@@ -9,6 +9,7 @@ import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 vi.mock('@/lib/core/security/encryption', () => encryptionMock)
 vi.mock('@/lib/credentials/workload-identity/issuer', () => ({
+  MAX_WORKLOAD_IDENTITY_TOKEN_TTL_SECONDS: 3600,
   mintWorkloadIdentityToken: async ({ subject }: { subject: string }) => `token-for:${subject}`,
 }))
 
 
@@ -12,6 +12,7 @@ import {
 } from '@/lib/credentials/token-service-accounts/errors'
 import { WORKLOAD_IDENTITY_AUDIENCES } from '@/lib/credentials/workload-identity/audiences'
 import {
+  MAX_WORKLOAD_IDENTITY_TOKEN_TTL_SECONDS,
   mintWorkloadIdentityToken,
   type WorkloadIdentityOwner,
 } from '@/lib/credentials/workload-identity/issuer'
@@ -183,7 +184,7 @@ async function resolveDatabricksAccessToken(
     audience: DATABRICKS_WORKLOAD_IDENTITY_AUDIENCE,
     owner,
     // Databricks' token expires with this one, and Genie polls for up to five minutes.
-    ttlSeconds: 3600,
+    ttlSeconds: MAX_WORKLOAD_IDENTITY_TOKEN_TTL_SECONDS,
   })
   return requestWorkspaceToken(
     config.host,
 
@@ -45,7 +45,7 @@ interface TokenCheck {
    * of a plain fetch.
    */
   egress?: Extract<EgressProfile, 'configuredEndpoint' | 'selfHostedService'>
-  /** The vendor echoes the token in its error body, so that body is never read into logs. */
+  /** The vendor echoes the token in its error body, so that body never reaches logs or error details. */
   errorBodyEchoesToken?: boolean
   /**
    * A cheap documented read that succeeds only with a valid token — the same
@@ -62,14 +62,10 @@ interface TokenCheck {
   forbiddenMeansScoped?: boolean
   /**
    * For a vendor that reports a rejected key inside a successful response (a
-   * GraphQL `errors` array): returns whether the parsed body proves the key.
+   * GraphQL `errors` array): returns whether the parsed body proves the key, or
+   * a display name read from it (a GitLab token's name) when it does.
    */
-  acceptsBody?: (body: unknown) => boolean
-  /**
-   * Names the credential from the verified reply (a GitLab token's name), used
-   * as its default display name alongside the domain or account id.
-   */
-  describe?: (body: unknown) => string | undefined
+  acceptsBody?: (body: unknown) => boolean | { displayName: string }
   /**
    * For a vendor whose error status alone doesn't say the key is bad (Fireflies
    * returns 500 with `auth_failed`; Brex returns its scope-error 403 for an
@@ -98,6 +94,49 @@ export function readJsonBody(response: ProviderResponse, serviceLabel: string):
   })
 }
 
+/**
+ * A typed http(s) base URL in the form tools build request paths on: a bare host
+ * is taken as https, trailing slashes are dropped, and any other scheme,
+ * credentials, a query, or a fragment is refused, since each would retarget the
+ * request. `allowPath: false` also refuses a path, for tools that append to the
+ * origin.
+ */
+export function normalizeHttpBaseUrl(
+  raw: string | undefined,
+  { allowPath = true }: { allowPath?: boolean } = {}
+): string {
+  const typed = (raw ?? '').trim()
+  if (!typed) throw new Error('missing URL')
+  const url = new URL(/^[a-z][a-z\d+.-]*:\/\//i.test(typed) ? typed : `https://${typed}`)
+  if (url.protocol !== 'https:' && url.protocol !== 'http:') throw new Error('http(s) only')
+  if (url.username || url.password || url.search || url.hash) {
+    throw new Error('credentials, query, or fragment in URL')
+  }
+  const path = url.pathname.replace(/\/+$/, '')
+  if (path && !allowPath) throw new Error('path not allowed')
+  return `${url.origin}${path}`
+}
+
+/**
+ * Refuses a typed URL that carries credentials, before a tool's own normalizer
+ * can drop them silently and verify a different identity than the user meant.
+ */
+export function refuseUrlCredentials(raw: string | undefined): string {
+  const typed = (raw ?? '').trim()
+  const authority = typed.replace(/^[a-z][a-z\d+.-]*:\/\//i, '').split(/[/?#]/)[0]
+  if (authority.includes('@')) throw new Error('credentials in URL')
+  return typed
+}
+
+/** A domain that must be one of a fixed set (a region or regional host), compared case-insensitively. */
+export function allowedDomain(allowed: ReadonlySet<string>) {
+  return ({ domain }: TokenServiceAccountFields): string => {
+    const value = (domain ?? '').trim().toLowerCase()
+    if (!allowed.has(value)) throw new Error('unknown region')
+    return value
+  }
+}
+
 /** Runs `normalize` on a typed connection field, rejecting what it refuses as the user's input. */
 function normalizedField(
   normalize: ((fields: TokenServiceAccountFields) => string) | undefined,
@@ -224,6 +263,7 @@ export function tokenCheckValidator(check: TokenCheck): TokenServiceAccountValid
     }
     if (!scopedForbidden && !response.ok) {
       if (!check.errorBodyEchoesToken) await throwForProviderResponse(response, 'verify')
+      // The body echoes the token, so it is dropped unread.
       await response.body?.cancel().catch(() => undefined)
       throw new TokenServiceAccountValidationError(
         providerFailureCode(response.status),
@@ -240,11 +280,15 @@ export function tokenCheckValidator(check: TokenCheck): TokenServiceAccountValid
           step: 'verify',
         })
       }
-      if (!check.acceptsBody(body)) {
+      const verdict = check.acceptsBody(body)
+      if (!verdict) {
         throw new TokenServiceAccountValidationError('invalid_credentials', 400, { step: 'verify' })
       }
-      const name = check.describe?.(body)
-      return name ? { ...accepted, displayName: where ? `${name} (${where})` : name } : accepted
+      if (typeof verdict === 'object') {
+        const name = verdict.displayName
+        return { ...accepted, displayName: where ? `${name} (${where})` : name }
+      }
+      return accepted
     }
     await response.body?.cancel().catch(() => undefined)
     return accepted
 
