feat(credentials): saved AWS and Databricks credentials with keyless OIDC

apps/docs/content/docs/integrations/aws-credentials.mdx

@@ -0,0 +1,59 @@
+---
+title: AWS credentials
+description: Save an AWS identity once and use it across every AWS block, with access keys, an assumed IAM role, or a keyless role that trusts Sim through OpenID Connect
+---
+
+import { Callout } from '@/components/ui/callout'
+import { Step, Steps } from '@/components/ui/steps'
+
+An AWS credential holds one AWS identity for the whole workspace. Every AWS block (S3, DynamoDB, Lambda, SQS, Athena, CloudWatch, and the rest) can select it instead of taking access keys typed into the block.
+
+<Callout type="info">
+Blocks that already use access keys keep working exactly as they are. Selecting a saved credential is optional; clear it and the block goes back to its own keys.
+</Callout>
+
+## Choose how Sim signs in
+
+| Option | What Sim stores | When to use it |
+| --- | --- | --- |
+| **IAM role (keyless, via Sim OIDC)** | Nothing secret: only the role ARN | Recommended. No long-lived keys to rotate or leak. |
+| **Access keys that assume an IAM role** | An access key pair, used only to assume the role | Your AWS account doesn't allow OIDC providers, or you need an external ID. |
+| **Access keys** | An access key pair | The same behavior as keys typed into a block, shared across blocks. |
+
+Every option resolves on Sim's servers at run time. Keys and session tokens never appear in block outputs, logs, or anything a model sees. Each assumed-role session is named `sim-<execution ID>`, so runs are traceable in CloudTrail.
+
+## Set up a keyless IAM role [#keyless-role]
+
+<Steps>
+  <Step>
+    In Sim, open **Integrations**, add an **AWS credential**, and choose **IAM role (keyless, via Sim OIDC)**. Keep the dialog open; it shows the values for the next steps.
+  </Step>
+  <Step>
+    In the AWS IAM console, open **Identity providers → Add provider**, choose **OpenID Connect**, and enter the **Identity provider URL** and **Audience** from the dialog. You only do this once per AWS account.
+  </Step>
+  <Step>
+    Create a role (or edit an existing one) and set its trust policy to the **Role trust policy** shown in the dialog. It trusts only this credential's **Subject**, so no other Sim credential, workspace, or customer can assume the role.
+  </Step>
+  <Step>
+    Attach the permissions your workflows need to the role, then paste its ARN into the dialog and save. Sim verifies the connection by assuming the role before saving it.
+  </Step>
+</Steps>
+
+<Callout type="warn">
+The subject is unique to the credential. Reconnecting a keyless credential with a new subject means updating the role's trust policy to match.
+</Callout>
+
+## Use access keys
+
+Create an IAM user (or use an existing one) with an access key, choose **Access keys** or **Access keys that assume an IAM role**, and enter the key pair. For an assumed role, add the role ARN and, if the role's trust policy requires one, the external ID. Sim checks the keys with `sts:GetCallerIdentity` before saving.
+
+## Self-hosted deployments
+
+Keyless roles need two things on a self-hosted deployment:
+
+- `WORKLOAD_IDENTITY_SIGNING_KEY`: a PKCS#8 PEM RSA private key that signs Sim's tokens.
+- An issuer AWS can reach over the public internet. It defaults to `<NEXT_PUBLIC_APP_URL>/oidc/workload`; set `WORKLOAD_IDENTITY_ISSUER` to pin it. Trust policies reference this URL, so never change it once roles trust it.
+
+To rotate the signing key, move the old key to `WORKLOAD_IDENTITY_PREVIOUS_KEY` and set a new `WORKLOAD_IDENTITY_SIGNING_KEY`. Both keys stay published until you remove the old one.
+
+Without a signing key, the keyless option is unavailable and access keys work as usual.

