@@ -254,6 +254,164 @@ describe('OAuth Token API Routes', () => {
     })
 
     describe('service account path', () => {
+      it('does not return Plaid compound credentials to session-authenticated callers', async () => {
+        authOAuthUtilsMockFns.mockResolveOAuthAccountId.mockResolvedValueOnce({
+          accountId: '',
+          credentialId: 'plaid-credential-id',
+          credentialType: 'service_account',
+          providerId: 'plaid-service-account',
+          workspaceId: 'workspace-id',
+          usedCredentialTable: true,
+        })
+        hybridAuthMockFns.mockCheckSessionOrInternalAuth.mockResolvedValueOnce({
+          success: true,
+          authType: 'session',
+          userId: 'test-user-id',
+        })
+        mockAuthorizeCredentialUse.mockResolvedValueOnce({
+          ok: true,
+          authType: 'session',
+          requesterUserId: 'test-user-id',
+          workspaceId: 'workspace-id',
+        })
+
+        const response = await POST(
+          createMockRequest('POST', {
+            credentialId: 'plaid-credential-id',
+            toolId: 'plaid_get_item',
+          })
+        )
+        const data = await response.json()
+
+        expect(response.status).toBe(403)
+        expect(data).toEqual({
+          code: 'PLAID_CREDENTIAL_EXECUTOR_ONLY',
+          error: 'Plaid Item credentials can only be used by server-side workflow execution',
+        })
+        expect(mockResolveServiceAccountToken).not.toHaveBeenCalled()
+      })
+
+      it('does not reveal the Plaid-only policy before credential authorization', async () => {
+        authOAuthUtilsMockFns.mockResolveOAuthAccountId.mockResolvedValueOnce({
+          accountId: '',
+          credentialId: 'plaid-credential-id',
+          credentialType: 'service_account',
+          providerId: 'plaid-service-account',
+          workspaceId: 'workspace-id',
+          usedCredentialTable: true,
+        })
+        hybridAuthMockFns.mockCheckSessionOrInternalAuth.mockResolvedValueOnce({
+          success: true,
+          authType: 'session',
+          userId: 'other-user-id',
+        })
+        mockAuthorizeCredentialUse.mockResolvedValueOnce({
+          ok: false,
+          error: 'You do not have access to this credential.',
+        })
+
+        const response = await POST(
+          createMockRequest('POST', {
+            credentialId: 'plaid-credential-id',
+            toolId: 'plaid_get_item',
+          })
+        )
+
+        expect(response.status).toBe(403)
+        await expect(response.json()).resolves.toEqual({
+          error: 'You do not have access to this credential.',
+        })
+        expect(mockResolveServiceAccountToken).not.toHaveBeenCalled()
+      })
+
+      it('returns Plaid compound credentials to a verified internal executor JWT', async () => {
+        authOAuthUtilsMockFns.mockResolveOAuthAccountId.mockResolvedValueOnce({
+          accountId: '',
+          credentialId: 'plaid-credential-id',
+          credentialType: 'service_account',
+          providerId: 'plaid-service-account',
+          workspaceId: 'workspace-id',
+          usedCredentialTable: true,
+        })
+        hybridAuthMockFns.mockCheckSessionOrInternalAuth.mockResolvedValueOnce({
+          success: true,
+          authType: 'internal_jwt',
+          userId: 'test-user-id',
+        })
+        mockAuthorizeCredentialUse.mockResolvedValueOnce({
+          ok: true,
+          authType: 'internal_jwt',
+          requesterUserId: 'test-user-id',
+          workspaceId: 'workspace-id',
+        })
+        mockResolveServiceAccountToken.mockResolvedValueOnce({
+          accessToken: 'access-production-item',
+          plaid: {
+            clientId: 'client-id',
+            secret: 'environment-secret',
+            environment: 'production',
+          },
+        })
+        mockGetToolMetadata.mockReturnValueOnce({ id: 'plaid_get_item', params: {} })
+
+        const response = await POST(
+          createMockRequest('POST', {
+            credentialId: 'plaid-credential-id',
+            toolId: 'plaid_get_item',
+          })
+        )
+        const data = await response.json()
+
+        expect(response.status).toBe(200)
+        expect(data).toEqual({
+          accessToken: 'access-production-item',
+          plaid: {
+            clientId: 'client-id',
+            secret: 'environment-secret',
+            environment: 'production',
+          },
+        })
+      })
+
+      it.each(['gmail_read', 'plaid_fake'])(
+        'rejects a Plaid credential selected for untrusted tool %s before resolving secrets',
+        async (toolId) => {
+          authOAuthUtilsMockFns.mockResolveOAuthAccountId.mockResolvedValueOnce({
+            accountId: '',
+            credentialId: 'plaid-credential-id',
+            credentialType: 'service_account',
+            providerId: 'plaid-service-account',
+            workspaceId: 'workspace-id',
+            usedCredentialTable: true,
+          })
+          hybridAuthMockFns.mockCheckSessionOrInternalAuth.mockResolvedValueOnce({
+            success: true,
+            authType: 'internal_jwt',
+            userId: 'test-user-id',
+          })
+          mockAuthorizeCredentialUse.mockResolvedValueOnce({
+            ok: true,
+            authType: 'internal_jwt',
+            requesterUserId: 'test-user-id',
+            workspaceId: 'workspace-id',
+          })
+
+          const response = await POST(
+            createMockRequest('POST', {
+              credentialId: 'plaid-credential-id',
+              toolId,
+            })
+          )
+
+          expect(response.status).toBe(403)
+          await expect(response.json()).resolves.toEqual({
+            code: 'PLAID_CREDENTIAL_TOOL_MISMATCH',
+            error: 'Plaid Item credentials can only be used with Plaid tools',
+          })
+          expect(mockResolveServiceAccountToken).not.toHaveBeenCalled()
+        }
+      )
+
       it('threads the NetSuite SuiteTalk instance URL into the token response', async () => {
         const instanceUrl = 'https://1234567.suitetalk.api.netsuite.com'
         authOAuthUtilsMockFns.mockResolveOAuthAccountId.mockResolvedValueOnce({
 
