Merge remote-tracking branch 'origin/staging' into feat/saved-database-connections

# Conflicts:
#	apps/sim/tools/generated/tool-metadata.ts

Author: waleedlatif1

apps/docs/content/docs/integrations/apollo.mdx

@@ -11,8 +11,50 @@ import { ReferenceDetails } from "@/components/ui/reference-details"
 
 {/* MANUAL-CONTENT-START:intro */}
 Use [Apollo.io](https://apollo.io/) in Sim to search and enrich people and companies, manage CRM contacts and accounts, add contacts to sequences, and create follow-up tasks. Single-record and bulk enrichment operations are documented below.
+
+Connect an Apollo account with OAuth, or save an API key as an Apollo credential. Existing API-key connections and workflows continue to work. OAuth requires an Apollo administrator or a user with permission to authorize third-party apps. Your Apollo plan, permissions, and credits still apply.
+
+For self-hosting, register a public partner OAuth app in the [Apollo developer portal](https://developer.apollo.io/), configure `APOLLO_CLIENT_ID` and `APOLLO_CLIENT_SECRET`, and register `https://<your-domain>/api/auth/oauth2/callback/apollo` as a redirect URL. Enable the scopes listed below. API-key credentials remain available without an OAuth client.
 {/* MANUAL-CONTENT-END */}
 
+## OAuth scopes [#oauth-scopes]
+
+Sim requests these scopes when someone connects an Apollo account. For a self-hosted deployment, register your own app with the provider using the settings below. See [Integrations and OAuth](/platform/self-hosting/integrations-oauth) for setup.
+
+| Setting | Value |
+| ------- | ----- |
+| Redirect URI | `<NEXT_PUBLIC_APP_URL>/api/auth/oauth2/callback/apollo` |
+| Environment variables | `APOLLO_CLIENT_ID`, `APOLLO_CLIENT_SECRET` |
+
+| Scope | Description |
+| ----- | ----------- |
+| `read_user_profile` | View your Apollo profile |
+| `mixed_people_api_search` | Search Apollo people |
+| `people_match` | Enrich a person in Apollo |
+| `people_bulk_match` | Enrich people in bulk in Apollo |
+| `mixed_companies_search` | Search Apollo companies |
+| `organizations_enrich` | Enrich an Apollo organization |
+| `organizations_bulk_enrich` | Enrich organizations in bulk in Apollo |
+| `contact_write` | Create Apollo contacts |
+| `contact_update` | Update Apollo contacts |
+| `contacts_search` | Search Apollo contacts |
+| `contacts_bulk_create` | Create Apollo contacts in bulk |
+| `contacts_bulk_update` | Update Apollo contacts in bulk |
+| `account_write` | Create Apollo accounts |
+| `account_update` | Update Apollo accounts |
+| `accounts_search` | Search Apollo accounts |
+| `account_bulk_create` | Create Apollo accounts in bulk |
+| `account_stages_update` | Update Apollo account stages |
+| `opportunity_write` | Create Apollo deals |
+| `opportunities_list` | List Apollo deals |
+| `opportunity_read` | View Apollo deals |
+| `opportunity_update` | Update Apollo deals |
+| `emailer_campaigns_search` | Search Apollo sequences |
+| `emailer_campaigns_add_contact_ids` | Add contacts to Apollo sequences |
+| `tasks_create` | Create Apollo tasks |
+| `tasks_list` | Search Apollo tasks |
+| `email_accounts_list` | View Apollo email accounts |
+
 ## Use the block [#usage-instructions]
 
 Search for people and companies, enrich contact data, manage your CRM contacts and accounts, add contacts to sequences, and create tasks.

apps/docs/content/docs/platform/self-hosting/integrations-oauth.mdx

@@ -393,6 +393,7 @@ GitHub workflow blocks and knowledge-base token connections continue to use pers
 | Help Scout | `HELPSCOUT_CLIENT_ID` / `HELPSCOUT_CLIENT_SECRET` | `helpscout` |
 | HubSpot | `HUBSPOT_CLIENT_ID` / `HUBSPOT_CLIENT_SECRET` | `hubspot` |
 | Salesforce | `SALESFORCE_CLIENT_ID` / `SALESFORCE_CLIENT_SECRET` | `salesforce` |
+| Apollo | `APOLLO_CLIENT_ID` / `APOLLO_CLIENT_SECRET` | `apollo` |
 | Pipedrive | `PIPEDRIVE_CLIENT_ID` / `PIPEDRIVE_CLIENT_SECRET` | `pipedrive` |
 | Attio | `ATTIO_CLIENT_ID` / `ATTIO_CLIENT_SECRET` | `attio` |
 | Zoho Desk | `ZOHO_CLIENT_ID` / `ZOHO_CLIENT_SECRET` | `zoho-desk` |

