You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Commit b91be10
Browse filesBrowse the repository at this point in the historyBrowse files
A service-account-only picker (a saved token or key credential) instead sets
141
+
`credentialKind: 'service-account'` and `mode: 'basic'` (no scopes), and pairs with an advanced
142
+
twin; `isSavedCredentialPicker` matches only this shape:
143
+
```typescript
144
+
{
145
+
id: 'credential',
146
+
title: '{Service} Account',
147
+
type: 'oauth-input',
148
+
serviceId: '{service}',
149
+
credentialKind: 'service-account',
150
+
canonicalParamId: 'oauthCredential',
151
+
mode: 'basic',
152
+
placeholder: 'Select {Service} credential',
153
+
required: true,
154
+
},
155
+
{
156
+
id: 'manualCredential',
157
+
title: '{Service} Account',
158
+
type: 'short-input',
159
+
canonicalParamId: 'oauthCredential',
160
+
mode: 'advanced',
161
+
placeholder: 'Enter credential ID',
162
+
required: true,
163
+
}
164
+
```
165
+
139
166
**Scopes:** Always use `getScopesForService(serviceId)` from `@/lib/oauth/utils` for `requiredScopes`. Never hardcode scope arrays — the single source of truth is `OAUTH_PROVIDERS` in `lib/oauth/oauth.ts`.
140
167
141
168
**Scope descriptions:** When adding a new OAuth provider, also add human-readable descriptions for all scopes in `SCOPE_DESCRIPTIONS` within `lib/oauth/utils.ts`.
@@ -695,7 +722,8 @@ outputs: {
695
722
When creating V2 blocks (alongside legacy V1):
696
723
697
724
```typescript illustrative
698
-
// V1 Block - mark as legacy
725
+
// V1 Block - mark as legacy. A credential-only successor is the exception: the
726
+
// successor keeps the legacy block's name, so neither block is renamed.
Copy file name to clipboardExpand all lines: .agents/skills/add-integration/SKILL.md
+22-7Lines changed: 22 additions & 7 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -43,6 +43,12 @@ supported paths and choose the simplest supported setup for the intended user:
43
43
| Customer-owned client credentials | Saved `service_account` credential with a client ID and secret | Internal-app eligibility, grant activation, scope syntax, token lifetime and revocation behavior |
44
44
| API token or personal access token | Saved token service account when reusable connections are useful | Token permissions, identity verification, expiry and rotation |
| Cloud workload identity (AWS role, Databricks/Snowflake/Entra/GCP federation) | Keyless saved credential: Sim signs a short-lived OIDC token the customer's cloud trusts. Add the provider to every table in `lib/credentials/workload-identity/audiences.ts` (`WORKLOAD_IDENTITY_PROVIDERS`, its service-account provider ID map, `WORKLOAD_IDENTITY_KEYLESS_CONFIGS`, `WORKLOAD_IDENTITY_AUDIENCES`) | Issuer and audience the provider accepts, how the trust pins the subject, token lifetime |
47
+
48
+
API, CLI, and MCP callers set up keyless in two steps: `POST /api/v2/credentials/workload-identity/subjects`
49
+
(or `sim credentials keyless-subject <providerId> --output json`) returns the subject to trust and a
50
+
`keylessConfig`; they add its `requiredConfigFields` and create the credential with it. The provider
51
+
catalog advertises `keyless` only when the deployment can sign tokens.
46
52
47
53
Do not present customer-owned credentials as a way around a provider's approval requirements
48
54
for a shared public integration. Explain the supported account/app type in the setup docs. Keep
@@ -86,15 +92,23 @@ service id:
86
92
answers), and `errorBodyEchoesToken` when an error body echoes the token.
87
93
3.`apps/sim/lib/oauth/oauth.ts` and `types.ts`: the service entry (`authType: 'service_account'`,
'providerWorkspaceId' })` in `apps/sim/tools/shared/saved-credentials.ts`, listed in
100
+
`SAVED_CREDENTIAL_OAUTH`, is for existing tools that already take the token inline (successors).