@@ -9,7 +9,11 @@ import {
   oauthTokenPostContract,
 } from '@/lib/api/contracts/oauth-connections'
 import { getValidationErrorMessage, parseRequest } from '@/lib/api/server'
-import { authorizeCredentialUse } from '@/lib/auth/credential-access'
+import {
+  authorizeCredentialUse,
+  authorizeCredentialUseForAuth,
+  type CredentialAccessResult,
+} from '@/lib/auth/credential-access'
 import { AuthType, checkSessionOrInternalAuth } from '@/lib/auth/hybrid'
 import { asOrchestrationError, statusForOrchestrationError } from '@/lib/core/orchestration/types'
 import { generateRequestId } from '@/lib/core/utils/request'
@@ -22,6 +26,7 @@ import { resolveManagedOAuthCredentialToken } from '@/lib/credentials/applicatio
 import { ManagedOAuthCredentialError } from '@/lib/credentials/managed-oauth'
 import { getCredential, getOAuthToken, resolveOAuthAccountId } from '@/lib/oauth/credential-service'
 import { completeOAuthCredentialToken, resolveCredentialToken } from '@/lib/oauth/token-resolution'
+import { PLAID_SERVICE_ACCOUNT_PROVIDER_ID } from '@/lib/oauth/types'
 import { getCanonicalScopesForProvider } from '@/lib/oauth/utils'
 import { captureServerEvent } from '@/lib/posthog/server'
 import { getToolMetadata } from '@/tools/metadata'
@@ -251,6 +256,52 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
     }
 
