feat(credentials): token-paste service accounts for 12 providers by waleedlatif1 · Pull Request #5682 · simstudioai/sim

waleedlatif1 · 2026-07-15T02:05:01Z

Summary

Adds workspace-level service-account credentials (paste a long-lived token, verified server-side, encrypted at rest) for 12 providers: HubSpot, Airtable, Notion, Asana, Attio, Linear, monday, Shopify, Webflow, Trello, Cal.com, Wealthbox — mirroring the existing Atlassian pattern
Declarative registry instead of per-provider branches: client-safe descriptors drive the contract validation and a single generic connect modal; server-side validators verify each token against the provider's whoami-style endpoint with SSRF guards and status-code-only error mapping (outages are never blamed on the token)
Migrates the existing Google/Atlassian/Slack service-account dispatch to the same registry pattern (builder + resolver maps, unified required-fields validation) — stored secret formats and runtime behavior unchanged
Linear tools now send the documented bare Authorization header for lin_api_ personal keys via a shared helper (OAuth tokens unchanged); Shopify tools resolve the store domain from service-account credentials
12 setup-guide docs pages under docs/integrations, incl. the Trello authorize-link flow
No DB migration; existing credentials unaffected

Type of Change

New feature

Testing

91 new unit tests for validators + shared error plumbing; full credential/oauth suites green (213 tests); typecheck + check:api-validation pass. Every provider spec was verified against current official API docs by independent review passes.

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

…Spot, Airtable, Notion, Asana, Attio, Linear, monday, Shopify, Webflow, Trello, Cal.com, Wealthbox)

…ied validator hardening - Migrate Google/Atlassian/Slack service-account branches to the same registry pattern as token-paste providers (builder + resolver maps, unified required-fields contract validation) - Fix Shopify service-account store domain never reaching tool URL builders - Linear: rate-limit 400s no longer mislabeled as invalid credentials; validation header matches runtime header rule - Trello: server API key rejection no longer blamed on customer token - Fleet-wide: network errors and non-JSON provider bodies map to provider_unavailable via shared fetchProvider/parseProviderJson - HubSpot: drop regional-host displayName upgrade; Wealthbox: explicit 402; monday: provider-side GraphQL errors mapped correctly; Attio: null-body guard

… for token service accounts - 12 setup-guide docs pages (docs.sim.ai/integrations/<provider>-service-account) incl. the Trello authorize-link flow the integration depends on - Attio: HTTP 400 on /v2/self maps to invalid_credentials (live-verified) - monday: scan all GraphQL errors for provider-side codes; no empty audit ids - Compile-time descriptor/validator lockstep (typed registry) and prototype-safe provider-id guard (Object.hasOwn) - Shared errors.test.ts pinning fetchProvider/parseProviderJson/ throwForProviderResponse guarantees for all validators - Stale TSDoc updated after the registry migration; biome organizeImports pass

vercel · 2026-07-15T02:05:07Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview, Comment	Jul 15, 2026 3:30am

cursor · 2026-07-15T02:05:12Z

PR Summary

Medium Risk
Touches credential create/update, encrypted secret storage, and runtime token resolution for production integrations; mistakes could break auth or accept bad tokens, though behavior is heavily tested and scoped to the new registry paths.

Overview
Introduces token-paste service accounts for HubSpot, Airtable, Notion, Asana, Attio, Linear, monday.com, Shopify, Webflow, Trello, Cal.com, and Wealthbox: workspaces can store long-lived provider tokens that are verified on connect, encrypted, and used at runtime as the access token (no OAuth refresh).

The implementation is registry-driven instead of one-off branches. Client descriptors define modal fields, connect labels, and required API fields; a generic TokenServiceAccountModal handles connect/reconnect; per-provider validators call each vendor’s whoami-style endpoint with shared error mapping (invalid_credentials vs provider_unavailable). verifyAndBuildServiceAccountSecret and resolveServiceAccountToken now dispatch through builder/resolver maps, with token-paste providers handled generically alongside Google, Atlassian, and Slack.

Integration UX uses vendor-accurate connect nouns (e.g. “Add private app token”). Credential create validation pulls required fields from service-account-fields.ts. Linear teams/projects API routes instantiate the SDK with apiKey when the token is lin_api_*, matching tool auth behavior.

Docs: twelve new *-service-account integration guides (scopes, setup steps, FAQs) are registered in meta.json.