apps/docs/openapi-v2-resources.json

@@ -18513,6 +18513,7 @@
                       "ramp",
                       "helpscout",
                       "hubspot",
+                      "apollo",
                       "linkedin",
                       "instagram",
                       "salesforce",

apps/docs/openapi-v2-workflows.json

@@ -15969,7 +15969,7 @@
               "failed",
               "cancelled"
             ],
-            "description": "Current or terminal run status. `redacting` is transient, reported while a finished run's output is being scrubbed. `paused` means the run is waiting at a human or time pause, or a resume attempt did not complete. The single-run response provides the pause kind, resume time, and any automatic-resume waiting reason."
+            "description": "Current or terminal run status. `redacting` is transient, reported while a finished run's output is being scrubbed. `paused` means the run has a human or time pause that can still be resumed; once the run has finished and every pause point has resumed or failed, it reports the finished status. The single-run response provides the pause kind, resume time, and any automatic-resume waiting reason."
           },
           "trigger": {
             "type": "string",
@@ -16468,7 +16468,7 @@
               "cancelled",
               "queued"
             ],
-            "description": "Current or terminal run status. `redacting` is transient, reported while a finished run's output is being scrubbed. `paused` means the run is waiting at a human or time pause, or a resume attempt did not complete. The single-run response provides the pause kind, resume time, and any automatic-resume waiting reason."
+            "description": "Current or terminal run status. `redacting` is transient, reported while a finished run's output is being scrubbed. `paused` means the run has a human or time pause that can still be resumed; once the run has finished and every pause point has resumed or failed, it reports the finished status. The single-run response provides the pause kind, resume time, and any automatic-resume waiting reason."
           },
           "trigger": {
             "anyOf": [

apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/credential-selector/credential-selector.tsx

@@ -28,9 +28,12 @@ import { useActiveSearchTarget } from '@/app/workspace/[workspaceId]/w/[workflow
 import { BrandIcon } from '@/blocks/brand-icon'
 import type { SubBlockConfig } from '@/blocks/types'
 import { useWorkspaceCredential, useWorkspaceCredentials } from '@/hooks/queries/credentials'
+import { useIntegrationAvailability } from '@/hooks/queries/integration-availability'
 import { useOAuthCredentials } from '@/hooks/queries/oauth/credentials'
 import { useCredentialRefreshTriggers } from '@/hooks/use-credential-refresh-triggers'
+import { useIntegrationAccess } from '@/hooks/use-integration-access'
 import { useWorkflowRegistry } from '@/stores/workflows/registry/store'
+import { useWorkflowStore } from '@/stores/workflows/workflow/store'
 
 interface CredentialSelectorProps {
   blockId: string
@@ -57,6 +60,7 @@ export function CredentialSelector({
   const [editingValue, setEditingValue] = useState('')
   const [isEditing, setIsEditing] = useState(false)
   const activeWorkflowId = useWorkflowRegistry((state) => state.activeWorkflowId)
+  const blockType = useWorkflowStore((state) => state.blocks[blockId]?.type)
   const [storeValue, setStoreValue] = useSubBlockValue<string | null>(blockId, subBlock.id)
 
   const label = subBlock.placeholder || 'Select credential'
@@ -100,6 +104,20 @@ export function CredentialSelector({
 
   const credentialKind = subBlock.credentialKind
   const isMergedKinds = credentialKind === 'any'
+  const { getAccess } = useIntegrationAccess(workspaceId, {
+    enabled: !isAllCredentials && credentialKind !== 'service-account',
+  })
+  const { data: integrationAvailability, isSuccess: isAvailabilityReady } =
+    useIntegrationAvailability({
+      enabled: !isAllCredentials && credentialKind !== 'service-account',
+    })
+  const oauthConnectAvailable =
+    Boolean(blockType && getAccess(blockType) === 'available') &&
+    isAvailabilityReady &&
+    (integrationAvailability?.oauthServiceAvailability.some(
+      ({ providerId, available }) => providerId === effectiveProviderId && available
+    ) ??
+      false)
 
