feat(credentials): keyless Google Cloud credentials via Workload Identity Federation

A keyless mode of the existing Google service account credential
(google-service-account) for Google Cloud APIs. JSON-key credentials, their
connect flow, and their token minting are unchanged.

- Flow: Sim signs a short-lived token for the credential's own subject with
  aud = the customer's provider resource name
  (https://iam.googleapis.com/projects/<number>/locations/global/
  workloadIdentityPools/<pool>/providers/<provider>), exchanges it at
  sts.googleapis.com/v1/token (token-exchange, jwt subject token,
  cloud-platform scope, audience //iam.googleapis.com/...), then calls
  iamcredentials generateAccessToken for the service account with the tool's
  scopes and a 1h lifetime. Impersonation rather than direct federated access:
  some Cloud APIs reject federated tokens, and the service account keeps the
  same identity and roles a JSON key uses.
- Inputs validated against Google's documented formats before any request:
  numeric project number, pool/provider IDs (4-32 [a-z0-9-], no gcp-), and a
  user-managed *.iam.gserviceaccount.com email, so nothing can steer the STS
  audience or IAM URL. Requests never follow redirects.
- Scope: refuses domain-wide delegation (an impersonated user) and any service
  but BigQuery and Vertex AI before reading further or contacting Google, with
  a new shared unsupported_use code and copy pointing to a JSON key. Workspace
  blocks never offer the mode.
- Save check: STS exchange, impersonation, and tokeninfo (no IAM role or
  enabled API needed), plus a probe that a subject no credential holds cannot
  impersonate the service account. Subject bound to the saving user with the
  signed proof; kept across reconnects.
- STS/IAM failures map to actionable copy (provider settings, issuer
  reachability, the exact workloadIdentityUser binding) without Google's
  descriptions or any token; runtime keeps the invalid_credentials /
  provider_unavailable split. Tokens cache per credential, secret version, and
  scopes in an LRU.
- Per-credential audiences: audiences.ts gains google without a fixed
  audience; the setup response omits audience for it and reports a keyless
  reconnect. Connect dialog shows the issuer, audience, subject, and filled-in
  gcloud commands (pool, OIDC provider with attribute condition on the
  subject, IAM binding); docs section added.

Author: waleedlatif1

apps/docs/content/docs/integrations/google-service-account.mdx

@@ -11,6 +11,8 @@ Google service accounts can access shared resources directly or impersonate a Go
 
 For example, you could build a workflow that iterates through a list of employees, impersonates each one to read their Google Docs, and uploads the contents to a shared knowledge base — all without requiring any of those users to sign in.
 
+For Google Cloud APIs such as BigQuery and Vertex AI, you can skip the JSON key entirely: see [Keyless Google Cloud access](#keyless-google-cloud-access).
+
 ## Prerequisites
 
 Create the service account and enable its APIs in Google Cloud. Configure the Google Workspace Admin Console only when using domain-wide delegation.
@@ -172,3 +174,64 @@ Leave **Impersonated Account** blank to authenticate as the service account itse
 Domain-wide delegation requires a Google Workspace super administrator. It authorizes impersonation within that Workspace domain, subject to the authorized scopes and the impersonated user’s access. Consumer Gmail accounts and users outside that domain cannot be impersonated. Access also depends on the license required by the target service. See [Google’s service-account authorization guide](https://developers.google.com/identity/protocols/oauth2/service-account).
 