apps/docs/content/docs/integrations/databricks-credentials.mdx

@@ -0,0 +1,41 @@
+---
+title: Databricks connections
+description: Save a Databricks workspace connection with a personal access token, a service principal OAuth secret, or a keyless service principal that trusts Sim through OpenID Connect
+---
+
+import { Callout } from '@/components/ui/callout'
+import { Step, Steps } from '@/components/ui/steps'
+
+A Databricks connection holds a workspace host and how Sim authenticates to it. The Databricks block can select a saved connection instead of taking a host and token typed into the block.
+
+<Callout type="info">
+Blocks that already use a host and personal access token keep working exactly as they are. Selecting a saved connection is optional.
+</Callout>
+
+## Choose how Sim signs in
+
+| Option | What Sim stores | When to use it |
+| --- | --- | --- |
+| **Service principal (keyless, via Sim OIDC)** | Nothing secret: the host and the service principal's application ID | Recommended. No secret to rotate or leak. |
+| **Service principal OAuth secret** | The application ID and an OAuth secret | Machine-to-machine access where federation isn't set up. Sim exchanges the secret for a short-lived token on each run. |
+| **Personal access token** | A personal access token | The same behavior as a token typed into the block, shared across blocks. |
+
+Every option resolves on Sim's servers at run time; tokens never appear in block outputs, logs, or anything a model sees.
+
+## Set up a keyless service principal [#keyless-service-principal]
+
+<Steps>
+  <Step>
+    In Sim, add a **Databricks connection**, choose **Service principal (keyless, via Sim OIDC)**, and enter the workspace host and the service principal's **application ID**.
+  </Step>
+  <Step>
+    A Databricks account admin runs the **Federation policy** command from the dialog with the service principal's numeric ID. The policy trusts Sim's issuer, the Sim audience, and this connection's subject only.
+  </Step>
+  <Step>
+    Make sure the service principal can access the workspace and the resources your workflows use, then save. Sim verifies the connection by exchanging a token and reading the service principal's identity.
+  </Step>
+</Steps>
+
+## Self-hosted deployments
+
+Keyless connections need `WORKLOAD_IDENTITY_SIGNING_KEY` set and an issuer Databricks can reach over the public internet. See [AWS credentials](/integrations/aws-credentials#self-hosted-deployments) for the same settings.

apps/docs/content/docs/integrations/databricks.mdx

@@ -21,6 +21,8 @@ Cluster operations support creating, configuring, starting, restarting, resizing
 Genie operations create and update spaces, answer natural-language questions, manage conversation history, and retrieve generated SQL, results, and charts. Reuse the conversation ID for follow-ups. Use a space's `etag` when updating it to avoid overwriting concurrent changes. Agent mode supports research reports and response cancellation; it must be enabled in your workspace.
 {/* MANUAL-CONTENT-END */}
 
+Connection guides: [Databricks connections](/integrations/databricks-credentials).
+
 ## Use the block [#usage-instructions]
 
 Execute parameterized SQL and retrieve result chunks, create and manage jobs, submit and repair runs, manage compute clusters and SQL warehouses, and create or update Genie spaces. Ask Genie questions or run agent research, inspect conversations, and retrieve query results and charts. Connect with a personal access token and workspace host URL.

apps/docs/content/docs/integrations/meta.json

@@ -21,6 +21,7 @@
     "atlassian-service-account",
     "attio",
     "attio-service-account",
+    "aws-credentials",
     "azure_data_explorer",
     "azure_devops",
     "bitbucket",
@@ -56,6 +57,7 @@
     "cursor",
     "dagster",
     "databricks",
+    "databricks-credentials",
     "datadog",
     "datagma",
     "daytona",

apps/docs/content/docs/platform/self-hosting/environment-variables.mdx

@@ -160,6 +160,18 @@ Google, GitHub, and Microsoft sign-in, their callback URLs, and the `DISABLE_*_A
 
 OAuth integrations require a provider application and its credentials on a self-hosted deployment. API-key integrations use the keys supplied in their blocks. The full table, redirect-URI format, and setup steps are in [Integrations and OAuth](/platform/self-hosting/integrations-oauth).
 