@@ -1,23 +1,40 @@
 import { jsonResponse } from '@sim/testing/helpers/http'
+import {
+  inputValidationMock,
+  inputValidationMockFns,
+} from '@sim/testing/mocks/input-validation.mock'
 import { describe, expect, it, vi } from 'vitest'
+
+vi.mock('@/lib/core/security/input-validation.server', () => inputValidationMock)
+
 import {
   validateAlgoliaServiceAccount,
   validateAshbyServiceAccount,
   validateAzureDevOpsServiceAccount,
   validateBrexServiceAccount,
+  validateConvexServiceAccount,
   validateDevinServiceAccount,
+  validateDynatraceServiceAccount,
   validateElevenLabsServiceAccount,
+  validateEmailBisonServiceAccount,
   validateFlintServiceAccount,
+  validateGrafanaServiceAccount,
+  validateInfisicalServiceAccount,
   validateInstantlyServiceAccount,
   validateJotformServiceAccount,
+  validateJupyterServiceAccount,
+  validateLogfireServiceAccount,
   validateMailgunServiceAccount,
   validateNewRelicServiceAccount,
   validateOktaServiceAccount,
+  validatePlaneServiceAccount,
   validateResendServiceAccount,
   validateSupabaseServiceAccount,
   validateThriveServiceAccount,
+  validateTinybirdServiceAccount,
   validateTwilioServiceAccount,
   validateTypeformServiceAccount,
+  validateUpstashServiceAccount,
   validateVercelServiceAccount,
   validateYouTubeServiceAccount,
 } from '@/lib/credentials/token-service-accounts/validators/token-checks'
@@ -350,3 +367,28 @@ describe('saved credentials whose connection names a host, region, or account',
     ).rejects.toMatchObject({ code: 'invalid_credentials' })
   })
 })
+
+describe('saved credentials for a host the user chose', () => {
+  it.each([
+    ['Convex', validateConvexServiceAccount],
+    ['Dynatrace', validateDynatraceServiceAccount],
+    ['Email Bison', validateEmailBisonServiceAccount],
+    ['Grafana', validateGrafanaServiceAccount],
+    ['Infisical', validateInfisicalServiceAccount],
+    ['Jupyter', validateJupyterServiceAccount],
+    ['Logfire', validateLogfireServiceAccount],
+    ['Plane', validatePlaneServiceAccount],
+    ['Tinybird', validateTinybirdServiceAccount],
+    ['Upstash', validateUpstashServiceAccount],
+  ])(
+    '%s refuses credentials smuggled into the URL before sending the key anywhere',
+    async (_, validate) => {
+      inputValidationMockFns.mockSecureFetchWithValidation.mockReset()
+
+      await expect(
+        validate({ apiToken: 'secret', domain: 'https://user:pass@instance.example.com' })
+      ).rejects.toMatchObject({ code: 'invalid_credentials' })
+      expect(inputValidationMockFns.mockSecureFetchWithValidation).not.toHaveBeenCalled()
+    }
+  )
+})