fix(credentials): close batch-2 audit findings

Restricted keys that name their missing permission (Ashby, Resend,
ElevenLabs) are accepted through a provesKey check; Typeform rejects every
403; WhatsApp keeps the phone number ID in its own path segment; Semrush is
held back because its free balance check accepts unknown keys.

Author: waleedlatif1

apps/docs/components/ui/icon-mapping.ts

@@ -694,7 +694,6 @@ export const blockTypeToIconMap: Record<string, IconComponent> = {
   secrets_manager: SecretsManagerIcon,
   secrets_manager_v2: SecretsManagerIcon,
   semrush: SemrushIcon,
-  semrush_v2: SemrushIcon,
   sendblue: SendblueIcon,
   sendgrid: SendgridIcon,
   sendgrid_v2: SendgridIcon,

apps/docs/content/docs/integrations/semrush.mdx

@@ -26,8 +26,8 @@ export const GrainBlock: BlockConfig = {
   description: 'Access meeting recordings, transcripts, and AI summaries',
   authMode: AuthMode.ApiKey,
   triggerAllowed: true,
-  // Superseded by grain_v2 (Grain API v1 sunsets 2026-09-07); existing blocks
-  // keep rendering, new blocks come from the v2 entry.
+  // Superseded (Grain API v1 sunsets 2026-09-07); existing blocks keep rendering,
+  // new blocks come from the current version.
   hideFromToolbar: true,
   sunset: { status: 'legacy', replacedBy: 'grain_v3' },
   longDescription:

apps/sim/blocks/blocks/grain.ts

@@ -1,7 +1,6 @@
 import { SemrushIcon } from '@/components/icons'
 import type { BlockConfig, BlockMeta } from '@/blocks/types'
 import { AuthMode, IntegrationType } from '@/blocks/types'
-import { withSavedCredential } from '@/blocks/utils'
 
 const DATABASE_OPTIONS = [
   { label: 'United States (us)', id: 'us' },
@@ -349,8 +348,6 @@ Return ONLY the 8-character value - no explanations, no quotes, no extra text.`,
 
 export const SemrushBlock: BlockConfig = {
   type: 'semrush',
-  hideFromToolbar: true,
-  sunset: { status: 'legacy', replacedBy: 'semrush_v2' },
   name: 'Semrush',
   description: 'Research SEO and paid search data with Semrush',
   authMode: AuthMode.ApiKey,
@@ -1051,17 +1048,3 @@ export const SemrushBlockMeta = {
     },
   ],
 } as const satisfies BlockMeta
-
-export const SemrushV2Block: BlockConfig = {
-  ...SemrushBlock,
-  type: 'semrush_v2',
-  authMode: AuthMode.OAuth,
-  hideFromToolbar: false,
-  sunset: undefined,
-  ...withSavedCredential(SemrushBlock, {
-    id: 'credential',
-    type: 'oauth-input',
-    serviceId: 'semrush',
-    title: 'Semrush Credential',
-  }),
-}

apps/sim/blocks/blocks/semrush.ts

@@ -362,7 +362,7 @@ import {
   SecretsManagerBlockMeta,
   SecretsManagerV2Block,
 } from '@/blocks/blocks/secrets_manager'
-import { SemrushBlock, SemrushBlockMeta, SemrushV2Block } from '@/blocks/blocks/semrush'
+import { SemrushBlock, SemrushBlockMeta } from '@/blocks/blocks/semrush'
 import { SendblueBlock, SendblueBlockMeta } from '@/blocks/blocks/sendblue'
 import { SendGridBlock, SendGridBlockMeta, SendGridV2Block } from '@/blocks/blocks/sendgrid'
 import { SentryBlock, SentryBlockMeta, SentryV2Block } from '@/blocks/blocks/sentry'
@@ -820,7 +820,6 @@ export const BLOCK_REGISTRY: Record<string, BlockConfig> = {
   secrets_manager: SecretsManagerBlock,
   secrets_manager_v2: SecretsManagerV2Block,
   semrush: SemrushBlock,
-  semrush_v2: SemrushV2Block,
   sendblue: SendblueBlock,
   sendgrid: SendGridBlock,
   sendgrid_v2: SendGridV2Block,

apps/sim/blocks/registry-maps.ts

@@ -252,7 +252,7 @@ export const BLOCK_NAMES: Readonly<Record<string, string>> = {
   schedule: 'Schedule',
   search: 'Search',
   secrets_manager_v2: 'AWS Secrets Manager',
-  semrush_v2: 'Semrush',
+  semrush: 'Semrush',
   sendblue: 'Sendblue',
   sendgrid_v2: 'SendGrid',
   sentry_v2: 'Sentry',

