docs(credentials): fix keyless setup instructions and copy

- AWS: enter the Role ARN before setting the trust policy, so it never carries
  the <AWS_ACCOUNT_ID> placeholder IAM rejects (dialog hint and docs).
- Databricks: the federation-policy command needs an account-level CLI login.
- Google: a valid sample pool ID, ID format hints, user-managed service accounts
  only, skip the pool command when the pool exists, and the API list from
  Google's guide (adds Resource Manager).
- Bitbucket: workspace and project access tokens need Premium; repository
  tokens do not.
- Snowflake: rename SIM_WORKFLOWS if it exists; USERADMIN runs the statement.
- Microsoft keyless dialog says where the federated credential goes.
- Server errors name the trust values for API and CLI callers too; Google
  Workspace and Account ID wording; AWS catalog hint mentions stsRegion; the
  CLI keyless example uses aws-service-account throughout.
- Self-hosting env vars list every keyless provider.

Author: waleedlatif1

apps/docs/content/docs/cli/credentials.mdx

@@ -100,9 +100,9 @@ The proof expires after 24 hours and works only for the user who requested it, w
 **Examples**
 
 ```bash
-sim credentials keyless-subject <providerId> --output json > subject.json
+sim credentials keyless-subject aws-service-account --output json > subject.json
 jq '.keylessConfig + {"roleArn":"arn:aws:iam::123456789012:role/SimWorkflows"}' subject.json > keyless.json
-sim credentials create <providerId> --name "Keyless" --credentials @keyless.json
+sim credentials create aws-service-account --name "Keyless" --credentials @keyless.json
 ```
 
 API request and response schemas: [createServiceAccountCredential](/api-reference/credentials/createServiceAccountCredential).
@@ -373,9 +373,9 @@ The proof expires after 24 hours and works only for the user who requested it, w
 **Examples**
 
 ```bash
-sim credentials keyless-subject <providerId> --output json > subject.json
+sim credentials keyless-subject aws-service-account --output json > subject.json
 jq '.keylessConfig + {"roleArn":"arn:aws:iam::123456789012:role/SimWorkflows"}' subject.json > keyless.json
-sim credentials create <providerId> --name "Keyless" --credentials @keyless.json
+sim credentials create aws-service-account --name "Keyless" --credentials @keyless.json
 ```
 
 API request and response schemas: [createCredentialWorkloadIdentitySubject](/api-reference/credentials/createCredentialWorkloadIdentitySubject).

apps/docs/content/docs/cli/reference.mdx

@@ -786,9 +786,9 @@ The proof expires after 24 hours and works only for the user who requested it, w
 **Examples**
 
 ```bash
-sim credentials keyless-subject <providerId> --output json > subject.json
+sim credentials keyless-subject aws-service-account --output json > subject.json
 jq '.keylessConfig + {"roleArn":"arn:aws:iam::123456789012:role/SimWorkflows"}' subject.json > keyless.json
-sim credentials create <providerId> --name "Keyless" --credentials @keyless.json
+sim credentials create aws-service-account --name "Keyless" --credentials @keyless.json
 ```
 
 API request and response schemas: [createServiceAccountCredential](/api-reference/credentials/createServiceAccountCredential).
@@ -822,9 +822,9 @@ The proof expires after 24 hours and works only for the user who requested it, w
 **Examples**
 
 ```bash
-sim credentials keyless-subject <providerId> --output json > subject.json
+sim credentials keyless-subject aws-service-account --output json > subject.json
 jq '.keylessConfig + {"roleArn":"arn:aws:iam::123456789012:role/SimWorkflows"}' subject.json > keyless.json
-sim credentials create <providerId> --name "Keyless" --credentials @keyless.json
+sim credentials create aws-service-account --name "Keyless" --credentials @keyless.json
 ```
 
 API request and response schemas: [createCredentialWorkloadIdentitySubject](/api-reference/credentials/createCredentialWorkloadIdentitySubject).