101
+
Either way, the executor overwrites mapped and pinned params after authorizing the credential,
102
+
and `check-block-registry` probes the real URL builders of every block with a saved-credential
103
+
picker and fails on a host-steering param left unmapped or unpinned.
94
104
5. A credential-only block (including a successor) uses `authMode: AuthMode.OAuth`, so the
95
105
generated catalog maps the service; a token-only block that keeps `AuthMode.ApiKey`, as Coda
96
106
does, registers in `tokenCredentialIntegrationTypes` instead (see below). The credential picker
97
-
sits directly under the operation dropdown (`add-block` → OAuth/Credentials). An existing block that already takes the secret inline is never edited in
107
+
sits directly under the operation dropdown (`add-block` → OAuth/Credentials). A new block
108
+
writes the picker inline, as Higgsfield does: `{ id: 'credential', type: 'oauth-input', serviceId,
Copy file name to clipboardExpand all lines: apps/docs/content/docs/integrations/aws-credentials.mdx
+5-2Lines changed: 5 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -36,10 +36,13 @@ STS **Get Session Token** works only with an **Access keys** credential: AWS ref
36
36
In the AWS IAM console, open **Identity providers → Add provider**, choose **OpenID Connect**, and enter the dialog's **Issuer** as the **Provider URL**, and its **Audience**. You only do this once per AWS account.
37
37
</Step>
38
38
<Step>
39
-
Create a role (or edit an existing one) and set its trust policy to the **Role trust policy**shown in the dialog. It trusts only this credential's **Subject**, so no other Sim credential, workspace, or customer can assume the role.
39
+
Enter the role's ARN (`arn:aws:iam::<account ID>:role/<role name>`) in the dialog first. The **Role trust policy**fills in its account ID; until then it shows `<AWS_ACCOUNT_ID>`, which IAM rejects.
40
40
</Step>
41
41
<Step>
42
-
Attach the permissions your workflows need to the role, then paste its ARN into the dialog and save. Sim verifies the connection by assuming the role before saving it, and refuses a role that would also trust a different subject.
42
+
Create the role with that name (or edit the existing one) and set its trust policy to the **Role trust policy** shown in the dialog. It trusts only this credential's **Subject**, so no other Sim credential, workspace, or customer can assume the role.
43
+
</Step>
44
+
<Step>
45
+
Attach the permissions your workflows need to the role, then save. Sim verifies the connection by assuming the role before saving it, and refuses a role that would also trust a different subject.
Copy file name to clipboardExpand all lines: apps/docs/content/docs/integrations/bitbucket-service-account.mdx
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -12,7 +12,7 @@ Bitbucket shows actions taken with the token (comments, merges, pipeline runs) u
12
12
13
13
## Prerequisites
14
14
15
-
Admin access to the workspace, project, or repository the token is for. Workspace access tokens require a Bitbucket Cloud Premium plan; project and repository access tokens do not.
15
+
Admin access to the workspace, project, or repository the token is for. Workspace and project access tokens require a Bitbucket Cloud Premium plan; repository access tokens do not.
16
16
17
17
## Create the access token [#creating-the-access-token]
Copy file name to clipboardExpand all lines: apps/docs/content/docs/integrations/databricks-credentials.mdx
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -29,7 +29,7 @@ Every option resolves on Sim's servers at run time; tokens never appear in block
29
29
In Sim, add a **Databricks connection**, choose **Service principal (keyless, via Sim OIDC)**, and enter the workspace host and the service principal's **application ID**.
30
30
</Step>
31
31
<Step>
32
-
A Databricks account admin runs the **Federation policy** command from the dialog with the service principal's numeric ID (find it with `databricks account service-principals list --filter 'applicationId eq "<application ID>"'`, or on the service principal's page in the account console). The policy trusts Sim's issuer, the Sim audience, and this connection's subject only.
32
+
A Databricks account admin runs the **Federation policy** command from the dialog with the service principal's numeric ID. First sign in to the account with `databricks auth login --host <account console URL> --account-id <account ID>` (not a workspace profile or the workspace web terminal). Find the numeric ID with `databricks account service-principals list --filter 'applicationId eq "<application ID>"'`, or on the service principal's page in the account console. The policy trusts Sim's issuer, the Sim audience, and this connection's subject only.