^{Reviewed by Cursor Bugbot for commit 2452f96. Configure here.}

…guides 34 corrections from a 12-agent audit against live official vendor docs: current HubSpot Development-area nav, Notion connections rename, monday Developer Center paths, Shopify legacy-vs-Dev-Dashboard token flows, and hedged wording for claims vendors do not document (expiry, limits)

… surfaces 'Add service account' only where the vendor actually has service accounts (Google, Atlassian); token-paste providers now use their own vocabulary via a connectNoun descriptor field — 'Add private app token' (HubSpot), 'Add API key' (Attio/Linear/Cal.com), 'Add personal access token' (Airtable), etc. Docs page titles updated to match; slugs and internal provider ids unchanged

…lid credentials Shopify can reject invalid or revoked shpat_ tokens with HTTP 200 and a GraphQL error body instead of a 401; those now map to invalid_credentials instead of a provider-outage message

waleedlatif1 · 2026-07-15T02:22:29Z

@greptile-apps review

waleedlatif1 · 2026-07-15T02:22:30Z

@cursor review

greptile-apps · 2026-07-15T02:24:48Z

Greptile Summary

This PR adds token-paste service-account credentials across the integration system. The main changes are:

Workspace-level credential setup for twelve token-based providers.
A shared descriptor and validator registry for service-account creation.
Server-side token verification with normalized provider metadata.
Shopify tool URLs that prefer the credential-resolved store domain.
Linear API-key authorization handling and new setup docs.

Confidence Score: 5/5

This looks safe to merge.

No blocking issues found in the changed code.

Important Files Changed

Filename	Overview
apps/sim/lib/credentials/service-account-secret.ts	Routes service-account secret creation through provider-specific builders and rejects unknown non-empty provider IDs.
apps/sim/lib/credentials/token-service-accounts/validators/shopify.ts	Validates Shopify service-account credentials and stores a normalized store domain for runtime tool calls.
apps/sim/tools/shopify/types.ts	Adds the optional credential-resolved Shopify domain parameter used by tool URL builders.
apps/sim/tools/shopify/get_product.ts	Updates Shopify request URL selection to prefer the credential-resolved domain before block parameters.
apps/sim/lib/credentials/token-service-accounts/validators/wealthbox.ts	Validates Wealthbox tokens against the runtime Bearer authentication path.

_{Reviews (3): Last reviewed commit: "fix(credentials): cold-review hardening ..." | Re-trigger Greptile}

Live probing showed the documented access-token-info route returns a bare 404 for unrecognized tokens (ambiguous with a missing route), so 404/400 now falls back to the Account Information API, which answers with a JSON 401 for rejected tokens and 200/403 for live ones — verified against the real endpoints

- Shopify tools prefer the credential-validated store domain over the block's auto-detected shopDomain (a store-bound token must hit its own store) - Unknown non-empty service-account providerIds are rejected instead of silently persisting as google-service-account (empty stays the legacy Google fallback) - Shopify/modal domain normalization strips URL paths ('https://x.myshopify.com/admin') - monday: warning-class GraphQL errors no longer reject a token whose me data proves it authenticated

waleedlatif1 · 2026-07-15T02:40:00Z

@greptile-apps review

waleedlatif1 · 2026-07-15T02:40:01Z

@cursor review

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit dd00d09. Configure here.}

- Object.hasOwn guards on all provider-id registry lookups (crafted '__proto__'/'constructor' providerIds now 400 instead of 500) + regression test - fetchProvider gets a 10s AbortSignal.timeout so a hung provider can't pin the create/reconnect request - HubSpot: unexpected 403 on the token-info route defers to the account-info fallback instead of blaming the token - Linear selector routes use the SDK apiKey option for lin_api_ keys (bare header parity with the tools sweep) - Docs: UI steps aligned to the vendor-noun connect labels; HubSpot scope-propagation claims softened; Trello in-product-link promise corrected

waleedlatif1 · 2026-07-15T03:25:39Z

@greptile-apps review

waleedlatif1 · 2026-07-15T03:25:40Z

@cursor review

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 2452f96. Configure here.}

…alesforce + Pipedrive API tokens Second service-account kind (follow-up to #5682): client-credential pairs (client ID + secret + org identifier) that mint short-lived tokens at execution — in-memory cache with ciphertext-fingerprint validation (rotation-correct across instances), single-flight coalescing, 30s failure memo, no refresh-token storage. - Zoom Server-to-Server OAuth, Box Client Credentials Grant, and Salesforce client-credentials (integration user) are the first minters; Salesforce's live instance_url rides the existing instanceUrl plumbing so all 40 tools work unchanged - Pipedrive lands as a token-paste provider with explicit authStyle threading: descriptor declares x-api-token, one shared header helper drives all 18 tools + both selector routes, OAuth Bearer behavior untouched - SSRF-allowlisted Salesforce My Domain host (production/sandbox/developer partitioned domains); ENOTFOUND maps to site_not_found, EAI_AGAIN stays provider_unavailable; 408/429 from token endpoints never blamed on creds - Create route forwards clientId/clientSecret/orgId to the builder, pinned by a route-level regression test - Zoom user-scoped tools document that server-to-server tokens don't support 'me' - 4 setup-guide docs pages verified against current vendor flows (incl. Salesforce External Client Apps — the classic Connected App wizard is disabled by default since Spring '26); integrations sidebar gains a Service Accounts & API Keys section

