fix(amplitude): send both saved keys to User Profile over Basic auth

Amplitude's User Profile API documents only Basic authentication with the
project API key and secret key. A saved Amplitude credential now fills the API
key too, and the tool sends Basic auth whenever an API key is present. Inline
calls that pass only the secret key keep the Api-Key header they sent before.

Author: waleedlatif1

apps/docs/content/docs/integrations/amplitude.mdx

@@ -12,7 +12,7 @@ import { ReferenceDetails } from "@/components/ui/reference-details"
 {/* MANUAL-CONTENT-START:intro */}
 Use [Amplitude](https://amplitude.com/) to send events, update user and group properties, and query product analytics from a workflow. The HTTP and Dashboard REST APIs use API-key and secret-key authentication.
 
-Connect an Amplitude project once as an Amplitude credential: in Amplitude, open **Settings > Projects**, choose the project, and copy the **API key** and **secret key** from its **General** tab. Enter `eu` as the data residency only for a project hosted in Amplitude's EU data center. Sim checks the pair by listing the project's events, a read with no billing cost. Event and identify operations send the API key, analytics operations send both keys, and **User Profile** sends the secret key; User Profile is not available for EU projects. Workflows built with the earlier Amplitude block keep the keys they entered in the block.
+Connect an Amplitude project once as an Amplitude credential: in Amplitude, open **Settings > Projects**, choose the project, and copy the **API key** and **secret key** from its **General** tab. Enter `eu` as the data residency only for a project hosted in Amplitude's EU data center. Sim checks the pair by listing the project's events, a read with no billing cost. Event and identify operations send the API key, analytics operations and **User Profile** send both keys; User Profile is not available for EU projects. Workflows built with the earlier Amplitude block keep the keys they entered in the block.
 {/* MANUAL-CONTENT-END */}
 
 ## Use the block [#usage-instructions]

apps/sim/tools/amplitude/types.ts

@@ -140,6 +140,7 @@ export interface AmplitudeUserActivityResponse extends ToolResponse {
  * User Profile params (User Profile API).
  */
 export interface AmplitudeUserProfileParams {
+  apiKey?: string
   secretKey: string
   userId?: string
   deviceId?: string

apps/sim/tools/amplitude/user_profile.ts

@@ -15,6 +15,13 @@ export const userProfileTool: ToolConfig<AmplitudeUserProfileParams, AmplitudeUs
     oauth: AMPLITUDE_PROFILE_CREDENTIAL_OAUTH,
 
     params: {
+      apiKey: {
+        type: 'string',
+        required: false,
+        visibility: 'user-only',
+        description:
+          'Amplitude API Key. With it, the request authenticates with both keys over Basic auth',
+      },
       secretKey: {
         type: 'string',
         required: true,
@@ -64,9 +71,15 @@ export const userProfileTool: ToolConfig<AmplitudeUserProfileParams, AmplitudeUs
         return url.toString()
       },
       method: 'GET',
-      headers: (params) => ({
-        Authorization: `Api-Key ${params.secretKey}`,
-      }),
+      headers: (params) => {
+        const apiKey = params.apiKey?.trim()
+        // Without an API key (an inline block that never asked for one), keep the secret-key-only header.
+        return {
+          Authorization: apiKey
+            ? `Basic ${btoa(`${apiKey}:${params.secretKey}`)}`
+            : `Api-Key ${params.secretKey}`,
+        }
+      },
     },
 
