMap = new Map(initialVars.map((v) => [v.key, v.value]))
+    const currentMap = new Map(currentVars.map((v) => [v.key, v.value]))
+
+    if (initialMap.size !== currentMap.size) return true
+
+    for (const [key, value] of currentMap) {
+      if (initialMap.get(key) !== value) return true
+    }
+
+    for (const key of initialMap.keys()) {
+      if (!currentMap.has(key)) return true
+    }
+
+    const before = initialWorkspaceVarsRef.current
+    const after = workspaceVars
+    const allKeys = new Set([...Object.keys(before), ...Object.keys(after)])
+
+    if (Object.keys(before).length !== Object.keys(after).length) return true
+
+    for (const key of allKeys) {
+      if (before[key] !== after[key]) return true
+    }
+
+    return false
+  }, [envVars, workspaceVars, changeToken])
+
+  const hasConflicts = useMemo(() => {
+    return envVars.some((envVar) => !!envVar.key && Object.hasOwn(workspaceVars, envVar.key))
+  }, [envVars, workspaceVars])
+
+  const hasInvalidKeys = useMemo(() => {
+    return envVars.some((envVar) => !!envVar.key && validateEnvVarKey(envVar.key))
+  }, [envVars])
+
+  useEffect(() => {
+    hasChangesRef.current = hasChanges
+  }, [hasChanges])
+
+  const handleBeforeLeave = useCallback((onProceed: () => void) => {
+    if (hasChangesRef.current) {
+      setShowUnsavedChanges(true)
+      pendingProceedCallback.current = onProceed
+    } else {
+      onProceed()
+    }
+  }, [])
+
+  useEffect(() => {
+    if (hasSavedRef.current) return
+
+    const existingVars = Object.values(variables)
+    const initialVars = existingVars.length
+      ? existingVars.map((envVar) => ({
+          ...envVar,
+          id: generateRowId(),
+        }))
+      : [createEmptyEnvVar()]
+    initialVarsRef.current = JSON.parse(JSON.stringify(initialVars))
+    setEnvVars(JSON.parse(JSON.stringify(initialVars)))
+    pendingProceedCallback.current = null
+  }, [variables])
+
+  useEffect(() => {
+    if (workspaceEnvData) {
+      if (hasSavedRef.current) {
+        setConflicts(workspaceEnvData?.conflicts || [])
+        hasSavedRef.current = false
+      } else {
+        setWorkspaceVars(workspaceEnvData?.workspace || {})
+        initialWorkspaceVarsRef.current = workspaceEnvData?.workspace || {}
+        setConflicts(workspaceEnvData?.conflicts || [])
+      }
+    }
+  }, [workspaceEnvData])
+
+  useEffect(() => {
+    if (registerBeforeLeaveHandler) {
+      registerBeforeLeaveHandler(handleBeforeLeave)
+    }
+  }, [registerBeforeLeaveHandler, handleBeforeLeave])
+
+  useEffect(() => {
+    if (shouldScrollToBottom && scrollContainerRef.current) {
+      scrollContainerRef.current.scrollTo({
+        top: scrollContainerRef.current.scrollHeight,
+        behavior: 'smooth',
+      })
+      setShouldScrollToBottom(false)
+    }
+  }, [shouldScrollToBottom])
+
+  useEffect(() => {
+    const personalKeys = envVars.map((envVar) => envVar.key.trim()).filter((key) => key.length > 0)
+
+    const uniquePersonalKeys = Array.from(new Set(personalKeys))
+
+    const computedConflicts = uniquePersonalKeys.filter((key) => Object.hasOwn(workspaceVars, key))
+
+    setConflicts((prev) => {
+      if (prev.length === computedConflicts.length) {
+        const sameKeys = prev.every((key) => computedConflicts.includes(key))
+        if (sameKeys) return prev
+      }
+      return computedConflicts
+    })
+  }, [envVars, workspaceVars])
+
+  const handleWorkspaceKeyRename = useCallback(
+    (currentKey: string, currentValue: string) => {
+      const newKey = pendingKeyValue.trim()
+      if (!renamingKey || renamingKey !== currentKey) return
+      setRenamingKey(null)
+      if (!newKey || newKey === currentKey) return
+
+      setWorkspaceVars((prev) => {
+        const next = { ...prev }
+        delete next[currentKey]
+        next[newKey] = currentValue
+        return next
+      })
+    },
+    [pendingKeyValue, renamingKey]
+  )
+
+  const handleDeleteWorkspaceVar = useCallback((key: string) => {
+    setWorkspaceVars((prev) => {
+      const next = { ...prev }
+      delete next[key]
+      return next
+    })
+  }, [])
+
+  const addEnvVar = useCallback(() => {
+    setEnvVars((prev) => [...prev, createEmptyEnvVar()])
+    setSearchTerm('')
+    setShouldScrollToBottom(true)
+  }, [])
+
+  const updateEnvVar = useCallback((index: number, field: 'key' | 'value', value: string) => {
+    setEnvVars((prev) => {
+      const newEnvVars = [...prev]
+      newEnvVars[index][field] = value
+      return newEnvVars
+    })
+  }, [])
+
+  const removeEnvVar = useCallback((index: number) => {
+    setEnvVars((prev) => {
+      const newEnvVars = prev.filter((_, i) => i !== index)
+      return newEnvVars.length ? newEnvVars : [createEmptyEnvVar()]
+    })
+  }, [])
+
+  const handleValueFocus = useCallback((index: number, e: React.FocusEvent<HTMLInputElement>) => {
+    setFocusedValueIndex(index)
+    e.target.scrollLeft = 0
+  }, [])
+
+  const handleValueClick = useCallback((e: React.MouseEvent<HTMLInputElement>) => {
+    e.preventDefault()
+    e.currentTarget.scrollLeft = 0
+  }, [])
+
+  const parseEnvVarLine = useCallback((line: string): UIEnvironmentVariable | null => {
+    const trimmed = line.trim()
+
+    if (!trimmed || trimmed.startsWith('#')) return null
+
+    const withoutExport = trimmed.replace(/^export\s+/, '')
+
+    const equalIndex = withoutExport.indexOf('=')
+    if (equalIndex === -1 || equalIndex === 0) return null
+
+    const potentialKey = withoutExport.substring(0, equalIndex).trim()
+    if (!isValidEnvVarName(potentialKey)) return null
+
+    let value = withoutExport.substring(equalIndex + 1)
+
+    const looksLikeBase64Key = /^[A-Za-z0-9+/]+$/.test(potentialKey) && !potentialKey.includes('_')
+    const valueIsJustPadding = /^=+$/.test(value.trim())
+    if (looksLikeBase64Key && valueIsJustPadding && potentialKey.length > 20) {
+      return null
+    }
+
+    const trimmedValue = value.trim()
+    if (
+      !trimmedValue.startsWith('"') &&
+      !trimmedValue.startsWith("'") &&
+      !trimmedValue.startsWith('`')
+    ) {
+      const commentIndex = value.search(/\s#/)
+      if (commentIndex !== -1) {
+        value = value.substring(0, commentIndex)
+      }
+    }
+
+    value = value.trim()
+
+    if (
+      (value.startsWith('"') && value.endsWith('"')) ||
+      (value.startsWith("'") && value.endsWith("'")) ||
+      (value.startsWith('`') && value.endsWith('`'))
+    ) {
+      value = value.slice(1, -1)
+    }
+
+    return { key: potentialKey, value, id: generateRowId() }
+  }, [])
+
+  const handleSingleValuePaste = useCallback(
+    (text: string, index: number, inputType: 'key' | 'value') => {
+      setEnvVars((prev) => {
+        const newEnvVars = [...prev]
+        newEnvVars[index][inputType] = text
+        return newEnvVars
+      })
+    },
+    []
+  )
+
+  const handleKeyValuePaste = useCallback(
+    (lines: string[]) => {
+      const parsedVars = lines
+        .map(parseEnvVarLine)
+        .filter((parsed): parsed is UIEnvironmentVariable => parsed !== null)
+        .filter(({ key, value }) => key && value)
+
+      if (parsedVars.length > 0) {
+        setEnvVars((prev) => {
+          const existingVars = prev.filter((v) => v.key || v.value)
+          return [...existingVars, ...parsedVars]
+        })
+        setShouldScrollToBottom(true)
+      }
+    },
+    [parseEnvVarLine]
+  )
+
+  const handlePaste = useCallback(
+    (e: React.ClipboardEvent<HTMLInputElement>, index: number) => {
+      const text = e.clipboardData.getData('text').trim()
+      if (!text) return
+
+      const lines = text.split('\n').filter((line) => line.trim())
+      if (lines.length === 0) return
+
+      e.preventDefault()
+
+      const inputType = (e.target as HTMLInputElement).getAttribute('data-input-type') as
+        | 'key'
+        | 'value'
+
+      if (inputType) {
+        const hasValidEnvVarPattern = lines.some((line) => parseEnvVarLine(line) !== null)
+        if (!hasValidEnvVarPattern) {
+          handleSingleValuePaste(text, index, inputType)
+          return
+        }
+      }
+
+      handleKeyValuePaste(lines)
+    },
+    [parseEnvVarLine, handleSingleValuePaste, handleKeyValuePaste]
+  )
+
+  const handleCancel = useCallback(() => {
+    setEnvVars(JSON.parse(JSON.stringify(initialVarsRef.current)))
+    setWorkspaceVars({ ...initialWorkspaceVarsRef.current })
+    setShowUnsavedChanges(false)
+
+    pendingProceedCallback.current?.()
+    pendingProceedCallback.current = null
+  }, [])
+
+  const handleSave = useCallback(async () => {
+    const onProceed = pendingProceedCallback.current
+
+    const prevInitialVars = [...initialVarsRef.current]
+    const prevInitialWorkspaceVars = { ...initialWorkspaceVarsRef.current }
+
+    try {
+      setShowUnsavedChanges(false)
+      hasSavedRef.current = true
+
+      initialWorkspaceVarsRef.current = { ...workspaceVars }
+      initialVarsRef.current = JSON.parse(JSON.stringify(envVars.filter((v) => v.key && v.value)))
+
+      setChangeToken((prev) => prev + 1)
+
+      const validVariables = envVars
+        .filter((v) => v.key && v.value)
+        .reduce<Record<string, string>>((acc, { key, value }) => ({ ...acc, [key]: value }), {})
+
+      await savePersonalMutation.mutateAsync({ variables: validVariables })
+
+      const before = prevInitialWorkspaceVars
+      const after = workspaceVars
+      const toUpsert: Record<string, string> = {}
+      const toDelete: string[] = []
+
+      for (const [k, v] of Object.entries(after)) {
+        if (!(k in before) || before[k] !== v) {
+          toUpsert[k] = v
+        }
+      }
+
+      for (const k of Object.keys(before)) {
+        if (!(k in after)) toDelete.push(k)
+      }
+
+      if (workspaceId) {
+        if (Object.keys(toUpsert).length) {
+          await upsertWorkspaceMutation.mutateAsync({ workspaceId, variables: toUpsert })
+        }
+        if (toDelete.length) {
+          await removeWorkspaceMutation.mutateAsync({ workspaceId, keys: toDelete })
+        }
+      }
+
+      onProceed?.()
+      pendingProceedCallback.current = null
+    } catch (error) {
+      hasSavedRef.current = false
+      initialVarsRef.current = prevInitialVars
+      initialWorkspaceVarsRef.current = prevInitialWorkspaceVars
+      logger.error('Failed to save environment variables:', error)
+    }
+  }, [
+    envVars,
+    workspaceVars,
+    workspaceId,
+    savePersonalMutation,
+    upsertWorkspaceMutation,
+    removeWorkspaceMutation,
+  ])
+
+  const promoteToWorkspace = useCallback(
+    (envVar: UIEnvironmentVariable) => {
+      if (!envVar.key || !envVar.value || !workspaceId) return
+      setWorkspaceVars((prev) => ({ ...prev, [envVar.key]: envVar.value }))
+      setEnvVars((prev) => {
+        const filtered = prev.filter((entry) => entry !== envVar)
+        return filtered.length ? filtered : [createEmptyEnvVar()]
+      })
+    },
+    [workspaceId]
+  )
+
+  const demoteToPersonal = useCallback((key: string, value: string) => {
+    if (!key) return
+    setWorkspaceVars((prev) => {
+      const next = { ...prev }
+      delete next[key]
+      return next
+    })
+    setEnvVars((prev) => [...prev, { key, value, id: generateRowId() }])
+  }, [])
+
+  const conflictClassName = 'border-[var(--text-error)] bg-[#F6D2D2] dark:bg-[#442929]'
+
+  const renderEnvVarRow = useCallback(
+    (envVar: UIEnvironmentVariable, originalIndex: number) => {
+      const isConflict = !!envVar.key && Object.hasOwn(workspaceVars, envVar.key)
+      const keyError = validateEnvVarKey(envVar.key)
+      const maskedValueStyle =
+        focusedValueIndex !== originalIndex && !isConflict
+          ? ({ WebkitTextSecurity: 'disc' } as React.CSSProperties)
+          : undefined
+
+      return (
+        <>
+          <div className={GRID_COLS}>
+            <EmcnInput
+              data-input-type='key'
+              value={envVar.key}
+              onChange={(e) => updateEnvVar(originalIndex, 'key', e.target.value)}