 A credential can serve multiple supported Google services when their APIs and scopes are configured. To rotate its key, create a replacement JSON key, update the credential in Sim, verify access, then delete the old key in Google Cloud.
+
+## Keyless Google Cloud access [#keyless-google-cloud-access]
+
+A Google service account credential can also be **keyless**: Sim stores no key. Instead, your Google Cloud project trusts Sim through [Workload Identity Federation](https://cloud.google.com/iam/docs/workload-identity-federation-with-other-providers). On each run, Sim signs a short-lived token for this credential's own subject, exchanges it at Google's Security Token Service for a federated token, and uses that to impersonate your service account. The service account's IAM roles decide what workflows can do, exactly as with a JSON key.
+
+<Callout type="info">
+Keyless credentials work with Google Cloud APIs that the service account calls as itself: **BigQuery**, and **Vertex AI** wherever a Google service account credential is accepted. They can't use domain-wide delegation, so Gmail, Drive, Sheets, Calendar, and other Google Workspace blocks don't offer them, and a keyless credential refuses an **Impersonated Account**. Use a JSON key for those.
+</Callout>
+
+<Steps>
+  <Step>
+    In the [Google Cloud Console](https://console.cloud.google.com/), enable the IAM, Resource Manager, Service Account Credentials, and Security Token Service APIs in the project that will hold the workload identity pool, and note its **project number** (on the project's Dashboard; it's numeric, not the project ID).
+  </Step>
+  <Step>
+    Create or pick a service account, and grant it the roles your workflows need (for example, BigQuery Data Viewer and BigQuery Job User, or Vertex AI User). No key is needed.
+  </Step>
+  <Step>
+    In Sim, open the **Google BigQuery** integration, choose **Add service account**, and set **Authentication** to **Workload Identity Federation (keyless, via Sim OIDC)**. Enter the project number, a pool ID and provider ID (4 to 32 lowercase letters, digits, or hyphens, not starting with `gcp-`), and the service account email (`name@project-id.iam.gserviceaccount.com`).
+  </Step>
+  <Step>
+    The dialog shows the **Issuer**, **Audience**, and **Subject**, and three `gcloud` commands with your values filled in. Run them in that project. They create the pool, an OIDC provider for Sim's issuer with the attribute mapping `google.subject=assertion.sub` and an attribute condition that accepts only this credential's subject, and grant that subject `roles/iam.workloadIdentityUser` on the service account:
+
+    ```bash
+    gcloud iam workload-identity-pools create POOL_ID \
+        --location="global" \
+        --display-name="Sim"
+
+    gcloud iam workload-identity-pools providers create-oidc PROVIDER_ID \
+        --location="global" \
+        --workload-identity-pool="POOL_ID" \
+        --issuer-uri="ISSUER" \
+        --attribute-mapping="google.subject=assertion.sub" \
+        --attribute-condition="assertion.sub=='SUBJECT'"
+
+    gcloud iam service-accounts add-iam-policy-binding SERVICE_ACCOUNT_EMAIL \
+        --role="roles/iam.workloadIdentityUser" \
+        --member="principal://iam.googleapis.com/projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/POOL_ID/subject/SUBJECT"
+    ```
+
+    The provider sets no allowed audiences, so it accepts its own resource name, which is the **Audience** the dialog shows.
+  </Step>
+  <Step>
+    Save in Sim. Sim exchanges a token at STS, impersonates the service account, and confirms Google accepts the resulting token. It also checks that a subject no credential holds can't impersonate the service account, so only this credential can use it. New IAM bindings can take a few minutes to apply; if saving fails right after you run the commands, wait and try again.
+  </Step>
+</Steps>
+
+<Callout type="warn">
+Keep the attribute condition and bind the role to the exact `principal://…/subject/SUBJECT` member. Without the condition, the provider accepts a token for any Sim subject, and a role granted to a `principalSet` for the whole pool would let other Sim credentials act with it. Sim refuses to save a service account that another subject can impersonate, but it can't see roles you grant the pool directly on other resources.
+</Callout>
+
+Each keyless credential has its own subject; reconnecting keeps it by default so your provider and binding keep working. Use one provider per credential (a pool can hold many). Keyless credentials are available for workspace credentials, not organization credentials. Sim uses impersonation rather than direct federated access because some Google Cloud APIs don't accept federated tokens, and impersonation keeps the same identity a JSON key would use.
+
+Self-hosted deployments need `WORKLOAD_IDENTITY_SIGNING_KEY` set and an `https` issuer Google can reach over the public internet. See [AWS credentials](/integrations/aws-credentials#self-hosted-deployments).
+
+### Troubleshooting keyless access
+
+- **"Google Cloud refused Sim's token for this workload identity provider":** the project number, pool ID, or provider ID doesn't match; the provider is disabled, has allowed audiences set, or uses a different issuer; or its attribute condition doesn't allow this credential's subject.
+- **"Google Cloud could not fetch the signing keys from Sim's issuer":** the issuer isn't reachable over public HTTPS (self-hosted deployments).
+- **"The service account … does not let this credential impersonate it":** run the `add-iam-policy-binding` command with the exact member shown, and enable the IAM Service Account Credentials API.
+- **"This service account also trusts other Sim credentials":** remove any `principalSet` binding for the pool from the service account and keep the attribute condition.
+- **A block fails with "This credential cannot be used here":** the block is a Google Workspace block or sets an **Impersonated Account**. Use a JSON key credential for it.