     const auth = await checkSessionOrInternalAuth(request, { requireWorkflowId: false })
+    let preauthorizedCredentialAccess: CredentialAccessResult | undefined
+
+    /**
+     * Plaid requires both its application secret and long-lived Item access
+     * token to stay server-side. Unlike the ordinary OAuth/service-account
+     * payloads used by browser-backed selectors, this compound credential may
+     * therefore cross this route only for a verified internal executor JWT.
+     * Authorize first so the rejection cannot be used to probe whether an
+     * arbitrary credential id belongs to Plaid.
+     */
+    if (
+      resolved?.credentialType === 'service_account' &&
+      resolved.providerId === PLAID_SERVICE_ACCOUNT_PROVIDER_ID
+    ) {
+      const authz = credentialId
+        ? await authorizeCredentialUseForAuth(auth, {
+            credentialId,
+            workflowId: workflowId ?? undefined,
+            callerUserId,
+          })
+        : { ok: false, error: 'Credential ID is required' }
+      if (!authz.ok) {
+        return NextResponse.json({ error: authz.error || 'Unauthorized' }, { status: 403 })
+      }
+      preauthorizedCredentialAccess = authz
+      if (auth.authType !== AuthType.INTERNAL_JWT) {
+        return NextResponse.json(
+          {
+            code: 'PLAID_CREDENTIAL_EXECUTOR_ONLY',
+            error: 'Plaid Item credentials can only be used by server-side workflow execution',
+          },
+          { status: 403 }
+        )
+      }
+      const plaidToolMetadata = toolId ? getToolMetadata(toolId) : undefined
+      if (!plaidToolMetadata?.id.startsWith('plaid_')) {
+        return NextResponse.json(
+          {
+            code: 'PLAID_CREDENTIAL_TOOL_MISMATCH',
+            error: 'Plaid Item credentials can only be used with Plaid tools',
+          },
+          { status: 403 }
+        )
+      }
+    }
+
     const result = await resolveCredentialToken(auth, {
       requestId,
       credentialId,
@@ -260,6 +311,7 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
       callerUserId,
       auditRequest: request,
       resolvedCredential: resolved,
+      preauthorizedCredentialAccess,
     })
 
     if (!result.ok) {
 
@@ -25,9 +25,11 @@ import {
 import { getServiceAccountCoverageSentence } from '@/lib/integrations/credential-display'
 import {
   ATLASSIAN_SERVICE_ACCOUNT_PROVIDER_ID,
+  PLAID_SERVICE_ACCOUNT_PROVIDER_ID,
   SLACK_CUSTOM_BOT_PROVIDER_ID,
 } from '@/lib/oauth/types'
 import { ClientCredentialAccountModal } from '@/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal/client-credential-account-modal'
+import { PlaidServiceAccountModal } from '@/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal/plaid-service-account-modal'
 import { TokenServiceAccountModal } from '@/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal/token-service-account-modal'
 import { ConnectSlackBotModal } from '@/app/workspace/[workspaceId]/integrations/components/connect-slack-bot-modal/connect-slack-bot-modal'
 import { withBrandIcon } from '@/blocks/brand-icon'
@@ -44,6 +46,7 @@ export type ServiceAccountProviderId =
   | typeof GOOGLE_SERVICE_ACCOUNT_PROVIDER_ID
   | typeof ATLASSIAN_SERVICE_ACCOUNT_PROVIDER_ID
   | typeof SLACK_CUSTOM_BOT_PROVIDER_ID
+  | typeof PLAID_SERVICE_ACCOUNT_PROVIDER_ID
   | TokenServiceAccountProviderId
   | ClientCredentialAccountProviderId
 
@@ -136,6 +139,8 @@ interface ConnectServiceAccountModalProps {
  * - `atlassian-service-account`: API token + site domain. Validated by the
  *   server against the Atlassian API; user-facing errors are mapped from the
  *   route's `error.code`.
+ * - `plaid-service-account`: application client ID + environment secret + one
+ *   Item access token. Validated server-side against Plaid `/item/get`.
  */
 export function ConnectServiceAccountModal({
   open,
@@ -211,6 +216,21 @@ export function ConnectServiceAccountModal({
       />
     )
   }
+  if (serviceAccountProviderId === PLAID_SERVICE_ACCOUNT_PROVIDER_ID) {
+    return (
+      <PlaidServiceAccountModal
+        open={open}
+        onOpenChange={onOpenChange}
+        workspaceId={workspaceId}
+        serviceName={serviceName}
+        serviceIcon={serviceIcon}
+        credentialId={credentialId}
+        initialDisplayName={credentialDisplayName}
+        initialDescription={credentialDescription}
+        onCreated={onCreated}
+      />
+    )
+  }
   return (
     <GoogleServiceAccountModal
       open={open}