+              onPaste={(e) => handlePaste(e, originalIndex)}
+              placeholder='API_KEY'
+              name={`env_variable_name_${envVar.id || originalIndex}_${Math.random()}`}
+              autoComplete='off'
+              autoCapitalize='off'
+              spellCheck='false'
+              readOnly
+              onFocus={(e) => e.target.removeAttribute('readOnly')}
+              className={`h-9 ${isConflict ? conflictClassName : ''} ${keyError ? 'border-[var(--text-error)]' : ''}`}
+            />
+            <div />
+            <EmcnInput
+              data-input-type='value'
+              value={envVar.value}
+              onChange={(e) => updateEnvVar(originalIndex, 'value', e.target.value)}
+              type='text'
+              onFocus={(e) => {
+                if (!isConflict) {
+                  e.target.removeAttribute('readOnly')
+                  handleValueFocus(originalIndex, e)
+                }
+              }}
+              onClick={handleValueClick}
+              onBlur={() => setFocusedValueIndex(null)}
+              onPaste={(e) => handlePaste(e, originalIndex)}
+              placeholder={isConflict ? 'Workspace override active' : 'Enter value'}
+              disabled={isConflict}
+              aria-disabled={isConflict}
+              name={`env_variable_value_${envVar.id || originalIndex}_${Math.random()}`}
+              autoComplete='off'
+              autoCapitalize='off'
+              spellCheck='false'
+              readOnly={isConflict}
+              style={maskedValueStyle}
+              className={`h-9 ${isConflict ? `cursor-not-allowed ${conflictClassName}` : ''}`}
+            />
+            <div className='ml-[8px] flex items-center'>
+              <Tooltip.Root>
+                <Tooltip.Trigger asChild>
+                  <Button
+                    variant='ghost'
+                    disabled={!envVar.key || !envVar.value || isConflict || !workspaceId}
+                    onClick={() => promoteToWorkspace(envVar)}
+                    className='h-9 w-9'
+                  >
+                    <Share2 className='h-3.5 w-3.5' />
+                  </Button>
+                </Tooltip.Trigger>
+                <Tooltip.Content>Change to workspace scope</Tooltip.Content>
+              </Tooltip.Root>
+              <Tooltip.Root>
+                <Tooltip.Trigger asChild>
+                  <Button
+                    variant='ghost'
+                    onClick={() => removeEnvVar(originalIndex)}
+                    className='h-9 w-9'
+                  >
+                    <Trash />
+                  </Button>
+                </Tooltip.Trigger>
+                <Tooltip.Content>Delete environment variable</Tooltip.Content>
+              </Tooltip.Root>
+            </div>
+          </div>
+          {keyError && (
+            <div className='col-span-3 mt-[4px] text-[12px] text-[var(--text-error)] leading-tight'>
+              {keyError}
+            </div>
+          )}
+          {isConflict && !keyError && (
+            <div className='col-span-3 mt-[4px] text-[12px] text-[var(--text-error)] leading-tight'>
+              Workspace variable with the same name overrides this. Rename your personal key to use
+              it.
+            </div>
+          )}
+        </>
+      )
+    },
+    [
+      workspaceVars,
+      workspaceId,
+      focusedValueIndex,
+      updateEnvVar,
+      handlePaste,
+      handleValueFocus,
+      handleValueClick,
+      promoteToWorkspace,
+      removeEnvVar,
+    ]
+  )
+
+  return (
+    <>
+      <div className='flex h-full flex-col gap-[16px]'>
+        <div className='hidden'>
+          <input
+            type='text'
+            name='fakeusernameremembered'
+            autoComplete='username'
+            tabIndex={-1}
+            readOnly
+          />
+          <input
+            type='password'
+            name='fakepasswordremembered'
+            autoComplete='current-password'
+            tabIndex={-1}
+            readOnly
+          />
+          <input
+            type='email'
+            name='fakeemailremembered'
+            autoComplete='email'
+            tabIndex={-1}
+            readOnly
+          />
+        </div>
+        <div className='flex items-center gap-[8px]'>
+          <div className='flex flex-1 items-center gap-[8px] rounded-[8px] border border-[var(--border)] bg-transparent px-[8px] py-[5px] transition-colors duration-100 dark:bg-[var(--surface-4)] dark:hover:border-[var(--border-1)] dark:hover:bg-[var(--surface-5)]'>
+            <Search
+              className='h-[14px] w-[14px] flex-shrink-0 text-[var(--text-tertiary)]'
+              strokeWidth={2}
+            />
+            <Input
+              placeholder='Search variables...'
+              value={searchTerm}
+              onChange={(e) => setSearchTerm(e.target.value)}
+              name='env_search_field'
+              autoComplete='off'
+              autoCapitalize='off'
+              spellCheck='false'
+              readOnly
+              onFocus={(e) => e.target.removeAttribute('readOnly')}
+              className='h-auto flex-1 border-0 bg-transparent p-0 font-base leading-none placeholder:text-[var(--text-tertiary)] focus-visible:ring-0 focus-visible:ring-offset-0'
+            />
+          </div>
+          <Button onClick={addEnvVar} variant='tertiary' disabled={isLoading}>
+            <Plus className='mr-[6px] h-[13px] w-[13px]' />
+            Add
+          </Button>
+          <Tooltip.Root>
+            <Tooltip.Trigger asChild>
+              <Button
+                onClick={handleSave}
+                disabled={isLoading || !hasChanges || hasConflicts || hasInvalidKeys}
+                variant='tertiary'
+                className={`${hasConflicts || hasInvalidKeys ? 'cursor-not-allowed opacity-50' : ''}`}
+              >
+                Save
+              </Button>
+            </Tooltip.Trigger>
+            {hasConflicts && <Tooltip.Content>Resolve all conflicts before saving</Tooltip.Content>}
+            {hasInvalidKeys && !hasConflicts && (
+              <Tooltip.Content>Fix invalid variable names before saving</Tooltip.Content>
+            )}
+          </Tooltip.Root>
+        </div>
+
+        <div ref={scrollContainerRef} className='min-h-0 flex-1 overflow-y-auto'>
+          <div className='flex flex-col gap-[16px]'>
+            {isLoading ? (
+              <>
+                <div className='flex flex-col gap-[8px]'>
+                  <Skeleton className='h-5 w-[70px]' />
+                  <div className='text-[13px] text-[var(--text-muted)]'>
+                    <Skeleton className='h-5 w-[160px]' />
+                  </div>
+                </div>
+                <div className='flex flex-col gap-[8px]'>
+                  <Skeleton className='h-5 w-[55px]' />
+                  {Array.from({ length: 2 }, (_, i) => (
+                    <div key={`personal-${i}`} className={GRID_COLS}>
+                      <Skeleton className='h-9 rounded-[6px]' />
+                      <div />
+                      <Skeleton className='h-9 rounded-[6px]' />
+                      <div className='ml-[8px] flex items-center gap-0'>
+                        <Skeleton className='h-9 w-9 rounded-[6px]' />
+                        <Skeleton className='h-9 w-9 rounded-[6px]' />
+                      </div>
+                    </div>
+                  ))}
+                </div>
+              </>
+            ) : (
+              <>
+                {(!searchTerm.trim() || filteredWorkspaceEntries.length > 0) && (
+                  <div className='flex flex-col gap-[8px]'>
+                    <div className='font-medium text-[13px] text-[var(--text-secondary)]'>
+                      Workspace
+                    </div>
+                    {!searchTerm.trim() && Object.keys(workspaceVars).length === 0 ? (
+                      <div className='text-[13px] text-[var(--text-muted)]'>
+                        No workspace variables yet
+                      </div>
+                    ) : (
+                      (searchTerm.trim()
+                        ? filteredWorkspaceEntries
+                        : Object.entries(workspaceVars)
+                      ).map(([key, value]) => (
+                        <WorkspaceVariableRow
+                          key={key}
+                          envKey={key}
+                          value={value}
+                          renamingKey={renamingKey}
+                          pendingKeyValue={pendingKeyValue}
+                          isNewlyPromoted={!Object.hasOwn(initialWorkspaceVarsRef.current, key)}
+                          onRenameStart={setRenamingKey}
+                          onPendingKeyChange={setPendingKeyValue}
+                          onRenameEnd={handleWorkspaceKeyRename}
+                          onDelete={handleDeleteWorkspaceVar}
+                          onDemote={demoteToPersonal}
+                        />
+                      ))
+                    )}
+                  </div>
+                )}
+
+                {(!searchTerm.trim() || filteredEnvVars.length > 0) && (
+                  <div className='flex flex-col gap-[8px]'>
+                    <div className='font-medium text-[13px] text-[var(--text-secondary)]'>
+                      Personal
+                    </div>
+                    {filteredEnvVars.map(({ envVar, originalIndex }) => (
+                      <div key={envVar.id || originalIndex}>
+                        {renderEnvVarRow(envVar, originalIndex)}
+                      </div>
+                    ))}
+                  </div>
+                )}
+                {searchTerm.trim() &&
+                  filteredEnvVars.length === 0 &&
+                  filteredWorkspaceEntries.length === 0 &&
+                  (envVars.length > 0 || Object.keys(workspaceVars).length > 0) && (
+                    <div className='py-[16px] text-center text-[13px] text-[var(--text-muted)]'>
+                      No environment variables found matching "{searchTerm}"
+                    </div>
+                  )}
+              </>
+            )}
+          </div>
+        </div>
+      </div>
+
+      <Modal open={showUnsavedChanges} onOpenChange={setShowUnsavedChanges}>
+        <ModalContent size='sm'>
+          <ModalHeader>Unsaved Changes</ModalHeader>
+          <ModalBody>
+            <p className='text-[12px] text-[var(--text-secondary)]'>
+              {hasConflicts || hasInvalidKeys
+                ? `You have unsaved changes, but ${hasConflicts ? 'conflicts must be resolved' : 'invalid variable names must be fixed'} before saving. You can discard your changes to close the modal.`
+                : 'You have unsaved changes. Do you want to save them before closing?'}
+            </p>
+          </ModalBody>
+          <ModalFooter>
+            <Button variant='destructive' onClick={handleCancel}>
+              Discard Changes
+            </Button>
+            {hasConflicts || hasInvalidKeys ? (
+              <Tooltip.Root>
+                <Tooltip.Trigger asChild>
+                  <Button
+                    disabled={true}
+                    variant='tertiary'
+                    className='cursor-not-allowed opacity-50'
+                  >
+                    Save Changes
+                  </Button>
+                </Tooltip.Trigger>
+                <Tooltip.Content>
+                  {hasConflicts
+                    ? 'Resolve all conflicts before saving'
+                    : 'Fix invalid variable names before saving'}
+                </Tooltip.Content>
+              </Tooltip.Root>
+            ) : (
+              <Button onClick={handleSave} variant='tertiary'>
+                Save Changes
+              </Button>
+            )}
+          </ModalFooter>
+        </ModalContent>
+      </Modal>
+    </>
+  )
+}

apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/settings-modal/components/index.ts

@@ -2,11 +2,12 @@ export { ApiKeys } from './api-keys/api-keys'
 export { BYOK } from './byok/byok'
 export { Copilot } from './copilot/copilot'
 export { CredentialSets } from './credential-sets/credential-sets'
-export { Credentials } from './credentials/credentials'
 export { CustomTools } from './custom-tools/custom-tools'
 export { Debug } from './debug/debug'
+export { EnvironmentVariables } from './environment/environment'
 export { Files as FileUploads } from './files/files'
 export { General } from './general/general'
+export { Integrations } from './integrations/integrations'
 export { MCP } from './mcp/mcp'
 export { Skills } from './skills/skills'
 export { Subscription } from './subscription/subscription'

apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/settings-modal/components/integrations/integrations.tsx

@@ -0,0 +1,417 @@
+'use client'
+
+import { createElement, useEffect, useRef, useState } from 'react'
+import { createLogger } from '@sim/logger'
+import { Check, ChevronDown, ExternalLink, Search } from 'lucide-react'
+import { useRouter, useSearchParams } from 'next/navigation'
+import {
+  Button,
+  Label,
+  Modal,
+  ModalBody,
+  ModalContent,
+  ModalFooter,
+  ModalHeader,
+} from '@/components/emcn'
+import { Input, Skeleton } from '@/components/ui'
+import { cn } from '@/lib/core/utils/cn'
+import { OAUTH_PROVIDERS } from '@/lib/oauth'
+import {
+  type ServiceInfo,
+  useConnectOAuthService,
+  useDisconnectOAuthService,
+  useOAuthConnections,
+} from '@/hooks/queries/oauth-connections'
+import { usePermissionConfig } from '@/hooks/use-permission-config'
+
+const logger = createLogger('Integrations')
+
+/**
+ * Static skeleton structure matching OAUTH_PROVIDERS layout
+ * Each entry: [providerName, serviceCount]
+ */
+const SKELETON_STRUCTURE: [string, number][] = [
+  ['Google', 7],
+  ['Microsoft', 6],
+  ['GitHub', 1],
+  ['X', 1],
+  ['Confluence', 1],
+  ['Jira', 1],
+  ['Airtable', 1],
+  ['Notion', 1],
+  ['Linear', 1],
+  ['Slack', 1],
+  ['Reddit', 1],
+  ['Wealthbox', 1],
+  ['Webflow', 1],
+  ['Trello', 1],
+  ['Asana', 1],
+  ['Pipedrive', 1],
+  ['HubSpot', 1],
+  ['Salesforce', 1],
+]
+
+function IntegrationsSkeleton() {
+  return (
+    <div className='flex h-full flex-col gap-[16px]'>
+      <div className='flex w-full items-center gap-[8px] rounded-[8px] border border-[var(--border)] bg-transparent px-[8px] py-[5px] transition-colors duration-100 dark:bg-[var(--surface-4)] dark:hover:border-[var(--border-1)] dark:hover:bg-[var(--surface-5)]'>
+        <Search className='h-[14px] w-[14px] flex-shrink-0 text-[var(--text-tertiary)]' />
+        <Input
+          placeholder='Search integrations...'
+          disabled
+          className='h-auto flex-1 border-0 bg-transparent p-0 font-base leading-none placeholder:text-[var(--text-tertiary)] focus-visible:ring-0 focus-visible:ring-offset-0'
+        />
+      </div>
+
+      <div className='min-h-0 flex-1 overflow-y-auto'>
+        <div className='flex flex-col gap-[16px]'>
+          {SKELETON_STRUCTURE.map(([providerName, serviceCount]) => (
+            <div key={providerName} className='flex flex-col gap-[8px]'>
+              <Skeleton className='h-[14px] w-[60px]' />
+              {Array.from({ length: serviceCount }).map((_, index) => (
+                <div key={index} className='flex items-center justify-between'>
+                  <div className='flex items-center gap-[12px]'>
+                    <Skeleton className='h-9 w-9 flex-shrink-0 rounded-[6px]' />
+                    <div className='flex flex-col justify-center gap-[1px]'>
+                      <Skeleton className='h-[14px] w-[100px]' />
+                      <Skeleton className='h-[13px] w-[200px]' />
+                    </div>
+                  </div>
+                  <Skeleton className='h-[32px] w-[72px] rounded-[6px]' />
+                </div>
+              ))}
+            </div>
+          ))}
+        </div>
+      </div>
+    </div>
+  )
+}
+
+interface IntegrationsProps {
+  onOpenChange?: (open: boolean) => void
+  registerCloseHandler?: (handler: (open: boolean) => void) => void
+}
+
+export function Integrations({ onOpenChange, registerCloseHandler }: IntegrationsProps) {
+  const router = useRouter()
+  const searchParams = useSearchParams()
+  const pendingServiceRef = useRef<HTMLDivElement>(null)
+
+  const { data: services = [], isPending } = useOAuthConnections()
+  const connectService = useConnectOAuthService()
+  const disconnectService = useDisconnectOAuthService()
+  const { config: permissionConfig } = usePermissionConfig()
+
+  const [searchTerm, setSearchTerm] = useState('')
+  const [pendingService, setPendingService] = useState<string | null>(null)
+  const [authSuccess, setAuthSuccess] = useState(false)
+  const [showActionRequired, setShowActionRequired] = useState(false)
+  const prevConnectedIdsRef = useRef<Set<string>>(new Set())
+  const connectionAddedRef = useRef<boolean>(false)
+
+  // Disconnect confirmation dialog state
+  const [showDisconnectDialog, setShowDisconnectDialog] = useState(false)
+  const [serviceToDisconnect, setServiceToDisconnect] = useState<{
+    service: ServiceInfo
+    accountId: string
+  } | null>(null)
+
+  // Check for OAuth callback - just show success message
+  useEffect(() => {
+    const code = searchParams.get('code')
+    const state = searchParams.get('state')
+    const error = searchParams.get('error')
+
+    if (code && state) {
+      logger.info('OAuth callback successful')
+      setAuthSuccess(true)
+
+      // Clear URL parameters without changing the page
+      const url = new URL(window.location.href)
+      url.searchParams.delete('code')
+      url.searchParams.delete('state')
+      router.replace(url.pathname + url.search)
+    } else if (error) {
+      logger.error('OAuth error:', { error })
+    }
+  }, [searchParams, router])
+
+  // Track when a new connection is added compared to previous render
+  useEffect(() => {
+    try {
+      const currentConnected = new Set<string>()
+      services.forEach((svc) => {
+        if (svc.isConnected) currentConnected.add(svc.id)
+      })
+      // Detect new connections by comparing to previous connected set
+      for (const id of currentConnected) {
+        if (!prevConnectedIdsRef.current.has(id)) {
+          connectionAddedRef.current = true
+          break
+        }
+      }
+      prevConnectedIdsRef.current = currentConnected
+    } catch {}
+  }, [services])
+
+  // On mount, register a close handler so the parent modal can delegate close events here
+  useEffect(() => {
+    if (!registerCloseHandler) return
+    const handle = (open: boolean) => {
+      if (open) return
+      try {
+        if (typeof window !== 'undefined') {
+          window.dispatchEvent(
+            new CustomEvent('oauth-integration-closed', {
+              detail: { success: connectionAddedRef.current === true },
+            })
+          )
+        }
+      } catch {}
+      onOpenChange?.(open)
+    }
+    registerCloseHandler(handle)
+  }, [registerCloseHandler, onOpenChange])
+
+  // Handle connect button click
+  const handleConnect = async (service: ServiceInfo) => {
+    try {
+      logger.info('Connecting service:', {
+        serviceId: service.id,
+        providerId: service.providerId,
+        scopes: service.scopes,
+      })
+
+      // better-auth will automatically redirect back to this URL after OAuth
+      await connectService.mutateAsync({
+        providerId: service.providerId,
+        callbackURL: window.location.href,
+      })
+    } catch (error) {
+      logger.error('OAuth connection error:', { error })
+    }
+  }
+
+  /**
+   * Opens the disconnect confirmation dialog for a service.
+   */
+  const handleDisconnect = (service: ServiceInfo, accountId: string) => {
+    setServiceToDisconnect({ service, accountId })
+    setShowDisconnectDialog(true)
+  }
+
+  /**
+   * Confirms and executes the service disconnection.
+   */
+  const confirmDisconnect = async () => {
+    if (!serviceToDisconnect) return
+
+    setShowDisconnectDialog(false)
+    const { service, accountId } = serviceToDisconnect
+    setServiceToDisconnect(null)
+
+    try {
+      await disconnectService.mutateAsync({
+        provider: service.providerId.split('-')[0],
+        providerId: service.providerId,
+        serviceId: service.id,
+        accountId,
+      })
+    } catch (error) {
+      logger.error('Error disconnecting service:', { error })
+    }
+  }
+
+  // Group services by provider, filtering by permission config
+  const groupedServices = services.reduce(
+    (acc, service) => {
+      // Filter based on allowedIntegrations
+      if (
+        permissionConfig.allowedIntegrations !== null &&
+        !permissionConfig.allowedIntegrations.includes(service.id)
+      ) {
+        return acc
+      }
+
+      // Find the provider for this service
+      const providerKey =
+        Object.keys(OAUTH_PROVIDERS).find((key) =>
+          Object.keys(OAUTH_PROVIDERS[key].services).includes(service.id)
+        ) || 'other'
+
+      if (!acc[providerKey]) {
+        acc[providerKey] = []
+      }
+
+      acc[providerKey].push(service)
+      return acc
+    },
+    {} as Record<string, ServiceInfo[]>
+  )
+
+  // Filter services based on search term
+  const filteredGroupedServices = Object.entries(groupedServices).reduce(
+    (acc, [providerKey, providerServices]) => {
+      const filteredServices = providerServices.filter(
+        (service) =>
+          service.name.toLowerCase().includes(searchTerm.toLowerCase()) ||
+          service.description.toLowerCase().includes(searchTerm.toLowerCase())
+      )
+
+      if (filteredServices.length > 0) {
+        acc[providerKey] = filteredServices
+      }
+
+      return acc
+    },
+    {} as Record<string, ServiceInfo[]>
+  )
+
+  const scrollToHighlightedService = () => {
+    if (pendingServiceRef.current) {
+      pendingServiceRef.current.scrollIntoView({
+        behavior: 'smooth',
+        block: 'center',
+      })
+    }
+  }
+
+  if (isPending) {
+    return <IntegrationsSkeleton />
+  }
+
+  return (
+    <>
+      <div className='flex h-full flex-col gap-[16px]'>
+        <div className='flex w-full items-center gap-[8px] rounded-[8px] border border-[var(--border)] bg-transparent px-[8px] py-[5px] transition-colors duration-100 dark:bg-[var(--surface-4)] dark:hover:border-[var(--border-1)] dark:hover:bg-[var(--surface-5)]'>
+          <Search className='h-[14px] w-[14px] flex-shrink-0 text-[var(--text-tertiary)]' />
+          <Input
+            placeholder='Search services...'
+            value={searchTerm}
+            onChange={(e) => setSearchTerm(e.target.value)}
+            className='h-auto flex-1 border-0 bg-transparent p-0 font-base leading-none placeholder:text-[var(--text-tertiary)] focus-visible:ring-0 focus-visible:ring-offset-0'
+          />
+        </div>
+
+        <div className='min-h-0 flex-1 overflow-y-auto'>
+          <div className='flex flex-col gap-[16px]'>
+            {authSuccess && (
+              <div className='flex items-center gap-[12px] rounded-[8px] border border-green-200 bg-green-50 p-[12px]'>
+                <Check className='h-4 w-4 flex-shrink-0 text-green-500' />
+                <p className='font-medium text-[13px] text-green-800'>
+                  Account connected successfully!
+                </p>
+              </div>
+            )}
+
+            {pendingService && showActionRequired && (
+              <div className='flex items-start gap-[12px] rounded-[8px] border border-[var(--border)] bg-[var(--bg)] p-[12px]'>
+                <ExternalLink className='mt-0.5 h-4 w-4 flex-shrink-0 text-[var(--text-muted)]' />
+                <div className='flex flex-1 flex-col gap-[8px]'>
+                  <p className='text-[13px] text-[var(--text-muted)]'>
+                    <span className='font-medium text-[var(--text-primary)]'>Action Required:</span>{' '}
+                    Please connect your account to enable the requested features.
+                  </p>
+                  <Button variant='outline' onClick={scrollToHighlightedService}>
+                    <span>Go to service</span>
+                    <ChevronDown className='h-3 w-3' />
+                  </Button>
+                </div>
+              </div>
+            )}
+
+            <div className='flex flex-col gap-[16px]'>
+              {Object.entries(filteredGroupedServices).map(([providerKey, providerServices]) => (
+                <div key={providerKey} className='flex flex-col gap-[8px]'>
+                  <Label className='text-[12px] text-[var(--text-tertiary)]'>
+                    {OAUTH_PROVIDERS[providerKey]?.name || 'Other Services'}
+                  </Label>
+                  {providerServices.map((service) => (
+                    <div
+                      key={service.id}
+                      className={cn(
+                        'flex items-center justify-between',
+                        pendingService === service.id &&
+                          '-m-[8px] rounded-[8px] bg-[var(--bg)] p-[8px]'
+                      )}
+                      ref={pendingService === service.id ? pendingServiceRef : undefined}
+                    >
+                      <div className='flex items-center gap-[12px]'>
+                        <div className='flex h-9 w-9 flex-shrink-0 items-center justify-center overflow-hidden rounded-[6px] bg-[var(--surface-5)]'>
+                          {createElement(service.icon, { className: 'h-4 w-4' })}
+                        </div>
+                        <div className='flex flex-col justify-center gap-[1px]'>
+                          <span className='font-medium text-[14px]'>{service.name}</span>
+                          {service.accounts && service.accounts.length > 0 ? (
+                            <p className='truncate text-[13px] text-[var(--text-muted)]'>
+                              {service.accounts.map((a) => a.name).join(', ')}
+                            </p>
+                          ) : (
+                            <p className='truncate text-[13px] text-[var(--text-muted)]'>
+                              {service.description}
+                            </p>
+                          )}
+                        </div>
+                      </div>
+
+                      {service.accounts && service.accounts.length > 0 ? (
+                        <Button
+                          variant='ghost'
+                          onClick={() => handleDisconnect(service, service.accounts![0].id)}
+                          disabled={disconnectService.isPending}
+                        >
+                          Disconnect
+                        </Button>
+                      ) : (
+                        <Button
+                          variant='tertiary'
+                          onClick={() => handleConnect(service)}
+                          disabled={connectService.isPending}
+                        >
+                          Connect
+                        </Button>
+                      )}
+                    </div>
+                  ))}
+                </div>
+              ))}
+
+              {searchTerm.trim() && Object.keys(filteredGroupedServices).length === 0 && (
+                <div className='py-[16px] text-center text-[13px] text-[var(--text-muted)]'>
+                  No services found matching "{searchTerm}"
+                </div>
+              )}
+            </div>
+          </div>
+        </div>
+      </div>
+
+      <Modal open={showDisconnectDialog} onOpenChange={setShowDisconnectDialog}>
+        <ModalContent size='sm'>
+          <ModalHeader>Disconnect Service</ModalHeader>
+          <ModalBody>
+            <p className='text-[12px] text-[var(--text-secondary)]'>
+              Are you sure you want to disconnect{' '}
+              <span className='font-medium text-[var(--text-primary)]'>
+                {serviceToDisconnect?.service.name}
+              </span>
+              ?{' '}
+              <span className='text-[var(--text-error)]'>
+                This will revoke access and you will need to reconnect to use this service.
+              </span>
+            </p>
+          </ModalBody>
+          <ModalFooter>
+            <Button variant='default' onClick={() => setShowDisconnectDialog(false)}>
+              Cancel
+            </Button>
+            <Button variant='destructive' onClick={confirmDisconnect}>
+              Disconnect
+            </Button>
+          </ModalFooter>
+        </ModalContent>
+      </Modal>
+    </>
+  )
+}

apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/settings-modal/components/subscription/components/index.ts

@@ -1,4 +1,3 @@
 export { CancelSubscription } from './cancel-subscription'
 export { CreditBalance } from './credit-balance'
 export { PlanCard, type PlanCardProps, type PlanFeature } from './plan-card'
-export { ReferralCode } from './referral-code'

apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/settings-modal/components/subscription/components/referral-code/index.ts

@@ -1 +0,0 @@
-export { ReferralCode } from './referral-code'

apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/settings-modal/components/subscription/components/referral-code/referral-code.tsx

@@ -1,103 +0,0 @@
-'use client'
-
-import { useState } from 'react'
-import { createLogger } from '@sim/logger'
-import { Button, Input, Label } from '@/components/emcn'
-
-const logger = createLogger('ReferralCode')
-
-interface ReferralCodeProps {
-  onRedeemComplete?: () => void
-}
-
-/**
- * Inline referral/promo code entry field with redeem button.
- * One-time use per account — shows success or "already redeemed" state.
- */
-export function ReferralCode({ onRedeemComplete }: ReferralCodeProps) {
-  const [code, setCode] = useState('')
-  const [isRedeeming, setIsRedeeming] = useState(false)
-  const [error, setError] = useState<string | null>(null)
-  const [success, setSuccess] = useState<{ bonusAmount: number } | null>(null)
-
-  const handleRedeem = async () => {
-    const trimmed = code.trim()
-    if (!trimmed || isRedeeming) return
-
-    setIsRedeeming(true)
-    setError(null)
-
-    try {
-      const response = await fetch('/api/referral-code/redeem', {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ code: trimmed }),
-      })
-
-      const data = await response.json()
-
-      if (!response.ok) {
-        throw new Error(data.error || 'Failed to redeem code')
-      }
-
-      if (data.redeemed) {
-        setSuccess({ bonusAmount: data.bonusAmount })
-        setCode('')
-        onRedeemComplete?.()
-      } else {
-        setError(data.error || 'Code could not be redeemed')
-      }
-    } catch (err) {
-      logger.error('Referral code redemption failed', { error: err })
-      setError(err instanceof Error ? err.message : 'Failed to redeem code')
-    } finally {
-      setIsRedeeming(false)
-    }
-  }
-
-  if (success) {
-    return (
-      <div className='flex items-center justify-between'>
-        <Label>Referral Code</Label>
-        <span className='text-[12px] text-[var(--text-secondary)]'>
-          +${success.bonusAmount} credits applied
-        </span>
-      </div>
-    )
-  }
-
-  return (
-    <div className='flex flex-col'>
-      <div className='flex items-center justify-between gap-[12px]'>
-        <Label className='shrink-0'>Referral Code</Label>
-        <div className='flex items-center gap-[8px]'>
-          <Input
-            type='text'
-            value={code}
-            onChange={(e) => {
-              setCode(e.target.value)
-              setError(null)
-            }}
-            onKeyDown={(e) => {
-              if (e.key === 'Enter') handleRedeem()
-            }}
-            placeholder='Enter code'
-            className='h-[32px] w-[140px] text-[12px]'
-            disabled={isRedeeming}
-          />
-          <Button
-            variant='active'
-            className='h-[32px] shrink-0 rounded-[6px] text-[12px]'
-            onClick={handleRedeem}
-            disabled={isRedeeming || !code.trim()}
-          >
-            {isRedeeming ? 'Redeeming...' : 'Redeem'}
-          </Button>
-        </div>
-      </div>
-      <div className='mt-[4px] min-h-[18px] text-right'>
-        {error && <span className='text-[11px] text-[var(--text-error)]'>{error}</span>}
-      </div>
-    </div>
-  )
-}

apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/settings-modal/components/subscription/subscription.tsx

@@ -17,7 +17,6 @@ import {
   CancelSubscription,
   CreditBalance,
   PlanCard,
-  ReferralCode,
 } from '@/app/workspace/[workspaceId]/w/components/sidebar/components/settings-modal/components/subscription/components'
 import {
   ENTERPRISE_PLAN_FEATURES,
@@ -550,10 +549,6 @@ export function Subscription() {
         />
       )}
 
-      {!subscription.isEnterprise && (
-        <ReferralCode onRedeemComplete={() => refetchSubscription()} />
-      )}
-
       {/* Next Billing Date - hidden from team members */}
       {subscription.isPaid &&
         subscriptionData?.data?.periodEnd &&

apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/settings-modal/settings-modal.tsx

@@ -1,6 +1,6 @@
 'use client'
 
-import { useCallback, useEffect, useMemo, useState } from 'react'
+import { useCallback, useEffect, useMemo, useRef, useState } from 'react'
 import * as DialogPrimitive from '@radix-ui/react-dialog'
 import * as VisuallyHidden from '@radix-ui/react-visually-hidden'
 import { useQueryClient } from '@tanstack/react-query'
@@ -20,6 +20,7 @@ import {
 import {
   Card,
   Connections,
+  FolderCode,
   HexSimple,
   Key,
   SModal,
@@ -44,11 +45,12 @@ import {
   BYOK,
   Copilot,
   CredentialSets,
-  Credentials,
   CustomTools,
   Debug,
+  EnvironmentVariables,
   FileUploads,
   General,
+  Integrations,
   MCP,
   Skills,
   Subscription,
@@ -78,8 +80,9 @@ interface SettingsModalProps {
 
 type SettingsSection =
   | 'general'
-  | 'credentials'
+  | 'environment'
   | 'template-profile'
+  | 'integrations'
   | 'credential-sets'
   | 'access-control'
   | 'apikeys'
@@ -153,10 +156,11 @@ const allNavigationItems: NavigationItem[] = [
     requiresHosted: true,
     requiresTeam: true,
   },
-  { id: 'credentials', label: 'Credentials', icon: Connections, section: 'tools' },
+  { id: 'integrations', label: 'Integrations', icon: Connections, section: 'tools' },
   { id: 'custom-tools', label: 'Custom Tools', icon: Wrench, section: 'tools' },
   { id: 'skills', label: 'Skills', icon: AgentSkillsIcon, section: 'tools' },
   { id: 'mcp', label: 'MCP Tools', icon: McpIcon, section: 'tools' },
+  { id: 'environment', label: 'Environment', icon: FolderCode, section: 'system' },
   { id: 'apikeys', label: 'API Keys', icon: Key, section: 'system' },
   { id: 'workflow-mcp-servers', label: 'MCP Servers', icon: Server, section: 'system' },
   {
@@ -214,6 +218,8 @@ export function SettingsModal({ open, onOpenChange }: SettingsModalProps) {
 
   const activeOrganization = organizationsData?.activeOrganization
   const { config: permissionConfig } = usePermissionConfig()
+  const environmentBeforeLeaveHandler = useRef<((onProceed: () => void) => void) | null>(null)
+  const integrationsCloseHandler = useRef<((open: boolean) => void) | null>(null)
 
   const userEmail = session?.user?.email
   const userId = session?.user?.id
@@ -250,6 +256,9 @@ export function SettingsModal({ open, onOpenChange }: SettingsModalProps) {
       if (item.id === 'apikeys' && permissionConfig.hideApiKeysTab) {
         return false
       }
+      if (item.id === 'environment' && permissionConfig.hideEnvironmentTab) {
+        return false
+      }
       if (item.id === 'files' && permissionConfig.hideFilesTab) {
         return false
       }
@@ -318,9 +327,26 @@ export function SettingsModal({ open, onOpenChange }: SettingsModalProps) {
     return activeSection
   }, [activeSection])
 
+  const registerEnvironmentBeforeLeaveHandler = useCallback(
+    (handler: (onProceed: () => void) => void) => {
+      environmentBeforeLeaveHandler.current = handler
+    },
+    []
+  )
+
+  const registerIntegrationsCloseHandler = useCallback((handler: (open: boolean) => void) => {
+    integrationsCloseHandler.current = handler
+  }, [])
+
   const handleSectionChange = useCallback(
     (sectionId: SettingsSection) => {
       if (sectionId === effectiveActiveSection) return
+
+      if (effectiveActiveSection === 'environment' && environmentBeforeLeaveHandler.current) {
+        environmentBeforeLeaveHandler.current(() => setActiveSection(sectionId))
+        return
+      }
+
       setActiveSection(sectionId)
     },
     [effectiveActiveSection]
@@ -449,9 +475,24 @@ export function SettingsModal({ open, onOpenChange }: SettingsModalProps) {
     }
   }
 
+  // Handle dialog close - delegate to environment component if it's active
   const handleDialogOpenChange = (newOpen: boolean) => {
+    if (
+      !newOpen &&
+      effectiveActiveSection === 'environment' &&
+      environmentBeforeLeaveHandler.current
+    ) {
+      environmentBeforeLeaveHandler.current(() => onOpenChange(false))
+    } else if (
+      !newOpen &&
+      effectiveActiveSection === 'integrations' &&
+      integrationsCloseHandler.current
+    ) {
+      integrationsCloseHandler.current(newOpen)
+    } else {
       onOpenChange(newOpen)
     }
+  }
 
   return (
     <SModal open={open} onOpenChange={handleDialogOpenChange}>
@@ -461,7 +502,7 @@ export function SettingsModal({ open, onOpenChange }: SettingsModalProps) {
         </VisuallyHidden.Root>
         <VisuallyHidden.Root>
           <DialogPrimitive.Description>
-            Configure your workspace settings, credentials, and preferences
+            Configure your workspace settings, environment variables, integrations, and preferences
           </DialogPrimitive.Description>
         </VisuallyHidden.Root>
 