apps/sim/app/workspace/[workspaceId]/integrations/[block]/integration-block-detail.tsx

@@ -355,6 +355,7 @@ function IntegrationBlockDetailContent({ integration, workspaceId }: Integration
           atlassianProduct={oauthService?.providerId === 'confluence' ? 'confluence' : 'jira'}
           serviceName={serviceAccountTarget.serviceName}
           serviceIcon={serviceAccountTarget.serviceIcon}
+          oauthServiceId={oauthService?.providerId}
         />
       )}
       <div

apps/sim/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal/aws-account-modal.tsx

@@ -147,7 +147,7 @@ function AwsAccountForm({
   }
 
   const trustPolicy =
-    authType === 'oidc_role' && keyless.trust
+    authType === 'oidc_role' && keyless.trust?.audience
       ? buildTrustPolicy(
           keyless.trust.issuer,
           keyless.trust.audience,

apps/sim/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal/connect-service-account-modal.tsx

@@ -25,6 +25,7 @@ import {
   type ClientCredentialAccountProviderId,
   getClientCredentialAccountDescriptor,
 } from '@/lib/credentials/client-credential-accounts/descriptors'
+import { GOOGLE_KEYLESS_SERVICES } from '@/lib/credentials/google-workload-identity'
 import type { ServiceAccountSecretFields } from '@/lib/credentials/service-account-secret'
 import {
   getTokenServiceAccountDescriptor,
@@ -45,6 +46,17 @@ import {
 import { AwsAccountModal } from '@/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal/aws-account-modal'
 import { ClientCredentialAccountModal } from '@/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal/client-credential-account-modal'
 import { DatabricksAccountModal } from '@/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal/databricks-account-modal'
+import {
+  buildGoogleKeylessConfig,
+  EMPTY_GOOGLE_KEYLESS_INPUT,
+  GoogleKeylessFields,
+  type GoogleKeylessInput,
+  isGoogleKeylessInputComplete,
+} from '@/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal/google-keyless-fields'
+import {
+  useKeylessSetup,
+  useSavedConnectionSubmit,
+} from '@/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal/keyless-connection'
 import { MicrosoftAppAccountModal } from '@/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal/microsoft-app-account-modal'
 import { OracleDatabaseAccountModal } from '@/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal/oracle-database-account-modal'
 import { SnowflakeAccountModal } from '@/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal/snowflake-account-modal'
@@ -149,6 +161,11 @@ interface ConnectServiceAccountModalProps {
   credentialDisplayName?: string
   /** Existing description, used to seed reconnect-capable modals. */
   credentialDescription?: string
+  /**
+   * The OAuth service the dialog was opened for (`google-bigquery`). A Google service account
+   * offers keyless setup only for a Google Cloud service.
+   */
+  oauthServiceId?: string
   /** Called with the new credential id after a successful create (token-paste providers). */
   onCreated?: (credentialId: string) => void
   onSubmitCredentials?: (
@@ -184,6 +201,7 @@ export function ConnectServiceAccountModal({
   credentialId,
   credentialDisplayName,
   credentialDescription,
+  oauthServiceId,
   onCreated,
   onSubmitCredentials,
   submitPending,
@@ -365,6 +383,7 @@ export function ConnectServiceAccountModal({
       credentialId={credentialId}
       initialDisplayName={credentialDisplayName}
       initialDescription={credentialDescription}
+      oauthServiceId={oauthServiceId}
       onCreated={onCreated}
     />
   )
@@ -597,12 +616,20 @@ function OciApiKeyServiceAccountModal({
   )
 }
 