   const credentials = useMemo(() => {
     // A service-account picker lists only the reusable service-account
@@ -233,8 +251,9 @@ export function CredentialSelector({
       setShowSetupModal(true)
       return
     }
+    if (!oauthConnectAvailable) return
     setShowConnectModal(true)
-  }, [credentialKind])
+  }, [credentialKind, oauthConnectAvailable])
 
   const getProviderIcon = useCallback((providerName: OAuthProvider) => {
     const { baseProvider } = parseProvider(providerName)
@@ -278,7 +297,9 @@ export function CredentialSelector({
     // Suppress the setup action when the service-account flow is preview-gated
     // for this viewer (a custom Slack bot needs slack_v2) — existing accounts
     // above stay selectable.
-    if (credentialKind !== 'service-account' || !serviceAccountConnectHidden) {
+    if (
+      credentialKind === 'service-account' ? !serviceAccountConnectHidden : oauthConnectAvailable
+    ) {
       options.push({
         label:
           credentialKind === 'service-account'
@@ -302,6 +323,7 @@ export function CredentialSelector({
     credentialKind,
     subBlock.credentialLabels,
     serviceAccountConnectHidden,
+    oauthConnectAvailable,
     serviceAccountTarget,
     provider,
     getProviderIcon,
@@ -323,11 +345,15 @@ export function CredentialSelector({
         section: labels?.oauthGroup ?? `${getProviderName(provider)} accounts`,
         items: [
           ...credentials.filter((c) => c.type !== 'service_account').map(toOption),
-          {
-            label: labels?.oauthConnect ?? `Connect ${getProviderName(provider)} account`,
-            value: '__connect_account__',
-            iconElement: <SquareArrowUpRight className='size-3' />,
-          },
+          ...(oauthConnectAvailable
+            ? [
+                {
+                  label: labels?.oauthConnect ?? `Connect ${getProviderName(provider)} account`,
+                  value: '__connect_account__',
+                  iconElement: <SquareArrowUpRight className='size-3' />,
+                },
+              ]
+            : []),
         ],
       },
       {
@@ -355,6 +381,7 @@ export function CredentialSelector({
     subBlock.credentialLabels,
     credentials,
     serviceAccountConnectHidden,
+    oauthConnectAvailable,
     serviceAccountTarget,
     provider,
     getProviderIcon,
@@ -407,10 +434,6 @@ export function CredentialSelector({
   const handleComboboxChange = useCallback(
     (value: string) => {
       if (value === '__connect_account__') {
-        if (isMergedKinds) {
-          setShowConnectModal(true)
-          return
-        }
         handleAddCredential()
         return
       }
@@ -432,14 +455,7 @@ export function CredentialSelector({
       setIsEditing(true)
       setEditingValue(value)
     },
-    [
-      isAllCredentials,
-      isMergedKinds,
-      allWorkspaceCredentials,
-      credentials,
-      handleAddCredential,
-      handleSelect,
-    ]
+    [isAllCredentials, allWorkspaceCredentials, credentials, handleAddCredential, handleSelect]
   )
 
   return (
@@ -470,31 +486,32 @@ export function CredentialSelector({
             <span className='mr-1.5 inline-block size-[6px] rounded-xs bg-[var(--caution)]' />
             {dataversePolicy.message}
           </div>
-          {!dataversePolicy.hasInvalidEnvironment && (
-            <Chip
-              variant='primary'
-              fullWidth
-              onClick={() => {
-                if (dataversePolicy.requiresSeparateCredential) {
-                  setShowConnectModal(true)
-                  return
-                }
-                writeOAuthReturnContext({
-                  origin: 'workflow',
-                  workflowId: activeWorkflowId || '',
-                  displayName: selectedCredential?.name ?? getProviderName(provider),
-                  providerId: effectiveProviderId,
-                  preCount: credentials.filter((c) => c.type !== 'service_account').length,
-                  workspaceId,
-                  reconnect: true,
-                  requestedAt: Date.now(),
-                })
-                setShowOAuthModal(true)
-              }}
-            >
-              {dataversePolicy.actionLabel}
-            </Chip>
-          )}
+          {!dataversePolicy.hasInvalidEnvironment &&
+            (!dataversePolicy.requiresSeparateCredential || oauthConnectAvailable) && (
+              <Chip
+                variant='primary'
+                fullWidth
+                onClick={() => {
+                  if (dataversePolicy.requiresSeparateCredential) {
+                    setShowConnectModal(true)
+                    return
+                  }
+                  writeOAuthReturnContext({
+                    origin: 'workflow',
+                    workflowId: activeWorkflowId || '',
+                    displayName: selectedCredential?.name ?? getProviderName(provider),
+                    providerId: effectiveProviderId,
+                    preCount: credentials.filter((c) => c.type !== 'service_account').length,
+                    workspaceId,
+                    reconnect: true,
+                    requestedAt: Date.now(),
+                  })
+                  setShowOAuthModal(true)
+                }}
+              >
+                {dataversePolicy.actionLabel}
+              </Chip>
+            )}
         </div>
       )}
 