@@ -498,10 +539,18 @@ export function SettingsModal({ open, onOpenChange }: SettingsModalProps) {
           </SModalMainHeader>
           <SModalMainBody>
             {effectiveActiveSection === 'general' && <General onOpenChange={onOpenChange} />}
-            {effectiveActiveSection === 'credentials' && (
+            {effectiveActiveSection === 'environment' && (
-              <Credentials onOpenChange={onOpenChange} />
+              <EnvironmentVariables
+                registerBeforeLeaveHandler={registerEnvironmentBeforeLeaveHandler}
+              />
             )}
             {effectiveActiveSection === 'template-profile' && <TemplateProfile />}
+            {effectiveActiveSection === 'integrations' && (
+              <Integrations
+                onOpenChange={onOpenChange}
+                registerCloseHandler={registerIntegrationsCloseHandler}
+              />
+            )}
             {effectiveActiveSection === 'credential-sets' && <CredentialSets />}
             {effectiveActiveSection === 'access-control' && <AccessControl />}
             {effectiveActiveSection === 'apikeys' && <ApiKeys onOpenChange={onOpenChange} />}

apps/sim/app/workspace/page.tsx

@@ -4,14 +4,12 @@ import { useEffect } from 'react'
 import { createLogger } from '@sim/logger'
 import { useRouter } from 'next/navigation'
 import { useSession } from '@/lib/auth/auth-client'
-import { useReferralAttribution } from '@/hooks/use-referral-attribution'
 
 const logger = createLogger('WorkspacePage')
 
 export default function WorkspacePage() {
   const router = useRouter()
   const { data: session, isPending } = useSession()
-  useReferralAttribution()
 
   useEffect(() => {
     const redirectToFirstWorkspace = async () => {

apps/sim/blocks/blocks/agent.ts

@@ -142,8 +142,6 @@ Return ONLY the JSON array.`,
       title: 'Google Cloud Account',
       type: 'oauth-input',
       serviceId: 'vertex-ai',
-      canonicalParamId: 'oauthCredential',
-      mode: 'basic',
       requiredScopes: ['https://www.googleapis.com/auth/cloud-platform'],
       placeholder: 'Select Google Cloud account',
       required: true,
@@ -152,19 +150,6 @@ Return ONLY the JSON array.`,
         value: providers.vertex.models,
       },
     },
-    {
-      id: 'manualCredential',
-      title: 'Google Cloud Account',
-      type: 'short-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'advanced',
-      placeholder: 'Enter credential ID',
-      required: true,
-      condition: {
-        field: 'model',
-        value: providers.vertex.models,
-      },
-    },
     {
       id: 'reasoningEffort',
       title: 'Reasoning Effort',
@@ -763,7 +748,6 @@ Example 3 (Array Input):
     apiKey: { type: 'string', description: 'Provider API key' },
     azureEndpoint: { type: 'string', description: 'Azure endpoint URL' },
     azureApiVersion: { type: 'string', description: 'Azure API version' },
-    oauthCredential: { type: 'string', description: 'OAuth credential for Vertex AI' },
     vertexProject: { type: 'string', description: 'Google Cloud project ID for Vertex AI' },
     vertexLocation: { type: 'string', description: 'Google Cloud location for Vertex AI' },
     bedrockAccessKeyId: { type: 'string', description: 'AWS Access Key ID for Bedrock' },

apps/sim/blocks/blocks/airtable.ts

@@ -32,8 +32,6 @@ export const AirtableBlock: BlockConfig<AirtableResponse> = {
       id: 'credential',
       title: 'Airtable Account',
       type: 'oauth-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'basic',
       serviceId: 'airtable',
       requiredScopes: [
         'data.records:read',
@@ -44,15 +42,6 @@ export const AirtableBlock: BlockConfig<AirtableResponse> = {
       placeholder: 'Select Airtable account',
       required: true,
     },
-    {
-      id: 'manualCredential',
-      title: 'Airtable Account',
-      type: 'short-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'advanced',
-      placeholder: 'Enter credential ID',
-      required: true,
-    },
     {
       id: 'baseId',
       title: 'Base ID',
@@ -230,7 +219,7 @@ Return ONLY the valid JSON object - no explanations, no markdown.`,
         }
       },
       params: (params) => {
-        const { oauthCredential, records, fields, ...rest } = params
+        const { credential, records, fields, ...rest } = params
         let parsedRecords: any | undefined
         let parsedFields: any | undefined
 
@@ -248,7 +237,7 @@ Return ONLY the valid JSON object - no explanations, no markdown.`,
 
         // Construct parameters based on operation
         const baseParams = {
-          credential: oauthCredential,
+          credential,
           ...rest,
         }
 
@@ -266,7 +255,7 @@ Return ONLY the valid JSON object - no explanations, no markdown.`,
   },
   inputs: {
     operation: { type: 'string', description: 'Operation to perform' },
-    oauthCredential: { type: 'string', description: 'Airtable access token' },
+    credential: { type: 'string', description: 'Airtable access token' },
     baseId: { type: 'string', description: 'Airtable base identifier' },
     tableId: { type: 'string', description: 'Airtable table identifier' },
     // Conditional inputs

apps/sim/blocks/blocks/asana.ts

@@ -32,22 +32,12 @@ export const AsanaBlock: BlockConfig<AsanaResponse> = {
       id: 'credential',
       title: 'Asana Account',
       type: 'oauth-input',
-      canonicalParamId: 'oauthCredential',
+
-      mode: 'basic',
       required: true,
       serviceId: 'asana',
       requiredScopes: ['default'],
       placeholder: 'Select Asana account',
     },
-    {
-      id: 'manualCredential',
-      title: 'Asana Account',
-      type: 'short-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'advanced',
-      placeholder: 'Enter credential ID',
-      required: true,
-    },
     {
       id: 'workspace',
       title: 'Workspace GID',
@@ -225,7 +215,7 @@ Return ONLY the date string in YYYY-MM-DD format - no explanations, no quotes, n
         }
       },
       params: (params) => {
-        const { oauthCredential, operation } = params
+        const { credential, operation } = params
 
         const projectsArray = params.projects
           ? params.projects
@@ -235,7 +225,7 @@ Return ONLY the date string in YYYY-MM-DD format - no explanations, no quotes, n
           : undefined
 
         const baseParams = {
-          accessToken: oauthCredential?.accessToken,
+          accessToken: credential?.accessToken,
         }
 
         switch (operation) {
@@ -294,7 +284,6 @@ Return ONLY the date string in YYYY-MM-DD format - no explanations, no quotes, n
   },
   inputs: {
     operation: { type: 'string', description: 'Operation to perform' },
-    oauthCredential: { type: 'string', description: 'Asana OAuth credential' },
     workspace: { type: 'string', description: 'Workspace GID' },
     taskGid: { type: 'string', description: 'Task GID' },
     getTasks_workspace: { type: 'string', description: 'Workspace GID for getting tasks' },

apps/sim/blocks/blocks/calcom.ts

@@ -49,20 +49,9 @@ export const CalComBlock: BlockConfig<ToolResponse> = {
       title: 'Cal.com Account',
       type: 'oauth-input',
       serviceId: 'calcom',
-      canonicalParamId: 'oauthCredential',
-      mode: 'basic',
       placeholder: 'Select Cal.com account',
       required: true,
     },
-    {
-      id: 'manualCredential',
-      title: 'Cal.com Account',
-      type: 'short-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'advanced',
-      placeholder: 'Enter credential ID',
-      required: true,
-    },
 
     // === Create Booking fields ===
     {
@@ -566,7 +555,7 @@ Return ONLY valid JSON - no explanations.`,
       params: (params) => {
         const {
           operation,
-          oauthCredential,
+          credential,
           attendeeName,
           attendeeEmail,
           attendeeTimeZone,
@@ -756,7 +745,7 @@ Return ONLY valid JSON - no explanations.`,
   },
   inputs: {
     operation: { type: 'string', description: 'Operation to perform' },
-    oauthCredential: { type: 'string', description: 'Cal.com OAuth credential' },
+    credential: { type: 'string', description: 'Cal.com OAuth credential' },
     eventTypeId: { type: 'number', description: 'Event type ID' },
     start: { type: 'string', description: 'Start time (ISO 8601)' },
     end: { type: 'string', description: 'End time (ISO 8601)' },

apps/sim/blocks/blocks/confluence.ts

@@ -51,8 +51,6 @@ export const ConfluenceBlock: BlockConfig<ConfluenceResponse> = {
       id: 'credential',
       title: 'Confluence Account',
       type: 'oauth-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'basic',
       serviceId: 'confluence',
       requiredScopes: [
         'read:confluence-content.all',
@@ -87,15 +85,6 @@ export const ConfluenceBlock: BlockConfig<ConfluenceResponse> = {
       placeholder: 'Select Confluence account',
       required: true,
     },
-    {
-      id: 'manualCredential',
-      title: 'Confluence Account',
-      type: 'short-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'advanced',
-      placeholder: 'Enter credential ID',
-      required: true,
-    },
     {
       id: 'pageId',
       title: 'Select Page',
@@ -298,7 +287,7 @@ export const ConfluenceBlock: BlockConfig<ConfluenceResponse> = {
       },
       params: (params) => {
         const {
-          oauthCredential,
+          credential,
           pageId,
           operation,
           attachmentFile,
@@ -311,7 +300,7 @@ export const ConfluenceBlock: BlockConfig<ConfluenceResponse> = {
 
         if (operation === 'upload_attachment') {
           return {
-            credential: oauthCredential,
+            credential,
             pageId: effectivePageId,
             operation,
             file: attachmentFile,
@@ -322,7 +311,7 @@ export const ConfluenceBlock: BlockConfig<ConfluenceResponse> = {
         }
 
         return {
-          credential: oauthCredential,
+          credential,
           pageId: effectivePageId || undefined,
           operation,
           ...rest,
@@ -333,7 +322,7 @@ export const ConfluenceBlock: BlockConfig<ConfluenceResponse> = {
   inputs: {
     operation: { type: 'string', description: 'Operation to perform' },
     domain: { type: 'string', description: 'Confluence domain' },
-    oauthCredential: { type: 'string', description: 'Confluence access token' },
+    credential: { type: 'string', description: 'Confluence access token' },
     pageId: { type: 'string', description: 'Page identifier (canonical param)' },
     spaceId: { type: 'string', description: 'Space identifier' },
     title: { type: 'string', description: 'Page title' },
@@ -439,8 +428,6 @@ export const ConfluenceV2Block: BlockConfig<ConfluenceResponse> = {
       id: 'credential',
       title: 'Confluence Account',
       type: 'oauth-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'basic',
       serviceId: 'confluence',
       requiredScopes: [
         'read:confluence-content.all',
@@ -475,15 +462,6 @@ export const ConfluenceV2Block: BlockConfig<ConfluenceResponse> = {
       placeholder: 'Select Confluence account',
       required: true,
     },
-    {
-      id: 'manualCredential',
-      title: 'Confluence Account',
-      type: 'short-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'advanced',
-      placeholder: 'Enter credential ID',
-      required: true,
-    },
     {
       id: 'domain',
       title: 'Domain',
@@ -965,7 +943,7 @@ export const ConfluenceV2Block: BlockConfig<ConfluenceResponse> = {
       },
       params: (params) => {
         const {
-          oauthCredential,
+          credential,
           pageId,
           operation,
           attachmentFile,
@@ -990,7 +968,7 @@ export const ConfluenceV2Block: BlockConfig<ConfluenceResponse> = {
 
         if (operation === 'add_label') {
           return {
-            credential: oauthCredential,
+            credential,
             pageId: effectivePageId,
             operation,
             prefix: labelPrefix || 'global',
@@ -1000,7 +978,7 @@ export const ConfluenceV2Block: BlockConfig<ConfluenceResponse> = {
 
         if (operation === 'create_blogpost') {
           return {
-            credential: oauthCredential,
+            credential,
             operation,
             status: blogPostStatus || 'current',
             ...rest,
@@ -1009,7 +987,7 @@ export const ConfluenceV2Block: BlockConfig<ConfluenceResponse> = {
 
         if (operation === 'delete') {
           return {
-            credential: oauthCredential,
+            credential,
             pageId: effectivePageId,
             operation,
             purge: purge || false,
@@ -1019,7 +997,7 @@ export const ConfluenceV2Block: BlockConfig<ConfluenceResponse> = {
 
         if (operation === 'list_comments') {
           return {
-            credential: oauthCredential,
+            credential,
             pageId: effectivePageId,
             operation,
             bodyFormat: bodyFormat || 'storage',
@@ -1045,7 +1023,7 @@ export const ConfluenceV2Block: BlockConfig<ConfluenceResponse> = {
 
         if (supportsCursor.includes(operation) && cursor) {
           return {
-            credential: oauthCredential,
+            credential,
             pageId: effectivePageId || undefined,
             operation,
             cursor,
@@ -1058,7 +1036,7 @@ export const ConfluenceV2Block: BlockConfig<ConfluenceResponse> = {
             throw new Error('Property key is required for this operation.')
           }
           return {
-            credential: oauthCredential,
+            credential,
             pageId: effectivePageId,
             operation,
             key: propertyKey,
@@ -1069,7 +1047,7 @@ export const ConfluenceV2Block: BlockConfig<ConfluenceResponse> = {
 
         if (operation === 'delete_page_property') {
           return {
-            credential: oauthCredential,
+            credential,
             pageId: effectivePageId,
             operation,
             propertyId,
@@ -1079,7 +1057,7 @@ export const ConfluenceV2Block: BlockConfig<ConfluenceResponse> = {
 
         if (operation === 'get_pages_by_label') {
           return {
-            credential: oauthCredential,
+            credential,
             operation,
             labelId,
             cursor: cursor || undefined,
@@ -1089,7 +1067,7 @@ export const ConfluenceV2Block: BlockConfig<ConfluenceResponse> = {
 