+interface GoogleServiceAccountModalProps extends ProviderModalProps {
+  oauthServiceId?: string
+}
+
+type GoogleAuthType = 'json_key' | 'workload_identity'
+
 /**
  * Google service-account flow. Accepts the raw JSON key (paste or drag/drop)
  * and validates against the shared `serviceAccountJsonSchema` so the same
- * shape errors render here as in the server route.
+ * shape errors render here as in the server route. For a Google Cloud service
+ * (or a keyless credential being reconnected) on a deployment that can sign
+ * workload-identity tokens, it also offers keyless Workload Identity Federation.
  */
-function GoogleServiceAccountModal(props: ProviderModalProps) {
+function GoogleServiceAccountModal(props: GoogleServiceAccountModalProps) {
   if (!props.open) return null
   return (
     <GoogleServiceAccountModalForm
@@ -622,8 +649,31 @@ function GoogleServiceAccountModalForm({
   credentialId,
   initialDisplayName,
   initialDescription,
+  oauthServiceId,
   onCreated,
-}: ProviderModalProps) {
+}: GoogleServiceAccountModalProps) {
+  const cloudService = Boolean(oauthServiceId && GOOGLE_KEYLESS_SERVICES.has(oauthServiceId))
+  const keyless = useKeylessSetup({
+    provider: 'google',
+    workspaceId,
+    organizationId,
+    credentialId,
+    enabled: cloudService || Boolean(credentialId),
+  })
+  const keylessSubmit = useSavedConnectionSubmit({
+    providerId: GOOGLE_SERVICE_ACCOUNT_PROVIDER_ID,
+    workspaceId,
+    organizationId,
+    credentialId,
+    onCreated,
+    onClose: () => onOpenChange(false),
+  })
+  const offerKeyless = Boolean(keyless.available) && (cloudService || keyless.reconnectsKeyless)
+  const [selectedAuthType, setSelectedAuthType] = useState<GoogleAuthType | null>(null)
+  const authType: GoogleAuthType = offerKeyless
+    ? (selectedAuthType ?? (keyless.reconnectsKeyless ? 'workload_identity' : 'json_key'))
+    : 'json_key'
+  const [keylessInput, setKeylessInput] = useState<GoogleKeylessInput>(EMPTY_GOOGLE_KEYLESS_INPUT)
   const [jsonInput, setJsonInput] = useState('')
   const [uploadedFileName, setUploadedFileName] = useState<string | null>(null)
   const [displayName, setDisplayName] = useState(initialDisplayName ?? '')
@@ -712,8 +762,13 @@ function GoogleServiceAccountModalForm({
     }
   }
 
-  const isPending = createCredential.isPending || updateCredential.isPending
-  const isDisabled = !jsonInput.trim() || isPending
+  const isPending =
+    createCredential.isPending || updateCredential.isPending || keylessSubmit.isPending
+  const isDisabled =
+    authType === 'workload_identity'
+      ? isPending || !keyless.ready || !isGoogleKeylessInputComplete(keylessInput)
+      : !jsonInput.trim() || isPending
+  const submitError = authType === 'workload_identity' ? keylessSubmit.error : error
 