apps/sim/blocks/blocks/apollo.ts

@@ -1600,5 +1600,6 @@ export const ApolloV2Block: BlockConfig = {
     type: 'oauth-input',
     serviceId: 'apollo',
     title: 'Apollo Credential',
+    credentialKind: 'any',
   }),
 }

apps/sim/blocks/utils.ts

@@ -62,6 +62,7 @@ interface SavedCredentialPicker {
   type: 'oauth-input'
   serviceId: SavedCredentialService
   title: string
+  credentialKind?: 'service-account' | 'any'
 }
 
 interface SavedCredentialOptions {
@@ -160,7 +161,7 @@ export function withSavedCredential(
     0,
     {
       ...picker,
-      credentialKind: 'service-account',
+      credentialKind: picker.credentialKind ?? 'service-account',
       canonicalParamId: 'oauthCredential',
       mode: 'basic',
       // 'AWS Credential' → 'Select AWS credential': sentence case, brand casing kept.

apps/sim/content/changelog/saved-credentials-and-access/index.mdx

@@ -0,0 +1,38 @@
+---
+slug: saved-credentials-and-access
+title: 'Connect once and control how credentials are used'
+description: 'Sim workflows can reuse saved credentials instead of repeated keys. Keyless cloud connections and read-only API keys give teams more control.'
+date: '2026-11-10T20:00:00Z'
+updated: '2026-11-12T05:00:30Z'
+authors: [waleed]
+tags: [Workflows, Security]
+ogImage: /changelog/credentials-gateway-v1.jpg
+ogAlt: 'Monochrome illustration of two stone gateways overlooking mountain ridges'
+technical: false
+draft: false
+release:
+  versions: [v0.9.53, v0.9.54]
+---
+
+<ChangelogImage
+  src="/changelog/credentials-gateway-v1.jpg"
+  alt="Monochrome illustration of two stone gateways overlooking mountain ridges"
+  width="1672"
+  height="941"
+/>
+
+Save a connection once and select it in your workflow blocks. Keys and connection details stay in one place instead of being copied into every block, and you choose who can use the saved credential.
+
+Introduced in v0.9.53 and expanded in v0.9.54, saved credentials cover more services that previously asked for keys directly. Existing blocks keep their original settings. To use a saved connection, replace a legacy block with its current version and select the credential.
+
+### Connect without a long-lived key
+
+In v0.9.53, supported cloud services can trust Sim to obtain temporary access. Your cloud administrator configures the trust and permissions; self-hosted deployments also need workload identity configured. See the [AWS](https://docs.sim.ai/integrations/aws-credentials) and [Databricks](https://docs.sim.ai/integrations/databricks-credentials) guides.
+
+### Give scripts only the access they need
+
+Create a **Read only** API key with an expiration date under **Sim API keys** in account or workspace settings. Introduced in v0.9.53 and generally available in v0.9.54, these keys can inspect information without changing workspace resources or starting, resuming, or cancelling workflows.
+
+Allowed reads can still consume credits or call connected services. Existing keys retain full access. [API key access and expiration](https://docs.sim.ai/api-reference/authentication#key-access).
+
+Technical releases: [v0.9.53](https://github.com/simstudioai/sim/releases/tag/v0.9.53), [v0.9.54](https://github.com/simstudioai/sim/releases/tag/v0.9.54).