     transformResponse: async (response: Response) => {

apps/sim/tools/generated/tool-metadata.ts

@@ -79,6 +79,7 @@ import {
   ResolvedSecretTraceRegistry,
 } from '@/executor/utils/resolved-secret-trace-registry'
 import { prepareToolExecution, transformBlockTool } from '@/providers/utils'
+import { userProfileTool as amplitudeUserProfileTool } from '@/tools/amplitude/user_profile'
 import { bitbucketGetPipelineStepLogTool } from '@/tools/bitbucket/get_pipeline_step_log'
 import { docusignGetEnvelopeTool } from '@/tools/docusign/get_envelope'
 import { ErrorExtractorId } from '@/tools/error-extractors'
@@ -245,6 +246,7 @@ vi.mock('@/executor/handlers/workflow/custom-block-tool-runner', () => ({
 // Mock the tools registry to avoid loading the full 4500+ line registry file.
 // Only the tools actually exercised in tests are provided.
 const mockRegistryTools: Record<string, any> = {
+  amplitude_user_profile: amplitudeUserProfileTool,
   stripe_list_subscriptions: stripeListSubscriptionsTool,
   stripe_search_subscriptions: stripeSearchSubscriptionsTool,
   slack_lists_items_list: slackListsItemsListTool,
@@ -4171,6 +4173,53 @@ describe('Internal Route Trust', () => {
       expect(mockSecureFetchWithPinnedIP).not.toHaveBeenCalled()
     })
 
+    it('reads an Amplitude profile with Basic auth over both keys of a saved credential', async () => {
+      mockResolveExecutorCredentialToken.mockResolvedValue({
+        accessToken: 'saved-secret-key',
+        credentialType: 'service_account',
+        providerWorkspaceId: 'saved-api-key',
+      })
+      mockSecureFetchWithPinnedIP.mockResolvedValueOnce(
+        toSecureFetchResponse(Response.json({ userData: {} }))
+      )
+
+      const result = await executeTool('amplitude_user_profile', {
+        credential: 'saved-credential',
+        userId: 'user-1',
+      })
+
+      expect(result.success).toBe(true)
+      expect(mockSecureFetchWithPinnedIP).toHaveBeenLastCalledWith(
+        'https://profile-api.amplitude.com/v1/userprofile?user_id=user-1',
+        expect.anything(),
+        expect.objectContaining({
+          headers: expect.objectContaining({
+            authorization: `Basic ${Buffer.from('saved-api-key:saved-secret-key').toString('base64')}`,
+          }),
+        })
+      )
+    })
+
+    it('keeps the secret-key-only Api-Key header for an inline Amplitude profile read', async () => {
+      mockSecureFetchWithPinnedIP.mockResolvedValueOnce(
+        toSecureFetchResponse(Response.json({ userData: {} }))
+      )
+
+      const result = await executeTool('amplitude_user_profile', {
+        secretKey: 'inline-secret-key',
+        userId: 'user-1',
+      })
+
+      expect(result.success).toBe(true)
+      expect(mockSecureFetchWithPinnedIP).toHaveBeenLastCalledWith(
+        'https://profile-api.amplitude.com/v1/userprofile?user_id=user-1',
+        expect.anything(),
+        expect.objectContaining({
+          headers: expect.objectContaining({ authorization: 'Api-Key inline-secret-key' }),
+        })
+      )
+    })
+
     it('makes copilot pass credentialId or the inline values, and honors credentialId alone', async () => {
       const _context = {
         workspaceId: 'workspace-456',

apps/sim/tools/index.test.ts

@@ -201,7 +201,7 @@ export const ALGOLIA_CREDENTIAL_OAUTH = tokenCredentialOAuth('algolia', {
  * project API key (as its account id), the secret key (as its token), and the data residency
  * region (as its domain). Each policy maps only the params its tools declare: the Dashboard REST
  * tools send both keys to the region's host, the ingestion tools send the API key to the
- * region's host, and the User Profile tool sends the secret key to its single US host.
+ * region's host, and the User Profile tool sends both keys to its single US host.
  */
 export const AMPLITUDE_CREDENTIAL_OAUTH = tokenCredentialOAuth('amplitude', {
   apiKey: 'providerWorkspaceId',
@@ -213,6 +213,7 @@ export const AMPLITUDE_INGESTION_CREDENTIAL_OAUTH = tokenCredentialOAuth('amplit
   dataResidency: 'domain',
 })
 export const AMPLITUDE_PROFILE_CREDENTIAL_OAUTH = tokenCredentialOAuth('amplitude', {
+  apiKey: 'providerWorkspaceId',
   secretKey: 'accessToken',
 })
 export const APIFY_CREDENTIAL_OAUTH = tokenCredentialOAuth('apify', { apiKey: 'accessToken' })