The Credential block returns account references without exposing tokens. Select workspace OAuth credentials, or discover organization OAuth contributions and managed Model Context Protocol (MCP) connections shared with the workspace.
Reuse a credential
Select a Slack credential once. In each downstream Slack block, switch its credential field to advanced mode and enter <credential.credentialId>. Changing the selection updates those bindings in one place.
A credential ID is a reference, not a token. The downstream block resolves and authorizes the credential when it runs. It still needs a compatible service and the required scopes; the same Google email address does not make one Gmail OAuth credential usable for Drive or Calendar.
Operations
| Operation | Behavior |
|---|---|
| Select Credential | Return one workspace OAuth credential reference. |
| List Credentials | Return workspace OAuth credential references, optionally filtered by providers. |
| Find Organization Account | Find exactly one active OAuth contribution by invitation email and provider. |
| List Organization Accounts | Page through active OAuth contributions, optionally filtered by email and providers. |
| Find Organization MCP Connection | Find exactly one active managed MCP connection by invitation email and MCP provider. |
| List Organization MCP Connections | Page through active managed MCP connections, optionally filtered by email and provider. |
These operations do not select secrets or service accounts. Function can read a returned ID string, but does not automatically resolve it to a token.
Configuration
Workspace credentials
For Select Credential, choose Credential from the workspace's connected OAuth accounts. Advanced mode accepts a Credential ID copied from Credentials settings or resolved from an earlier output.
For List Credentials, optionally select one or more Provider values. The picker shows providers with connected credentials; leave it empty for all workspace OAuth credentials.
Organization accounts
An organization owner or admin must enable connected accounts and allow the workflow's workspace. Personal workspaces cannot use an organization pool. The block uses the organization owning the workspace; there is no organization or credential-group selector.
Authorized workflows in an allowed workspace can discover active contributions for its allowed integrations. Results are not limited to the acting person's own accounts, and there is no separate per-workflow discovery grant. Workspace/integration access is checked on each page; normal workflow permissions still apply.
| Operation | Required | Optional |
|---|---|---|
| Find Organization Account | Email, Provider | — |
| List Organization Accounts | — | Email, Providers, Limit, Cursor |
| Find Organization MCP Connection | Email, MCP provider | — |
| List Organization MCP Connections | — | Email, MCP provider, Limit, Cursor |
Email means the invitation address associated with the person's verified Sim account. It can differ from the OAuth provider's account email. See email association.
List Limit defaults to 100 and accepts 1–100. Cursor accepts the previous page's nextCursor with the same filters. The block does not fetch all pages automatically.
Find fails unless exactly one active connection matches. List returns empty results when none match. Disconnected accounts, revoked invitations, and accounts needing reconnection are excluded; multiple accounts contributed by one person stay separate.
Outputs
Workspace OAuth
| Operation | Outputs |
|---|---|
| Select Credential | credentialId, displayName, providerId |
| List Credentials | credentials: array of those objects; count: number returned |
Pass <credential.credentialId> to compatible credential fields. A deleted credential causes Select to fail; List omits it. Update the selection before rerunning.
Organization OAuth
Find Organization Account returns credentialId, displayName, providerId, and invitation email.
List Organization Accounts returns credentials with those fields plus accountEmail verified by the OAuth provider. It also returns:
| Output | Meaning |
|---|---|
emails | Provider account addresses on this page, in credential order; duplicates are preserved |
count | Accounts on this page |
hasMore | Whether another page is available |
nextCursor | Cursor for the next page, or null on the last page |
For example, name the block Account, choose Find Organization Account, set Email to alex@example.com, and select Gmail. Use <account.credentialId> in a Gmail block to act with that contribution.
Managed MCP
| Field | Meaning |
|---|---|
credentialId | Person's managed MCP connection ID |
email | Invitation email |
displayName | Connection display name |
mcpServerId | Shared MCP configuration ID |
mcpServerName | Configured server name |
toolNames | Tools available through that connection |
Find returns one object. List returns objects in mcpConnections plus count, hasMore, and nextCursor.
Use credentialId to select the person's connection in an MCP Tool block. mcpServerId identifies shared configuration, not the person's authorization. No OAuth token or client secret is returned.
List accounts and process each one
- Name the Credential block Accounts. Select List Credentials and filter Provider to Gmail, or use List Organization Accounts and filter Providers to Gmail.
- Pass
<accounts.credentials>into a For Each loop. - Inside the loop, set the Gmail credential to
<loop.currentItem.credentialId>. - For organization lists, repeat with
nextCursorwhilehasMoreis true, preserving filters.
Leave organization Email blank to discover accounts without knowing invitation addresses. Listing does not select a downstream account automatically.
Choose an account by a rule
A Condition reads <variable.env> and selects a production or staging Slack credential. Each chosen branch passes its credential reference to a compatible Slack action.
Connection-event triggers
Switch the block to trigger mode, select an Event, and deploy in an allowed workspace:
| Event | Trigger |
|---|---|
| Credential Added | New account contribution |
| Credential Reconnected | Existing contribution reconnected |
| Account Connections Submitted | Connection form submitted |
Events include event, timestamp, email, enrollmentId, enrollmentStatus, credentialGroupId, and credentialGroupName. Added/reconnected events also include account details such as credentialId, provider, and displayName; mcpServerId identifies shared MCP configuration and is null for OAuth accounts.
Every deployed workflow selecting that event in an allowed workspace can receive it. Removing workspace access stops later delivery. Replace legacy Credential Group blocks with Credential; they are not automatically converted.