   return (
     <ChipModal
@@ -725,39 +780,84 @@ function GoogleServiceAccountModalForm({
         Add {serviceName} service account
       </ChipModalHeader>
       <ChipModalBody>
-        <ChipModalField
-          type='textarea'
-          title='JSON key'
-          value={jsonInput}
-          onChange={(value) => {
-            setJsonInput(value)
-            if (uploadedFileName) setUploadedFileName(null)
-            if (error) setError(null)
-            maybeFillDisplayNameFromJson(value)
-          }}
-          placeholder='Paste your service account JSON key here'
-          minHeight={120}
-          required
-        />
+        {offerKeyless && (
+          <ChipModalField
+            type='dropdown'
+            title='Authentication'
+            value={authType}
+            onChange={(value) => {
+              setSelectedAuthType(value as GoogleAuthType)
+              setError(null)
+              keylessSubmit.clearError()
+            }}
+            options={[
+              { value: 'json_key', label: 'JSON key' },
+              {
+                value: 'workload_identity',
+                label: 'Workload Identity Federation (keyless, via Sim OIDC)',
+              },
+            ]}
+            required
+            hint={
+              authType === 'workload_identity'
+                ? 'No key is stored. Sim signs a short-lived token your workload identity provider trusts, then impersonates the service account. Google Cloud APIs only, without domain-wide delegation.'
+                : undefined
+            }
+          />
+        )}
 
-        <ChipModalField
-          type='file'
-          title='Or upload a file'
-          accept='.json'
-          label={
-            uploadedFileName
-              ? `Uploaded ${uploadedFileName} — click or drop to replace`
-              : 'Drag & drop a .json file, or click to browse'
-          }
-          onChange={handleFileUpload}
-        />
+        {authType === 'workload_identity' && (
+          <GoogleKeylessFields
+            input={keylessInput}
+            onChange={(next) => {
+              setKeylessInput(next)
+              keylessSubmit.clearError()
+            }}
+            setup={keyless}
+          />
+        )}
+
+        {authType === 'json_key' && (
+          <>
+            <ChipModalField
+              type='textarea'
+              title='JSON key'
+              value={jsonInput}
+              onChange={(value) => {
+                setJsonInput(value)
+                if (uploadedFileName) setUploadedFileName(null)
+                if (error) setError(null)
+                maybeFillDisplayNameFromJson(value)
+              }}
+              placeholder='Paste your service account JSON key here'
+              minHeight={120}
+              required
+            />
+
+            <ChipModalField
+              type='file'
+              title='Or upload a file'
+              accept='.json'
+              label={
+                uploadedFileName
+                  ? `Uploaded ${uploadedFileName} — click or drop to replace`
+                  : 'Drag & drop a .json file, or click to browse'
+              }
+              onChange={handleFileUpload}
+            />
+          </>
+        )}
 
         <ChipModalField
           type='input'
           title='Display name'
           value={displayName}
           onChange={setDisplayName}
-          placeholder='Auto-populated from client_email'
+          placeholder={
+            authType === 'workload_identity'
+              ? 'Defaults to the service account email'
+              : 'Auto-populated from client_email'
+          }
           autoComplete='off'
         />
 
@@ -771,7 +871,7 @@ function GoogleServiceAccountModalForm({
           minHeight={80}
         />
 
-        <ChipModalError>{error}</ChipModalError>
+        <ChipModalError>{submitError}</ChipModalError>
       </ChipModalBody>
       <ChipModalFooter
         onCancel={() => onOpenChange(false)}
@@ -782,8 +882,24 @@ function GoogleServiceAccountModalForm({
           },
         ]}
         primaryAction={{
-          label: isPending ? 'Adding...' : 'Add service account',
-          onClick: handleSubmit,
+          label: isPending
+            ? authType === 'workload_identity'
+              ? 'Verifying...'
+              : 'Adding...'
+            : 'Add service account',
+          onClick: () => {
+            if (authType === 'json_key') {
+              void handleSubmit()
+              return
+            }
+            if (!isDisabled) {
+              void keylessSubmit.submit({
+                config: buildGoogleKeylessConfig(keylessInput, keyless),
+                displayName,
+                description,
+              })
+            }
+          },
           disabled: isDisabled,
         }}
       />

apps/sim/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal/databricks-account-modal.tsx

@@ -122,7 +122,7 @@ function DatabricksAccountForm({
   }
 
   const federationCommand =
-    authType === 'oidc_federation' && keyless.trust
+    authType === 'oidc_federation' && keyless.trust?.audience
       ? buildFederationPolicyCommand(
           keyless.trust.issuer,
           keyless.trust.audience,