apps/docs/content/docs/integrations/aws-credentials.mdx

@@ -36,10 +36,13 @@ STS **Get Session Token** works only with an **Access keys** credential: AWS ref
     In the AWS IAM console, open **Identity providers → Add provider**, choose **OpenID Connect**, and enter the dialog's **Issuer** as the **Provider URL**, and its **Audience**. You only do this once per AWS account.
   </Step>
   <Step>
-    Create a role (or edit an existing one) and set its trust policy to the **Role trust policy** shown in the dialog. It trusts only this credential's **Subject**, so no other Sim credential, workspace, or customer can assume the role.
+    Enter the role's ARN (`arn:aws:iam::<account ID>:role/<role name>`) in the dialog first. The **Role trust policy** fills in its account ID; until then it shows `<AWS_ACCOUNT_ID>`, which IAM rejects.
   </Step>
   <Step>
-    Attach the permissions your workflows need to the role, then paste its ARN into the dialog and save. Sim verifies the connection by assuming the role before saving it, and refuses a role that would also trust a different subject.
+    Create the role with that name (or edit the existing one) and set its trust policy to the **Role trust policy** shown in the dialog. It trusts only this credential's **Subject**, so no other Sim credential, workspace, or customer can assume the role.
+  </Step>
+  <Step>
+    Attach the permissions your workflows need to the role, then save. Sim verifies the connection by assuming the role before saving it, and refuses a role that would also trust a different subject.
   </Step>
 </Steps>
 

apps/docs/content/docs/integrations/bitbucket-service-account.mdx

@@ -12,7 +12,7 @@ Bitbucket shows actions taken with the token (comments, merges, pipeline runs) u
 
 ## Prerequisites
 
-Admin access to the workspace, project, or repository the token is for. Workspace access tokens require a Bitbucket Cloud Premium plan; project and repository access tokens do not.
+Admin access to the workspace, project, or repository the token is for. Workspace and project access tokens require a Bitbucket Cloud Premium plan; repository access tokens do not.
 
 ## Create the access token [#creating-the-access-token]
 

apps/docs/content/docs/integrations/databricks-credentials.mdx

@@ -29,7 +29,7 @@ Every option resolves on Sim's servers at run time; tokens never appear in block
     In Sim, add a **Databricks connection**, choose **Service principal (keyless, via Sim OIDC)**, and enter the workspace host and the service principal's **application ID**.
   </Step>
   <Step>
-    A Databricks account admin runs the **Federation policy** command from the dialog with the service principal's numeric ID (find it with `databricks account service-principals list --filter 'applicationId eq "<application ID>"'`, or on the service principal's page in the account console). The policy trusts Sim's issuer, the Sim audience, and this connection's subject only.
+    A Databricks account admin runs the **Federation policy** command from the dialog with the service principal's numeric ID. First sign in to the account with `databricks auth login --host <account console URL> --account-id <account ID>` (not a workspace profile or the workspace web terminal). Find the numeric ID with `databricks account service-principals list --filter 'applicationId eq "<application ID>"'`, or on the service principal's page in the account console. The policy trusts Sim's issuer, the Sim audience, and this connection's subject only.
   </Step>
   <Step>
     Make sure the service principal can access the workspace and the resources your workflows use, then save. Sim verifies the connection by exchanging a token and reading the service principal's identity, and refuses a policy that would also trust a different subject, since every Sim workspace shares the issuer and audience.

apps/docs/content/docs/integrations/google-service-account.mdx

@@ -185,16 +185,16 @@ Keyless credentials work with Google Cloud APIs that the service account calls a
 
 <Steps>
   <Step>
-    In the [Google Cloud Console](https://console.cloud.google.com/), enable the IAM, Service Account Credentials, and Security Token Service APIs in the project that will hold the workload identity pool, and note its **project number** (on the project's Dashboard; it's numeric, not the project ID).
+    In the [Google Cloud Console](https://console.cloud.google.com/), enable the IAM, Resource Manager, Service Account Credentials, and Security Token Service APIs in the project that will hold the workload identity pool, and note its **project number** (on the project's Dashboard; it's numeric, not the project ID).
   </Step>
   <Step>
     Create or pick a service account, and grant it the roles your workflows need (for example, BigQuery Data Viewer and BigQuery Job User, or Vertex AI User). No key is needed.
   </Step>
   <Step>
-    In Sim, open the **Google BigQuery** integration, choose **Add service account**, and set **Authentication** to **Workload Identity Federation (keyless, via Sim OIDC)**. Enter the project number, a pool ID and provider ID (4 to 32 lowercase letters, digits, or hyphens, not starting with `gcp-`), and the service account email (`name@project-id.iam.gserviceaccount.com`).
+    In Sim, open the **Google BigQuery** integration, choose **Add service account**, and set **Authentication** to **Workload Identity Federation (keyless, via Sim OIDC)**. Enter the project number, a pool ID and provider ID (4 to 32 lowercase letters, digits, or hyphens, not starting with `gcp-`), and the service account email (`name@project-id.iam.gserviceaccount.com`; user-managed service account only, so default accounts such as `…@developer.gserviceaccount.com` are refused).
   </Step>
   <Step>
-    The dialog shows the **Issuer**, **Audience**, and **Subject**, and three `gcloud` commands with your values filled in. Run them in that project. They run against the project number you entered and create the pool, an OIDC provider for Sim's issuer with the attribute mapping `google.subject=assertion.sub` and an attribute condition that accepts only this credential's subject, and grant that subject `roles/iam.workloadIdentityUser` on the service account:
+    The dialog shows the **Issuer**, **Audience**, and **Subject**, and three `gcloud` commands with your values filled in. Run them in that project. They run against the project number you entered and create the pool, an OIDC provider for Sim's issuer with the attribute mapping `google.subject=assertion.sub` and an attribute condition that accepts only this credential's subject, and grant that subject `roles/iam.workloadIdentityUser` on the service account. If the pool already exists, skip the first command:
 