apps/sim/lib/block-metadata/names.generated.ts

@@ -91,7 +91,6 @@ export const TYPEFORM_SERVICE_ACCOUNT_PROVIDER_ID = 'typeform-service-account' a
 export const TELEGRAM_SERVICE_ACCOUNT_PROVIDER_ID = 'telegram-service-account' as const
 export const STRIPE_SERVICE_ACCOUNT_PROVIDER_ID = 'stripe-service-account' as const
 export const SENTRY_SERVICE_ACCOUNT_PROVIDER_ID = 'sentry-service-account' as const
-export const SEMRUSH_SERVICE_ACCOUNT_PROVIDER_ID = 'semrush-service-account' as const
 export const ROOTLY_SERVICE_ACCOUNT_PROVIDER_ID = 'rootly-service-account' as const
 export const RESEND_SERVICE_ACCOUNT_PROVIDER_ID = 'resend-service-account' as const
 export const PAGERDUTY_SERVICE_ACCOUNT_PROVIDER_ID = 'pagerduty-service-account' as const
@@ -198,7 +197,6 @@ export type TokenServiceAccountProviderId =
   | typeof TELEGRAM_SERVICE_ACCOUNT_PROVIDER_ID
   | typeof STRIPE_SERVICE_ACCOUNT_PROVIDER_ID
   | typeof SENTRY_SERVICE_ACCOUNT_PROVIDER_ID
-  | typeof SEMRUSH_SERVICE_ACCOUNT_PROVIDER_ID
   | typeof ROOTLY_SERVICE_ACCOUNT_PROVIDER_ID
   | typeof RESEND_SERVICE_ACCOUNT_PROVIDER_ID
   | typeof PAGERDUTY_SERVICE_ACCOUNT_PROVIDER_ID
@@ -1520,7 +1518,7 @@ export const TOKEN_SERVICE_ACCOUNT_DESCRIPTORS: Record<
     ],
     docsUrl: 'https://docs.sim.ai/integrations/ashby',
     helpText:
-      'Create an API key in Ashby under Settings > API Keys and grant read and write access to the modules your workflows use.',
+      'Create an API key in Ashby under Admin > API Keys and grant read and write access to the modules your workflows use.',
     invalidCredentialsHelp:
       'Ashby rejected this key. Check that it was copied in full and has not been deactivated.',
   },
@@ -1666,20 +1664,6 @@ export const TOKEN_SERVICE_ACCOUNT_DESCRIPTORS: Record<
     invalidCredentialsHelp:
       'Rootly rejected this key. Check that it was copied in full and has not been revoked.',
   },
-  [SEMRUSH_SERVICE_ACCOUNT_PROVIDER_ID]: {
-    providerId: SEMRUSH_SERVICE_ACCOUNT_PROVIDER_ID,
-    serviceLabel: 'Semrush',
-    tokenNoun: 'API key',
-    connectNoun: 'API key',
-    fields: [
-      { id: 'apiToken', label: 'API key', placeholder: 'Paste your Semrush API key', secret: true },
-    ],
-    docsUrl: 'https://docs.sim.ai/integrations/semrush',
-    helpText:
-      'API access needs a Semrush subscription with API units. Checking the key uses no units.',
-    invalidCredentialsHelp:
-      'Semrush rejected this key. Check that it was copied in full and belongs to an account with API access.',
-  },
   [SENTRY_SERVICE_ACCOUNT_PROVIDER_ID]: {
     providerId: SENTRY_SERVICE_ACCOUNT_PROVIDER_ID,
     serviceLabel: 'Sentry',