33
33
</Step>
34
34
<Step>
35
35
Make sure the service principal can access the workspace and the resources your workflows use, then save. Sim verifies the connection by exchanging a token and reading the service principal's identity, and refuses a policy that would also trust a different subject, since every Sim workspace shares the issuer and audience.
Copy file name to clipboardExpand all lines: apps/docs/content/docs/integrations/google-service-account.mdx
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -185,16 +185,16 @@ Keyless credentials work with Google Cloud APIs that the service account calls a
185
185
186
186
<Steps>
187
187
<Step>
188
-
In the [Google Cloud Console](https://console.cloud.google.com/), enable the IAM, Service Account Credentials, and Security Token Service APIs in the project that will hold the workload identity pool, and note its **project number** (on the project's Dashboard; it's numeric, not the project ID).
188
+
In the [Google Cloud Console](https://console.cloud.google.com/), enable the IAM, Resource Manager, Service Account Credentials, and Security Token Service APIs in the project that will hold the workload identity pool, and note its **project number** (on the project's Dashboard; it's numeric, not the project ID).
189
189
</Step>
190
190
<Step>
191
191
Create or pick a service account, and grant it the roles your workflows need (for example, BigQuery Data Viewer and BigQuery Job User, or Vertex AI User). No key is needed.
192
192
</Step>
193
193
<Step>
194
-
In Sim, open the **Google BigQuery** integration, choose **Add service account**, and set **Authentication** to **Workload Identity Federation (keyless, via Sim OIDC)**. Enter the project number, a pool ID and provider ID (4 to 32 lowercase letters, digits, or hyphens, not starting with `gcp-`), and the service account email (`name@project-id.iam.gserviceaccount.com`).
194
+
In Sim, open the **Google BigQuery** integration, choose **Add service account**, and set **Authentication** to **Workload Identity Federation (keyless, via Sim OIDC)**. Enter the project number, a pool ID and provider ID (4 to 32 lowercase letters, digits, or hyphens, not starting with `gcp-`), and the service account email (`name@project-id.iam.gserviceaccount.com`; user-managed service account only, so default accounts such as `…@developer.gserviceaccount.com` are refused).
195
195
</Step>
196
196
<Step>
197
-
The dialog shows the **Issuer**, **Audience**, and **Subject**, and three `gcloud` commands with your values filled in. Run them in that project. They run against the project number you entered and create the pool, an OIDC provider for Sim's issuer with the attribute mapping `google.subject=assertion.sub` and an attribute condition that accepts only this credential's subject, and grant that subject `roles/iam.workloadIdentityUser` on the service account:
197
+
The dialog shows the **Issuer**, **Audience**, and **Subject**, and three `gcloud` commands with your values filled in. Run them in that project. They run against the project number you entered and create the pool, an OIDC provider for Sim's issuer with the attribute mapping `google.subject=assertion.sub` and an attribute condition that accepts only this credential's subject, and grant that subject `roles/iam.workloadIdentityUser` on the service account. If the pool already exists, skip the first command:
198
198
199
199
```bash
200
200
gcloud iam workload-identity-pools create POOL_ID \
In Sim, add a **Snowflake** connection, choose **Service user (keyless, via Sim OIDC)**, and enter the account host (`myorg-myaccount.snowflakecomputing.com`). The dialog shows the issuer, audience, and subject for this connection, and the statement to run.
25
25
</Step>
26
26
<Step>
27
-
A user whose role can create users (and has `OWNERSHIP` or `MODIFY PROGRAMMATIC AUTHENTICATION METHODS` on the user) runs the statement from the dialog. It looks like this:
27
+
A user whose role can create users (for example USERADMIN) runs the statement from the dialog. If SIM_WORKFLOWS already exists, change the name in the statement you run and in the follow-up GRANT and ALTER commands below. It looks like this:
0 commit comments