         if (operation === 'list_space_labels') {
           return {
-            credential: oauthCredential,
+            credential,
             operation,
             cursor: cursor || undefined,
             ...rest,
@@ -1102,7 +1080,7 @@ export const ConfluenceV2Block: BlockConfig<ConfluenceResponse> = {
             throw new Error('File is required for upload attachment operation.')
           }
           return {
-            credential: oauthCredential,
+            credential,
             pageId: effectivePageId,
             operation,
             file: normalizedFile,
@@ -1113,7 +1091,7 @@ export const ConfluenceV2Block: BlockConfig<ConfluenceResponse> = {
         }
 
         return {
-          credential: oauthCredential,
+          credential,
           pageId: effectivePageId || undefined,
           blogPostId: blogPostId || undefined,
           versionNumber: versionNumber ? Number.parseInt(String(versionNumber), 10) : undefined,
@@ -1126,7 +1104,7 @@ export const ConfluenceV2Block: BlockConfig<ConfluenceResponse> = {
   inputs: {
     operation: { type: 'string', description: 'Operation to perform' },
     domain: { type: 'string', description: 'Confluence domain' },
-    oauthCredential: { type: 'string', description: 'Confluence access token' },
+    credential: { type: 'string', description: 'Confluence access token' },
     pageId: { type: 'string', description: 'Page identifier (canonical param)' },
     spaceId: { type: 'string', description: 'Space identifier' },
     blogPostId: { type: 'string', description: 'Blog post identifier' },

apps/sim/blocks/blocks/dropbox.ts

@@ -38,8 +38,6 @@ export const DropboxBlock: BlockConfig<DropboxResponse> = {
       id: 'credential',
       title: 'Dropbox Account',
       type: 'oauth-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'basic',
       serviceId: 'dropbox',
       requiredScopes: [
         'account_info.read',
@@ -53,15 +51,6 @@ export const DropboxBlock: BlockConfig<DropboxResponse> = {
       placeholder: 'Select Dropbox account',
       required: true,
     },
-    {
-      id: 'manualCredential',
-      title: 'Dropbox Account',
-      type: 'short-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'advanced',
-      placeholder: 'Enter credential ID',
-      required: true,
-    },
     // Upload operation inputs
     {
       id: 'path',
@@ -363,7 +352,7 @@ Return ONLY the timestamp string - no explanations, no quotes, no extra text.`,
   },
   inputs: {
     operation: { type: 'string', description: 'Operation to perform' },
-    oauthCredential: { type: 'string', description: 'Dropbox OAuth credential' },
+    credential: { type: 'string', description: 'Dropbox OAuth credential' },
     // Common inputs
     path: { type: 'string', description: 'Path in Dropbox' },
     autorename: { type: 'boolean', description: 'Auto-rename on conflict' },

apps/sim/blocks/blocks/gmail.ts

@@ -76,8 +76,6 @@ export const GmailBlock: BlockConfig<GmailToolResponse> = {
       id: 'credential',
       title: 'Gmail Account',
       type: 'oauth-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'basic',
       serviceId: 'gmail',
       requiredScopes: [
         'https://www.googleapis.com/auth/gmail.send',
@@ -87,15 +85,6 @@ export const GmailBlock: BlockConfig<GmailToolResponse> = {
       placeholder: 'Select Gmail account',
       required: true,
     },
-    {
-      id: 'manualCredential',
-      title: 'Gmail Account',
-      type: 'short-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'advanced',
-      placeholder: 'Enter credential ID',
-      required: true,
-    },
     // Send Email Fields
     {
       id: 'to',
@@ -417,7 +406,7 @@ Return ONLY the search query - no explanations, no extra text.`,
       tool: selectGmailToolId,
       params: (params) => {
         const {
-          oauthCredential,
+          credential,
           folder,
           addLabelIds,
           removeLabelIds,
@@ -478,7 +467,7 @@ Return ONLY the search query - no explanations, no extra text.`,
 
         return {
           ...rest,
-          oauthCredential,
+          credential,
           ...(normalizedAttachments && { attachments: normalizedAttachments }),
         }
       },
@@ -486,7 +475,7 @@ Return ONLY the search query - no explanations, no extra text.`,
   },
   inputs: {
     operation: { type: 'string', description: 'Operation to perform' },
-    oauthCredential: { type: 'string', description: 'Gmail access token' },
+    credential: { type: 'string', description: 'Gmail access token' },
     // Send operation inputs
     to: { type: 'string', description: 'Recipient email address' },
     subject: { type: 'string', description: 'Email subject' },

apps/sim/blocks/blocks/google_books.ts

@@ -1,201 +0,0 @@
-import { GoogleBooksIcon } from '@/components/icons'
-import type { BlockConfig } from '@/blocks/types'
-import { AuthMode } from '@/blocks/types'
-
-export const GoogleBooksBlock: BlockConfig = {
-  type: 'google_books',
-  name: 'Google Books',
-  description: 'Search and retrieve book information',
-  authMode: AuthMode.ApiKey,
-  longDescription:
-    'Search for books using the Google Books API. Find volumes by title, author, ISBN, or keywords, and retrieve detailed information about specific books including descriptions, ratings, and publication details.',
-  docsLink: 'https://docs.sim.ai/tools/google_books',
-  category: 'tools',
-  bgColor: '#E0E0E0',
-  icon: GoogleBooksIcon,
-
-  subBlocks: [
-    {
-      id: 'operation',
-      title: 'Operation',
-      type: 'dropdown',
-      options: [
-        { label: 'Search Volumes', id: 'volume_search' },
-        { label: 'Get Volume Details', id: 'volume_details' },
-      ],
-      value: () => 'volume_search',
-    },
-    {
-      id: 'apiKey',
-      title: 'API Key',
-      type: 'short-input',
-      password: true,
-      placeholder: 'Enter your Google Books API key',
-      required: true,
-    },
-    {
-      id: 'query',
-      title: 'Search Query',
-      type: 'short-input',
-      placeholder: 'e.g., intitle:harry potter inauthor:rowling',
-      condition: { field: 'operation', value: 'volume_search' },
-      required: { field: 'operation', value: 'volume_search' },
-    },
-    {
-      id: 'filter',
-      title: 'Filter',
-      type: 'dropdown',
-      options: [
-        { label: 'None', id: '' },
-        { label: 'Partial Preview', id: 'partial' },
-        { label: 'Full Preview', id: 'full' },
-        { label: 'Free eBooks', id: 'free-ebooks' },
-        { label: 'Paid eBooks', id: 'paid-ebooks' },
-        { label: 'All eBooks', id: 'ebooks' },
-      ],
-      condition: { field: 'operation', value: 'volume_search' },
-      mode: 'advanced',
-    },
-    {
-      id: 'printType',
-      title: 'Print Type',
-      type: 'dropdown',
-      options: [
-        { label: 'All', id: 'all' },
-        { label: 'Books', id: 'books' },
-        { label: 'Magazines', id: 'magazines' },
-      ],
-      value: () => 'all',
-      condition: { field: 'operation', value: 'volume_search' },
-      mode: 'advanced',
-    },
-    {
-      id: 'orderBy',
-      title: 'Order By',
-      type: 'dropdown',
-      options: [
-        { label: 'Relevance', id: 'relevance' },
-        { label: 'Newest', id: 'newest' },
-      ],
-      value: () => 'relevance',
-      condition: { field: 'operation', value: 'volume_search' },
-      mode: 'advanced',
-    },
-    {
-      id: 'maxResults',
-      title: 'Max Results',
-      type: 'short-input',
-      placeholder: 'Number of results (1-40)',
-      condition: { field: 'operation', value: 'volume_search' },
-      mode: 'advanced',
-    },
-    {
-      id: 'startIndex',
-      title: 'Start Index',
-      type: 'short-input',
-      placeholder: 'Starting index for pagination',
-      condition: { field: 'operation', value: 'volume_search' },
-      mode: 'advanced',
-    },
-    {
-      id: 'langRestrict',
-      title: 'Language',
-      type: 'short-input',
-      placeholder: 'ISO 639-1 code (e.g., en, es, fr)',
-      condition: { field: 'operation', value: 'volume_search' },
-      mode: 'advanced',
-    },
-    {
-      id: 'volumeId',
-      title: 'Volume ID',
-      type: 'short-input',
-      placeholder: 'Google Books volume ID',
-      condition: { field: 'operation', value: 'volume_details' },
-      required: { field: 'operation', value: 'volume_details' },
-    },
-    {
-      id: 'projection',
-      title: 'Projection',
-      type: 'dropdown',
-      options: [
-        { label: 'Full', id: 'full' },
-        { label: 'Lite', id: 'lite' },
-      ],
-      value: () => 'full',
-      condition: { field: 'operation', value: 'volume_details' },
-      mode: 'advanced',
-    },
-  ],
-
-  tools: {
-    access: ['google_books_volume_search', 'google_books_volume_details'],
-    config: {
-      tool: (params) => `google_books_${params.operation}`,
-      params: (params) => {
-        const { operation, ...rest } = params
-
-        let maxResults: number | undefined
-        if (params.maxResults) {
-          maxResults = Number.parseInt(params.maxResults, 10)
-          if (Number.isNaN(maxResults)) {
-            maxResults = undefined
-          }
-        }
-
-        let startIndex: number | undefined
-        if (params.startIndex) {
-          startIndex = Number.parseInt(params.startIndex, 10)
-          if (Number.isNaN(startIndex)) {
-            startIndex = undefined
-          }
-        }
-
-        return {
-          ...rest,
-          maxResults,
-          startIndex,
-          filter: params.filter || undefined,
-          printType: params.printType || undefined,
-          orderBy: params.orderBy || undefined,
-          projection: params.projection || undefined,
-        }
-      },
-    },
-  },
-
-  inputs: {
-    operation: { type: 'string', description: 'Operation to perform' },
-    apiKey: { type: 'string', description: 'Google Books API key' },
-    query: { type: 'string', description: 'Search query' },
-    filter: { type: 'string', description: 'Filter by availability' },
-    printType: { type: 'string', description: 'Print type filter' },
-    orderBy: { type: 'string', description: 'Sort order' },
-    maxResults: { type: 'string', description: 'Maximum number of results' },
-    startIndex: { type: 'string', description: 'Starting index for pagination' },
-    langRestrict: { type: 'string', description: 'Language restriction' },
-    volumeId: { type: 'string', description: 'Volume ID for details' },
-    projection: { type: 'string', description: 'Projection level' },
-  },
-
-  outputs: {
-    totalItems: { type: 'number', description: 'Total number of matching results' },
-    volumes: { type: 'json', description: 'List of matching volumes' },
-    id: { type: 'string', description: 'Volume ID' },
-    title: { type: 'string', description: 'Book title' },
-    subtitle: { type: 'string', description: 'Book subtitle' },
-    authors: { type: 'json', description: 'List of authors' },
-    publisher: { type: 'string', description: 'Publisher name' },
-    publishedDate: { type: 'string', description: 'Publication date' },
-    description: { type: 'string', description: 'Book description' },
-    pageCount: { type: 'number', description: 'Number of pages' },
-    categories: { type: 'json', description: 'Book categories' },
-    averageRating: { type: 'number', description: 'Average rating (1-5)' },
-    ratingsCount: { type: 'number', description: 'Number of ratings' },
-    language: { type: 'string', description: 'Language code' },
-    previewLink: { type: 'string', description: 'Link to preview on Google Books' },
-    infoLink: { type: 'string', description: 'Link to info page' },
-    thumbnailUrl: { type: 'string', description: 'Book cover thumbnail URL' },
-    isbn10: { type: 'string', description: 'ISBN-10 identifier' },
-    isbn13: { type: 'string', description: 'ISBN-13 identifier' },
-  },
-}

apps/sim/blocks/blocks/google_calendar.ts

@@ -39,22 +39,11 @@ export const GoogleCalendarBlock: BlockConfig<GoogleCalendarResponse> = {
       id: 'credential',
       title: 'Google Calendar Account',
       type: 'oauth-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'basic',
       required: true,
       serviceId: 'google-calendar',
       requiredScopes: ['https://www.googleapis.com/auth/calendar'],
       placeholder: 'Select Google Calendar account',
     },
-    {
-      id: 'manualCredential',
-      title: 'Google Calendar Account',
-      type: 'short-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'advanced',
-      placeholder: 'Enter credential ID',
-      required: true,
-    },
     // Calendar selector (basic mode) - not needed for list_calendars
     {
       id: 'calendarId',
@@ -523,7 +512,7 @@ Return ONLY the natural language event text - no explanations.`,
       },
       params: (params) => {
         const {
-          oauthCredential,
+          credential,
           operation,
           attendees,
           replaceExisting,
@@ -587,7 +576,7 @@ Return ONLY the natural language event text - no explanations.`,
         }
 
         return {
-          oauthCredential,
+          credential,
           ...processedParams,
         }
       },
@@ -595,7 +584,7 @@ Return ONLY the natural language event text - no explanations.`,
   },
   inputs: {
     operation: { type: 'string', description: 'Operation to perform' },
-    oauthCredential: { type: 'string', description: 'Google Calendar access token' },
+    credential: { type: 'string', description: 'Google Calendar access token' },
     calendarId: { type: 'string', description: 'Calendar identifier (canonical param)' },
 