apps/sim/lib/credentials/token-service-accounts/descriptors.ts

@@ -73,7 +73,6 @@ import {
   RIPPLING_SERVICE_ACCOUNT_PROVIDER_ID,
   ROCKETLANE_SERVICE_ACCOUNT_PROVIDER_ID,
   ROOTLY_SERVICE_ACCOUNT_PROVIDER_ID,
-  SEMRUSH_SERVICE_ACCOUNT_PROVIDER_ID,
   SENDGRID_SERVICE_ACCOUNT_PROVIDER_ID,
   SENTRY_SERVICE_ACCOUNT_PROVIDER_ID,
   SHOPIFY_SERVICE_ACCOUNT_PROVIDER_ID,
@@ -176,7 +175,6 @@ import {
   validateRipplingServiceAccount,
   validateRocketlaneServiceAccount,
   validateRootlyServiceAccount,
-  validateSemrushServiceAccount,
   validateSendGridServiceAccount,
   validateSentryServiceAccount,
   validateSimilarwebServiceAccount,
@@ -332,7 +330,6 @@ const TOKEN_SERVICE_ACCOUNT_VALIDATORS: Record<
   [TELEGRAM_SERVICE_ACCOUNT_PROVIDER_ID]: validateTelegramServiceAccount,
   [STRIPE_SERVICE_ACCOUNT_PROVIDER_ID]: validateStripeServiceAccount,
   [SENTRY_SERVICE_ACCOUNT_PROVIDER_ID]: validateSentryServiceAccount,
-  [SEMRUSH_SERVICE_ACCOUNT_PROVIDER_ID]: validateSemrushServiceAccount,
   [ROOTLY_SERVICE_ACCOUNT_PROVIDER_ID]: validateRootlyServiceAccount,
   [RESEND_SERVICE_ACCOUNT_PROVIDER_ID]: validateResendServiceAccount,
   [PAGERDUTY_SERVICE_ACCOUNT_PROVIDER_ID]: validatePagerDutyServiceAccount,

apps/sim/lib/credentials/token-service-accounts/server.ts

@@ -46,6 +46,13 @@ interface TokenCheck {
    * before {@link forbiddenMeansScoped} accepts a 403.
    */
   rejectsKey?: (errorBody: unknown) => boolean
+  /**
+   * For a vendor that answers a valid but restricted key with an error naming
+   * the missing permission (Resend's `restricted_api_key` 401): returns whether
+   * the error body proves the key authenticated. Checked after
+   * {@link rejectsKey}.
+   */
+  provesKey?: (errorBody: unknown) => boolean
 }
 
 const MAX_CHECK_RESPONSE_BYTES = 64 * 1024
@@ -82,12 +89,13 @@ export function tokenCheckValidator(check: TokenCheck): TokenServiceAccountValid
       check.forbiddenMeansScoped &&
       response.status === 403 &&
       (response.headers.get('content-type') ?? '').includes('application/json')
-    if (check.rejectsKey && !response.ok) {
+    if ((check.rejectsKey || check.provesKey) && !response.ok) {
       const unreadable = Symbol('unreadable')
       const errorBody = await readJsonBody(response, check.serviceLabel).catch(() => unreadable)
-      if (errorBody !== unreadable && check.rejectsKey(errorBody)) {
+      if (errorBody !== unreadable && check.rejectsKey?.(errorBody)) {
         throw new TokenServiceAccountValidationError('invalid_credentials', 400, { step: 'verify' })
       }
+      if (errorBody !== unreadable && check.provesKey?.(errorBody)) return accepted
       if (scopedForbidden) {
         // Only a body that was read and doesn't name a bad key proves the token.
         if (errorBody === unreadable) {

apps/sim/lib/credentials/token-service-accounts/validators/http.ts

@@ -3,6 +3,7 @@ import { describe, expect, it, vi } from 'vitest'
 import {
   validateAshbyServiceAccount,
   validateBrexServiceAccount,
+  validateElevenLabsServiceAccount,
   validateFlintServiceAccount,
   validateInstantlyServiceAccount,
   validateResendServiceAccount,
@@ -238,3 +239,38 @@ describe('Vercel saved token verification', () => {
     })
   })
 })
+
+describe('ElevenLabs saved API key verification', () => {
+  it('accepts a valid key without the user permission', async () => {
+    vi.stubGlobal(
+      'fetch',
+      vi
+        .fn()
+        .mockResolvedValue(
+          jsonResponse({ detail: { status: 'missing_permissions', message: 'user_read' } }, 401)
+        )
+    )
+
+    await expect(
+      validateElevenLabsServiceAccount({ apiToken: 'sk_scoped' })
+    ).resolves.toMatchObject({ displayName: 'ElevenLabs' })
+  })
+
+  it('rejects an unknown key', async () => {
+    vi.stubGlobal(
+      'fetch',
+      vi
+        .fn()
+        .mockResolvedValue(
+          jsonResponse(
+            { detail: { status: 'invalid_api_key', message: 'API key is invalid.' } },
+            400
+          )
+        )
+    )
+
+    await expect(validateElevenLabsServiceAccount({ apiToken: 'sk_bad' })).rejects.toMatchObject({
+      code: 'invalid_credentials',
+    })
+  })
+})