…alesforce + Pipedrive API tokens (#5690) Second service-account kind (follow-up to #5682): client-credential pairs (client ID + secret + org identifier) that mint short-lived tokens at execution — in-memory cache with ciphertext-fingerprint validation (rotation-correct across instances), single-flight coalescing, 30s failure memo, no refresh-token storage. - Zoom Server-to-Server OAuth, Box Client Credentials Grant, and Salesforce client-credentials (integration user) are the first minters; Salesforce's live instance_url rides the existing instanceUrl plumbing so all 40 tools work unchanged - Pipedrive lands as a token-paste provider with explicit authStyle threading: descriptor declares x-api-token, one shared header helper drives all 18 tools + both selector routes, OAuth Bearer behavior untouched - SSRF-allowlisted Salesforce My Domain host (production/sandbox/developer partitioned domains); ENOTFOUND maps to site_not_found, EAI_AGAIN stays provider_unavailable; 408/429 from token endpoints never blamed on creds - Create route forwards clientId/clientSecret/orgId to the builder, pinned by a route-level regression test - Zoom user-scoped tools document that server-to-server tokens don't support 'me' - 4 setup-guide docs pages verified against current vendor flows (incl. Salesforce External Client Apps — the classic Connected App wizard is disabled by default since Spring '26); integrations sidebar gains a Service Accounts & API Keys section

waleedlatif1 added 3 commits July 14, 2026 17:21

feat(credentials): token-paste service accounts for 12 providers (Hub…
4bba8b4
…Spot, Airtable, Notion, Asana, Attio, Linear, monday, Shopify, Webflow, Trello, Cal.com, Wealthbox)

cursorBot reviewed Jul 15, 2026
View reviewed changes

Comment threadapps/sim/lib/credentials/token-service-accounts/validators/shopify.ts

vercelBotdeployed to Preview July 15, 2026 02:09 View deployment

vercelBotdeployed to Preview July 15, 2026 02:17 View deployment

waleedlatif1 added 2 commits July 14, 2026 19:19

fix(credentials): classify auth-shaped Shopify GraphQL errors as inva…
afc697c
…lid credentials Shopify can reject invalid or revoked shpat_ tokens with HTTP 200 and a GraphQL error body instead of a 401; those now map to invalid_credentials instead of a provider-outage message

vercelBottemporarily deployed to Preview July 15, 2026 02:22 Inactive

greptile-appsBot reviewed Jul 15, 2026
View reviewed changes

cursorBot reviewed Jul 15, 2026
View reviewed changes

Comment threadapps/sim/lib/credentials/token-service-accounts/validators/monday.ts

vercelBottemporarily deployed to Preview July 15, 2026 02:34 Inactive

vercelBottemporarily deployed to Preview July 15, 2026 02:39 Inactive

cursorBot reviewed Jul 15, 2026
View reviewed changes

chore(credentials): format shopify validator test
5e1ab39

vercelBottemporarily deployed to Preview July 15, 2026 02:55 Inactive

cursorBot reviewed Jul 15, 2026
View reviewed changes

vercelBotdeployed to Preview July 15, 2026 03:30 View deployment

waleedlatif1 merged commit 00a2f26 into stagingJul 15, 2026
18 checks passed

waleedlatif1 deleted the worktree-hubspot-service-accounts branch July 15, 2026 05:52

This was referenced Jul 15, 2026
v0.7.36: mothership secrets resolution, SEO, service accounts for various providers, library updates, platform and solutions pages #5686
Merged
feat(credentials): client-credentials service accounts — Zoom, Box, Salesforce + Pipedrive API tokens #5690
Merged

TheodoreSpeaks mentioned this pull request Jul 15, 2026
feat(triggers): service-account credentials in the hubspot trigger #5693
Merged
6 tasks

Uh oh!

Conversation

waleedlatif1 commented Jul 15, 2026

Summary

Type of Change

Testing

Checklist

Uh oh!

vercelBot commented Jul 15, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursorBot commented Jul 15, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

Uh oh!

waleedlatif1 commented Jul 15, 2026

Uh oh!

waleedlatif1 commented Jul 15, 2026

Uh oh!

greptile-appsBot commented Jul 15, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Jul 15, 2026

Uh oh!

waleedlatif1 commented Jul 15, 2026

Uh oh!

cursorBot left a comment

Choose a reason for hiding this comment

Uh oh!

waleedlatif1 commented Jul 15, 2026

Uh oh!

waleedlatif1 commented Jul 15, 2026

Uh oh!

cursorBot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

vercelBot commented Jul 15, 2026•
edited
Loading

cursorBot commented Jul 15, 2026•
edited
Loading

greptile-appsBot commented Jul 15, 2026•
edited
Loading