     // Create/Update operation inputs

apps/sim/blocks/blocks/google_docs.ts

@@ -32,8 +32,6 @@ export const GoogleDocsBlock: BlockConfig<GoogleDocsResponse> = {
       id: 'credential',
       title: 'Google Account',
       type: 'oauth-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'basic',
       required: true,
       serviceId: 'google-docs',
       requiredScopes: [
@@ -42,15 +40,6 @@ export const GoogleDocsBlock: BlockConfig<GoogleDocsResponse> = {
       ],
       placeholder: 'Select Google account',
     },
-    {
-      id: 'manualCredential',
-      title: 'Google Account',
-      type: 'short-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'advanced',
-      placeholder: 'Enter credential ID',
-      required: true,
-    },
     // Document selector (basic mode)
     {
       id: 'documentId',
@@ -168,7 +157,7 @@ Return ONLY the document content - no explanations, no extra text.`,
         }
       },
       params: (params) => {
-        const { oauthCredential, documentId, folderId, ...rest } = params
+        const { credential, documentId, folderId, ...rest } = params
 
         const effectiveDocumentId = documentId ? String(documentId).trim() : ''
         const effectiveFolderId = folderId ? String(folderId).trim() : ''
@@ -177,14 +166,14 @@ Return ONLY the document content - no explanations, no extra text.`,
           ...rest,
           documentId: effectiveDocumentId || undefined,
           folderId: effectiveFolderId || undefined,
-          oauthCredential,
+          credential,
         }
       },
     },
   },
   inputs: {
     operation: { type: 'string', description: 'Operation to perform' },
-    oauthCredential: { type: 'string', description: 'Google Docs access token' },
+    credential: { type: 'string', description: 'Google Docs access token' },
     documentId: { type: 'string', description: 'Document identifier (canonical param)' },
     title: { type: 'string', description: 'Document title' },
     folderId: { type: 'string', description: 'Parent folder identifier (canonical param)' },

apps/sim/blocks/blocks/google_drive.ts

@@ -44,8 +44,6 @@ export const GoogleDriveBlock: BlockConfig<GoogleDriveResponse> = {
       id: 'credential',
       title: 'Google Drive Account',
       type: 'oauth-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'basic',
       required: true,
       serviceId: 'google-drive',
       requiredScopes: [
@@ -54,15 +52,6 @@ export const GoogleDriveBlock: BlockConfig<GoogleDriveResponse> = {
       ],
       placeholder: 'Select Google Drive account',
     },
-    {
-      id: 'manualCredential',
-      title: 'Google Drive Account',
-      type: 'short-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'advanced',
-      placeholder: 'Enter credential ID',
-      required: true,
-    },
     // Create/Upload File Fields
     {
       id: 'fileName',
@@ -797,7 +786,7 @@ Return ONLY the message text - no subject line, no greetings/signatures, no extr
       },
       params: (params) => {
         const {
-          oauthCredential,
+          credential,
           // Folder canonical params (per-operation)
           uploadFolderId,
           createFolderParentId,
@@ -884,7 +873,7 @@ Return ONLY the message text - no subject line, no greetings/signatures, no extr
           sendNotification === 'true' ? true : sendNotification === 'false' ? false : undefined
 
         return {
-          oauthCredential,
+          credential,
           folderId: effectiveFolderId,
           fileId: effectiveFileId,
           destinationFolderId: effectiveDestinationFolderId,
@@ -902,7 +891,7 @@ Return ONLY the message text - no subject line, no greetings/signatures, no extr
   },
   inputs: {
     operation: { type: 'string', description: 'Operation to perform' },
-    oauthCredential: { type: 'string', description: 'Google Drive access token' },
+    credential: { type: 'string', description: 'Google Drive access token' },
     // Folder canonical params (per-operation)
     uploadFolderId: { type: 'string', description: 'Parent folder for upload/create' },
     createFolderParentId: { type: 'string', description: 'Parent folder for create folder' },

apps/sim/blocks/blocks/google_forms.ts

@@ -34,8 +34,6 @@ export const GoogleFormsBlock: BlockConfig = {
       id: 'credential',
       title: 'Google Account',
       type: 'oauth-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'basic',
       required: true,
       serviceId: 'google-forms',
       requiredScopes: [
@@ -47,15 +45,6 @@ export const GoogleFormsBlock: BlockConfig = {
       ],
       placeholder: 'Select Google account',
     },
-    {
-      id: 'manualCredential',
-      title: 'Google Account',
-      type: 'short-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'advanced',
-      placeholder: 'Enter credential ID',
-      required: true,
-    },
     // Form selector (basic mode)
     {
       id: 'formSelector',
@@ -244,7 +233,7 @@ Example for "Add a required multiple choice question about favorite color":
       },
       params: (params) => {
         const {
-          oauthCredential,
+          credential,
           operation,
           formId, // Canonical param from formSelector (basic) or manualFormId (advanced)
           responseId,
@@ -262,7 +251,7 @@ Example for "Add a required multiple choice question about favorite color":
           ...rest
         } = params
 
-        const baseParams = { ...rest, oauthCredential }
+        const baseParams = { ...rest, credential }
         const effectiveFormId = formId ? String(formId).trim() : undefined
 
         switch (operation) {
@@ -320,7 +309,7 @@ Example for "Add a required multiple choice question about favorite color":
   },
   inputs: {
     operation: { type: 'string', description: 'Operation to perform' },
-    oauthCredential: { type: 'string', description: 'Google OAuth credential' },
+    credential: { type: 'string', description: 'Google OAuth credential' },
     formId: { type: 'string', description: 'Google Form ID' },
     responseId: { type: 'string', description: 'Specific response ID' },
     pageSize: { type: 'string', description: 'Max responses to retrieve' },

apps/sim/blocks/blocks/google_groups.ts

@@ -42,8 +42,6 @@ export const GoogleGroupsBlock: BlockConfig = {
       id: 'credential',
       title: 'Google Groups Account',
       type: 'oauth-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'basic',
       required: true,
       serviceId: 'google-groups',
       requiredScopes: [
@@ -52,15 +50,6 @@ export const GoogleGroupsBlock: BlockConfig = {
       ],
       placeholder: 'Select Google Workspace account',
     },
-    {
-      id: 'manualCredential',
-      title: 'Google Groups Account',
-      type: 'short-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'advanced',
-      placeholder: 'Enter credential ID',
-      required: true,
-    },
 
     {
       id: 'customer',
@@ -322,12 +311,12 @@ Return ONLY the description text - no explanations, no quotes, no extra text.`,
         }
       },
       params: (params) => {
-        const { oauthCredential, operation, ...rest } = params
+        const { credential, operation, ...rest } = params
 
         switch (operation) {
           case 'list_groups':
             return {
-              oauthCredential,
+              credential,
               customer: rest.customer,
               domain: rest.domain,
               query: rest.query,
@@ -336,19 +325,19 @@ Return ONLY the description text - no explanations, no quotes, no extra text.`,
           case 'get_group':
           case 'delete_group':
             return {
-              credential: oauthCredential,
+              credential,
               groupKey: rest.groupKey,
             }
           case 'create_group':
             return {
-              credential: oauthCredential,
+              credential,
               email: rest.email,
               name: rest.name,
               description: rest.description,
             }
           case 'update_group':
             return {
-              credential: oauthCredential,
+              credential,
               groupKey: rest.groupKey,
               name: rest.newName,
               email: rest.newEmail,
@@ -356,7 +345,7 @@ Return ONLY the description text - no explanations, no quotes, no extra text.`,
             }
           case 'list_members':
             return {
-              credential: oauthCredential,
+              credential,
               groupKey: rest.groupKey,
               maxResults: rest.maxResults ? Number(rest.maxResults) : undefined,
               roles: rest.roles,
@@ -364,66 +353,66 @@ Return ONLY the description text - no explanations, no quotes, no extra text.`,
           case 'get_member':
           case 'remove_member':
             return {
-              credential: oauthCredential,
+              credential,
               groupKey: rest.groupKey,
               memberKey: rest.memberKey,
             }
           case 'add_member':
             return {
-              credential: oauthCredential,
+              credential,
               groupKey: rest.groupKey,
               email: rest.memberEmail,
               role: rest.role,
             }
           case 'update_member':
             return {
-              credential: oauthCredential,
+              credential,
               groupKey: rest.groupKey,
               memberKey: rest.memberKey,
               role: rest.role,
             }
           case 'has_member':
             return {
-              credential: oauthCredential,
+              credential,
               groupKey: rest.groupKey,
               memberKey: rest.memberKey,
             }
           case 'list_aliases':
             return {
-              credential: oauthCredential,
+              credential,
               groupKey: rest.groupKey,
             }
           case 'add_alias':
             return {
-              credential: oauthCredential,
+              credential,
               groupKey: rest.groupKey,
               alias: rest.alias,
             }
           case 'remove_alias':
             return {
-              oauthCredential,
+              credential,
               groupKey: rest.groupKey,
               alias: rest.alias,
             }
           case 'get_settings':
             return {
-              oauthCredential,
+              credential,
               groupEmail: rest.groupEmail,
             }
           case 'update_settings':
             return {
-              oauthCredential,
+              credential,
               groupEmail: rest.groupEmail,
             }
           default:
-            return { oauthCredential, ...rest }
+            return { credential, ...rest }
         }
       },
     },
   },
   inputs: {
     operation: { type: 'string', description: 'Operation to perform' },
-    oauthCredential: { type: 'string', description: 'Google Workspace OAuth credential' },
+    credential: { type: 'string', description: 'Google Workspace OAuth credential' },
     customer: { type: 'string', description: 'Customer ID for listing groups' },
     domain: { type: 'string', description: 'Domain filter for listing groups' },
     query: { type: 'string', description: 'Search query for filtering groups' },

apps/sim/blocks/blocks/google_sheets.ts

@@ -36,8 +36,6 @@ export const GoogleSheetsBlock: BlockConfig<GoogleSheetsResponse> = {
       id: 'credential',
       title: 'Google Account',
       type: 'oauth-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'basic',
       required: true,
       serviceId: 'google-sheets',
       requiredScopes: [
@@ -46,15 +44,6 @@ export const GoogleSheetsBlock: BlockConfig<GoogleSheetsResponse> = {
       ],
       placeholder: 'Select Google account',
     },
-    {
-      id: 'manualCredential',
-      title: 'Google Account',
-      type: 'short-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'advanced',
-      placeholder: 'Enter credential ID',
-      required: true,
-    },
     // Spreadsheet Selector
     {
       id: 'spreadsheetId',
@@ -257,7 +246,7 @@ Return ONLY the JSON array - no explanations, no markdown, no extra text.`,
         }
       },
       params: (params) => {
-        const { oauthCredential, values, spreadsheetId, ...rest } = params
+        const { credential, values, spreadsheetId, ...rest } = params
 
         const parsedValues = values ? JSON.parse(values as string) : undefined
 
@@ -271,14 +260,14 @@ Return ONLY the JSON array - no explanations, no markdown, no extra text.`,
           ...rest,
           spreadsheetId: effectiveSpreadsheetId,
           values: parsedValues,
-          oauthCredential,
+          credential,
         }
       },
     },
   },
   inputs: {
     operation: { type: 'string', description: 'Operation to perform' },
-    oauthCredential: { type: 'string', description: 'Google Sheets access token' },
+    credential: { type: 'string', description: 'Google Sheets access token' },
     spreadsheetId: { type: 'string', description: 'Spreadsheet identifier (canonical param)' },
     range: { type: 'string', description: 'Cell range' },
     values: { type: 'string', description: 'Cell values data' },
@@ -334,8 +323,6 @@ export const GoogleSheetsV2Block: BlockConfig<GoogleSheetsV2Response> = {
       id: 'credential',
       title: 'Google Account',
       type: 'oauth-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'basic',
       required: true,
       serviceId: 'google-sheets',
       requiredScopes: [
@@ -344,15 +331,6 @@ export const GoogleSheetsV2Block: BlockConfig<GoogleSheetsV2Response> = {
       ],
       placeholder: 'Select Google account',
     },
-    {
-      id: 'manualCredential',
-      title: 'Google Account',
-      type: 'short-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'advanced',
-      placeholder: 'Enter credential ID',
-      required: true,
-    },
     // Spreadsheet Selector (basic mode) - not for create operation
     {
       id: 'spreadsheetId',
@@ -737,7 +715,7 @@ Return ONLY the JSON array - no explanations, no markdown, no extra text.`,
       }),
       params: (params) => {
         const {
-          oauthCredential,
+          credential,
           values,
           spreadsheetId,
           sheetName,
@@ -761,7 +739,7 @@ Return ONLY the JSON array - no explanations, no markdown, no extra text.`,
           return {
             title: (title as string)?.trim(),
             sheetTitles: sheetTitlesArray,
-            oauthCredential,
+            credential,
           }
         }
 