+### Keyless cloud credentials [#workload-identity]
+
+Saved AWS and Databricks credentials can trust Sim through OpenID Connect instead of storing keys. Leave these unset to offer only key- and secret-based credentials.
+
+| Variable | Description |
+| --- | --- |
+| `WORKLOAD_IDENTITY_SIGNING_KEY` | PKCS#8 PEM RSA private key that signs Sim's workload-identity tokens: `openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048` |
+| `WORKLOAD_IDENTITY_ISSUER` | Issuer URL clouds trust. Defaults to `<NEXT_PUBLIC_APP_URL>/oidc/workload` and must be reachable from the public internet. Never change it once trust policies reference it. |
+| `WORKLOAD_IDENTITY_PREVIOUS_KEY` | During rotation, the retiring key (private or public PEM), still published so tokens it signed keep verifying |
+
+See [AWS credentials](/integrations/aws-credentials#self-hosted-deployments).
+
 ## Access control
 
 Who may sign up and sign in — the allowlists, blocklists, `DISABLE_REGISTRATION`, `DISABLE_INVITATIONS`, `DISABLE_PUBLIC_API`, and `DISABLE_AUTH` — is documented in [Authentication](/platform/self-hosting/authentication).

apps/docs/content/integration-navigation.json

@@ -15,6 +15,9 @@
       "integration": "attio",
       "title": "API keys"
     },
+    "aws-credentials": {
+      "title": "AWS credentials"
+    },
     "box-service-account": {
       "integration": "box",
       "title": "Service accounts"
@@ -27,6 +30,10 @@
       "integration": "clickup",
       "title": "API tokens"
     },
+    "databricks-credentials": {
+      "integration": "databricks",
+      "title": "Databricks connections"
+    },
     "google-service-account": {
       "title": "Google service accounts"
     },

apps/sim/app/api/credentials/workload-identity/route.ts

@@ -0,0 +1,20 @@
+import { prepareWorkloadIdentityContract } from '@/lib/api/contracts/credentials'
+import {
+  defineInternalJsonRoute,
+  internalRateLimits,
+  internalSessionAuth,
+} from '@/lib/api/server/routes'
+import { internalCredentialErrorPolicy } from '@/lib/credentials/api/route-policies'
+import { credentialOperations } from '@/lib/credentials/application/operations'
+import { prepareWorkloadIdentity } from '@/lib/credentials/application/prepare-workload-identity'
+
+export const POST = defineInternalJsonRoute({
+  contract: prepareWorkloadIdentityContract,
+  auth: internalSessionAuth,
+  operation: credentialOperations.prepareWorkloadIdentity,
+  rateLimit: internalRateLimits.user({ bucketName: 'credentials.workload_identity.prepare' }),
+  errorPolicy: internalCredentialErrorPolicy,
+  mapInput: ({ body }) => body,
+  useCase: prepareWorkloadIdentity,
+  present: (result) => result,
+})

apps/sim/app/oidc/workload/.well-known/openid-configuration/route.ts

@@ -0,0 +1,5 @@
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { workloadIdentityDiscoveryResponse } from '@/lib/credentials/workload-identity/responses'
+
+/** OpenID Connect discovery for Sim's workload-identity issuer (keyless cloud credentials). */
+export const GET = withRouteHandler(workloadIdentityDiscoveryResponse)

apps/sim/app/oidc/workload/jwks/route.ts

@@ -0,0 +1,5 @@
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { workloadIdentityJwksResponse } from '@/lib/credentials/workload-identity/responses'
+
+/** Public signing keys for Sim's workload-identity issuer. */
+export const GET = withRouteHandler(workloadIdentityJwksResponse)