     ```bash
     gcloud iam workload-identity-pools create POOL_ID \

apps/docs/content/docs/integrations/snowflake-service-account.mdx

@@ -24,7 +24,7 @@ Snowflake's [workload identity federation](https://docs.snowflake.com/en/user-gu
     In Sim, add a **Snowflake** connection, choose **Service user (keyless, via Sim OIDC)**, and enter the account host (`myorg-myaccount.snowflakecomputing.com`). The dialog shows the issuer, audience, and subject for this connection, and the statement to run.
   </Step>
   <Step>
-    A user whose role can create users (and has `OWNERSHIP` or `MODIFY PROGRAMMATIC AUTHENTICATION METHODS` on the user) runs the statement from the dialog. It looks like this:
+    A user whose role can create users (for example USERADMIN) runs the statement from the dialog. Rename the user if SIM_WORKFLOWS already exists. It looks like this:
 
 ```sql
 CREATE USER SIM_WORKFLOWS

apps/docs/content/docs/platform/self-hosting/environment-variables.mdx

@@ -162,7 +162,7 @@ OAuth integrations require a provider application and its credentials on a self-
 
 ### Keyless cloud credentials [#workload-identity]
 
-Saved AWS and Databricks credentials can trust Sim through OpenID Connect instead of storing keys. Leave these unset to offer only key- and secret-based credentials.
+Saved AWS, Databricks, Snowflake, Microsoft app, and Google Cloud credentials can trust Sim through OpenID Connect instead of storing keys. Leave these unset to offer only key- and secret-based credentials.
 
 | Variable | Description |
 | --- | --- |

apps/docs/scripts/fixtures/content-baseline.json

@@ -3016,7 +3016,7 @@
         {
           "lang": "bash",
           "meta": null,
-          "sha256": "e7dfe3c54d5966f79a4c8fcc7287fe9c29e893326977e4264a7cdc35822c076f",
+          "sha256": "48d4019bc1905094aec776873af1d5a4e94ec2f52d043c51bbbb559b6a876944",
           "bytes": 262,
           "line": 102
         },
@@ -3079,7 +3079,7 @@
         {
           "lang": "bash",
           "meta": null,
-          "sha256": "e7dfe3c54d5966f79a4c8fcc7287fe9c29e893326977e4264a7cdc35822c076f",
+          "sha256": "48d4019bc1905094aec776873af1d5a4e94ec2f52d043c51bbbb559b6a876944",
           "bytes": 262,
           "line": 375
         }
@@ -11190,7 +11190,7 @@
         {
           "lang": "bash",
           "meta": null,
-          "sha256": "e7dfe3c54d5966f79a4c8fcc7287fe9c29e893326977e4264a7cdc35822c076f",
+          "sha256": "48d4019bc1905094aec776873af1d5a4e94ec2f52d043c51bbbb559b6a876944",
           "bytes": 262,
           "line": 788
         },
@@ -11204,7 +11204,7 @@
         {
           "lang": "bash",
           "meta": null,
-          "sha256": "e7dfe3c54d5966f79a4c8fcc7287fe9c29e893326977e4264a7cdc35822c076f",
+          "sha256": "48d4019bc1905094aec776873af1d5a4e94ec2f52d043c51bbbb559b6a876944",
           "bytes": 262,
           "line": 824
         },

apps/sim/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal/aws-account-modal.tsx

@@ -259,7 +259,7 @@ function AwsAccountForm({
           <ChipModalField
             type='custom'
             title='Role trust policy'
-            hint='Add the issuer and audience above as an IAM identity provider (once per AWS account), set this as the role’s trust policy, then grant the role the permissions your workflows need.'
+            hint='Enter the Role ARN first; the policy fills in its account ID. Add the issuer and audience above as an IAM identity provider (once per AWS account), set this as the role’s trust policy, then grant the role the permissions your workflows need.'
           >
             {(aria) => (
               <ChipTextarea