@@ -775,7 +753,7 @@ Return ONLY the JSON array - no explanations, no markdown, no extra text.`,
         if (operation === 'get_info') {
           return {
             spreadsheetId: effectiveSpreadsheetId,
-            oauthCredential,
+            credential,
           }
         }
 
@@ -785,7 +763,7 @@ Return ONLY the JSON array - no explanations, no markdown, no extra text.`,
           return {
             spreadsheetId: effectiveSpreadsheetId,
             ranges: parsedRanges,
-            oauthCredential,
+            credential,
           }
         }
 
@@ -796,7 +774,7 @@ Return ONLY the JSON array - no explanations, no markdown, no extra text.`,
             ...rest,
             spreadsheetId: effectiveSpreadsheetId,
             data: parsedData,
-            oauthCredential,
+            credential,
           }
         }
 
@@ -806,7 +784,7 @@ Return ONLY the JSON array - no explanations, no markdown, no extra text.`,
           return {
             spreadsheetId: effectiveSpreadsheetId,
             ranges: parsedRanges,
-            oauthCredential,
+            credential,
           }
         }
 
@@ -816,7 +794,7 @@ Return ONLY the JSON array - no explanations, no markdown, no extra text.`,
             sourceSpreadsheetId: effectiveSpreadsheetId,
             sheetId: Number.parseInt(sheetId as string, 10),
             destinationSpreadsheetId: (destinationSpreadsheetId as string)?.trim(),
-            oauthCredential,
+            credential,
           }
         }
 
@@ -835,14 +813,14 @@ Return ONLY the JSON array - no explanations, no markdown, no extra text.`,
           sheetName: effectiveSheetName,
           cellRange: cellRange ? (cellRange as string).trim() : undefined,
           values: parsedValues,
-          oauthCredential,
+          credential,
         }
       },
     },
   },
   inputs: {
     operation: { type: 'string', description: 'Operation to perform' },
-    oauthCredential: { type: 'string', description: 'Google Sheets access token' },
+    credential: { type: 'string', description: 'Google Sheets access token' },
     spreadsheetId: { type: 'string', description: 'Spreadsheet identifier (canonical param)' },
     sheetName: { type: 'string', description: 'Name of the sheet/tab (canonical param)' },
     cellRange: { type: 'string', description: 'Cell range (e.g., A1:D10)' },

apps/sim/blocks/blocks/google_slides.ts

@@ -46,8 +46,6 @@ export const GoogleSlidesBlock: BlockConfig<GoogleSlidesResponse> = {
       id: 'credential',
       title: 'Google Account',
       type: 'oauth-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'basic',
       required: true,
       serviceId: 'google-drive',
       requiredScopes: [
@@ -56,15 +54,6 @@ export const GoogleSlidesBlock: BlockConfig<GoogleSlidesResponse> = {
       ],
       placeholder: 'Select Google account',
     },
-    {
-      id: 'manualCredential',
-      title: 'Google Account',
-      type: 'short-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'advanced',
-      placeholder: 'Enter credential ID',
-      required: true,
-    },
     // Presentation selector (basic mode) - for operations that need an existing presentation
     {
       id: 'presentationId',
@@ -673,7 +662,7 @@ Return ONLY the text content - no explanations, no markdown formatting markers,
       },
       params: (params) => {
         const {
-          oauthCredential,
+          credential,
           presentationId,
           folderId,
           slideIndex,
@@ -690,7 +679,7 @@ Return ONLY the text content - no explanations, no markdown formatting markers,
         const result: Record<string, any> = {
           ...rest,
           presentationId: effectivePresentationId || undefined,
-          oauthCredential,
+          credential,
         }
 
         // Handle operation-specific params
@@ -810,7 +799,7 @@ Return ONLY the text content - no explanations, no markdown formatting markers,
   },
   inputs: {
     operation: { type: 'string', description: 'Operation to perform' },
-    oauthCredential: { type: 'string', description: 'Google Slides access token' },
+    credential: { type: 'string', description: 'Google Slides access token' },
     presentationId: { type: 'string', description: 'Presentation identifier (canonical param)' },
     // Write operation
     slideIndex: { type: 'number', description: 'Slide index to write to' },

apps/sim/blocks/blocks/google_vault.ts

@@ -34,8 +34,6 @@ export const GoogleVaultBlock: BlockConfig = {
       id: 'credential',
       title: 'Google Vault Account',
       type: 'oauth-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'basic',
       required: true,
       serviceId: 'google-vault',
       requiredScopes: [
@@ -44,15 +42,6 @@ export const GoogleVaultBlock: BlockConfig = {
       ],
       placeholder: 'Select Google Vault account',
     },
-    {
-      id: 'manualCredential',
-      title: 'Google Vault Account',
-      type: 'short-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'advanced',
-      placeholder: 'Enter credential ID',
-      required: true,
-    },
     // Create Hold inputs
     {
       id: 'matterId',
@@ -449,10 +438,10 @@ Return ONLY the description text - no explanations, no quotes, no extra text.`,
         }
       },
       params: (params) => {
-        const { oauthCredential, holdStartTime, holdEndTime, holdTerms, ...rest } = params
+        const { credential, holdStartTime, holdEndTime, holdTerms, ...rest } = params
         return {
           ...rest,
-          oauthCredential,
+          credential,
           // Map hold-specific fields to their tool parameter names
           ...(holdStartTime && { startTime: holdStartTime }),
           ...(holdEndTime && { endTime: holdEndTime }),
@@ -464,7 +453,7 @@ Return ONLY the description text - no explanations, no quotes, no extra text.`,
   inputs: {
     // Core inputs
     operation: { type: 'string', description: 'Operation to perform' },
-    oauthCredential: { type: 'string', description: 'Google Vault OAuth credential' },
+    credential: { type: 'string', description: 'Google Vault OAuth credential' },
     matterId: { type: 'string', description: 'Matter ID' },
 
     // Create export inputs

apps/sim/blocks/blocks/hubspot.ts

@@ -39,8 +39,6 @@ export const HubSpotBlock: BlockConfig<HubSpotResponse> = {
       id: 'credential',
       title: 'HubSpot Account',
       type: 'oauth-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'basic',
       serviceId: 'hubspot',
       requiredScopes: [
         'crm.objects.contacts.read',
@@ -70,15 +68,6 @@ export const HubSpotBlock: BlockConfig<HubSpotResponse> = {
       placeholder: 'Select HubSpot account',
       required: true,
     },
-    {
-      id: 'manualCredential',
-      title: 'HubSpot Account',
-      type: 'short-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'advanced',
-      placeholder: 'Enter credential ID',
-      required: true,
-    },
     {
       id: 'contactId',
       title: 'Contact ID or Email',
@@ -834,7 +823,7 @@ Return ONLY the JSON array of property names - no explanations, no markdown, no
       },
       params: (params) => {
         const {
-          oauthCredential,
+          credential,
           operation,
           propertiesToSet,
           properties,
@@ -846,7 +835,7 @@ Return ONLY the JSON array of property names - no explanations, no markdown, no
         } = params
 
         const cleanParams: Record<string, any> = {
-          oauthCredential,
+          credential,
         }
 
         const createUpdateOps = [
@@ -901,7 +890,7 @@ Return ONLY the JSON array of property names - no explanations, no markdown, no
   },
   inputs: {
     operation: { type: 'string', description: 'Operation to perform' },
-    oauthCredential: { type: 'string', description: 'HubSpot access token' },
+    credential: { type: 'string', description: 'HubSpot access token' },
     contactId: { type: 'string', description: 'Contact ID or email' },
     companyId: { type: 'string', description: 'Company ID or domain' },
     idProperty: { type: 'string', description: 'Property name to use as unique identifier' },

apps/sim/blocks/blocks/jira.ts

@@ -60,8 +60,6 @@ export const JiraBlock: BlockConfig<JiraResponse> = {
       id: 'credential',
       title: 'Jira Account',
       type: 'oauth-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'basic',
       required: true,
       serviceId: 'jira',
       requiredScopes: [
@@ -98,15 +96,6 @@ export const JiraBlock: BlockConfig<JiraResponse> = {
       ],
       placeholder: 'Select Jira account',
     },
-    {
-      id: 'manualCredential',
-      title: 'Jira Account',
-      type: 'short-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'advanced',
-      placeholder: 'Enter credential ID',
-      required: true,
-    },
     // Project selector (basic mode)
     {
       id: 'projectId',
@@ -800,14 +789,14 @@ Return ONLY the comment text - no explanations.`,
         }
       },
       params: (params) => {
-        const { oauthCredential, projectId, issueKey, ...rest } = params
+        const { credential, projectId, issueKey, ...rest } = params
 
         // Use canonical param IDs (raw subBlock IDs are deleted after serialization)
         const effectiveProjectId = projectId ? String(projectId).trim() : ''
         const effectiveIssueKey = issueKey ? String(issueKey).trim() : ''
 
         const baseParams = {
-          oauthCredential,
+          credential,
           domain: params.domain,
         }
 
@@ -1060,7 +1049,7 @@ Return ONLY the comment text - no explanations.`,
   inputs: {
     operation: { type: 'string', description: 'Operation to perform' },
     domain: { type: 'string', description: 'Jira domain' },
-    oauthCredential: { type: 'string', description: 'Jira access token' },
+    credential: { type: 'string', description: 'Jira access token' },
     issueKey: { type: 'string', description: 'Issue key identifier (canonical param)' },
     projectId: { type: 'string', description: 'Project identifier (canonical param)' },
     // Update/Write operation inputs

apps/sim/blocks/blocks/jira_service_management.ts

@@ -55,8 +55,6 @@ export const JiraServiceManagementBlock: BlockConfig<JsmResponse> = {
       id: 'credential',
       title: 'Jira Account',
       type: 'oauth-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'basic',
       required: true,
       serviceId: 'jira',
       requiredScopes: [
@@ -97,15 +95,6 @@ export const JiraServiceManagementBlock: BlockConfig<JsmResponse> = {
       ],
       placeholder: 'Select Jira account',
     },
-    {
-      id: 'manualCredential',
-      title: 'Jira Account',
-      type: 'short-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'advanced',
-      placeholder: 'Enter credential ID',
-      required: true,
-    },
     {
       id: 'serviceDeskId',
       title: 'Service Desk ID',
@@ -504,7 +493,7 @@ Return ONLY the comment text - no explanations.`,
       },
       params: (params) => {
         const baseParams = {
-          oauthCredential: params.oauthCredential,
+          credential: params.credential,
           domain: params.domain,
         }
 
@@ -751,7 +740,7 @@ Return ONLY the comment text - no explanations.`,
   inputs: {
     operation: { type: 'string', description: 'Operation to perform' },
     domain: { type: 'string', description: 'Jira domain' },
-    oauthCredential: { type: 'string', description: 'Jira Service Management access token' },
+    credential: { type: 'string', description: 'Jira Service Management access token' },
     serviceDeskId: { type: 'string', description: 'Service desk ID' },
     requestTypeId: { type: 'string', description: 'Request type ID' },
     issueIdOrKey: { type: 'string', description: 'Issue ID or key' },

apps/sim/blocks/blocks/linear.ts

@@ -129,22 +129,11 @@ export const LinearBlock: BlockConfig<LinearResponse> = {
       id: 'credential',
       title: 'Linear Account',
       type: 'oauth-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'basic',
       serviceId: 'linear',
       requiredScopes: ['read', 'write'],
       placeholder: 'Select Linear account',
       required: true,
     },
-    {
-      id: 'manualCredential',
-      title: 'Linear Account',
-      type: 'short-input',
-      canonicalParamId: 'oauthCredential',
-      mode: 'advanced',
-      placeholder: 'Enter credential ID',
-      required: true,
-    },
     // Team selector (for most operations)
     {
       id: 'teamId',
@@ -1515,7 +1504,7 @@ Return ONLY the date string in YYYY-MM-DD format - no explanations, no quotes, n
 
         // Base params that most operations need
         const baseParams: Record<string, any> = {
-          oauthCredential: params.oauthCredential,
+          credential: params.credential,
         }
 
         // Operation-specific param mapping
@@ -2334,7 +2323,7 @@ Return ONLY the date string in YYYY-MM-DD format - no explanations, no quotes, n
   },
   inputs: {
     operation: { type: 'string', description: 'Operation to perform' },
-    oauthCredential: { type: 'string', description: 'Linear access token' },
+    credential: { type: 'string', description: 'Linear access token' },
     teamId: { type: 'string', description: 'Linear team identifier (canonical param)' },
     projectId: { type: 'string', description: 'Linear project identifier (canonical param)' },
     issueId: { type: 'string', description: 'Issue identifier' },