Credential

The Credential block passes account references to downstream blocks without exposing tokens. Select Credential and List Credentials use workspace OAuth credentials. When organization connected accounts is enabled and shared with the workflow's workspace, the organization operations find or list contributed OAuth accounts and managed MCP connections.

The Credential block outputs credential ID references, not secrets. Downstream blocks receive the ID and resolve the actual OAuth token securely during their own execution.

Configuration

Operation

Value	Description
Select Credential	Pick one OAuth credential and output its reference — use this to wire a single credential into downstream blocks
List Credentials	Return all OAuth credentials in the workspace as an array — use this with a ForEach loop
Find Organization Account	Find exactly one active OAuth contribution by invitation email and provider
List Organization Accounts	Return a page of active OAuth contributions, optionally filtered by email and providers
Find Organization MCP Connection	Find exactly one active managed MCP connection by invitation email and MCP provider
List Organization MCP Connections	Return a page of active managed MCP connections, optionally filtered by email and provider

Credential (Select operation)

Select an OAuth credential from your workspace. The dropdown shows all connected OAuth accounts (Google, GitHub, Slack, etc.).

In advanced mode, paste a credential ID directly. You can copy a credential ID from your workspace's Credentials settings page.

Provider (List operation)

Filter the returned OAuth credentials by provider. Select one or more providers from the dropdown — only providers you have credentials for will appear. Leave empty to return all OAuth credentials.

Example	Returns
Gmail	Gmail credentials only
Slack	Slack credentials only
Gmail + Slack	Gmail and Slack credentials

Outputs

Output	Type	Description
`credentialId`	`string`	The credential ID — pipe this into other blocks' credential fields
`displayName`	`string`	Human-readable name (e.g. "waleed@company.com")
`providerId`	`string`	OAuth provider ID (e.g. `google-email`, `slack`)

Output	Type	Description
`credentials`	`json`	Array of OAuth credential objects (see shape below)
`count`	`number`	Number of credentials returned

Each object in the credentials array:

Field	Type	Description
`credentialId`	`string`	The credential ID
`displayName`	`string`	Human-readable name
`providerId`	`string`	OAuth provider ID

Organization accounts

An organization owner or admin must first set up connected accounts and allow this workflow's workspace. The block uses the organization that owns the workspace; there is no credential group or organization selector.

Every authorized workflow in an allowed workspace can use every active contribution in the organization's pool. Results are not restricted to the running user's own accounts, and no separate per-workflow grant is required. Normal workflow permissions still apply.

Inputs

Operation	Required fields	Optional fields
Find Organization Account	Email, Provider	—
List Organization Accounts	—	Email, Providers, Limit, Cursor
Find Organization MCP Connection	Email, MCP provider	—
List Organization MCP Connections	—	Email, MCP provider, Limit, Cursor

For list operations, Limit accepts 1–100 and defaults to 100. Cursor accepts the previous page's nextCursor.

Email refers to the address used for the person's invitation. Sim associates that invitation with their verified Sim user. See email association for how OAuth and managed MCP identity checks differ.

Find operations fail unless there is exactly one active matching connection. List operations return an empty array when there are no matches and omit inactive or revoked connections.

OAuth outputs

Find Organization Account returns credentialId, displayName, providerId, and the invitation email. Pass credentialId into the corresponding integration block's credential field in advanced mode.

List Organization Accounts returns these account references in credentials, along with count, hasMore, and nextCursor. count is the number returned on this page. Feed credentials into a ForEach loop and use <loop.currentItem.credentialId> inside the loop. To process additional pages, pass nextCursor into another call with the same filters while hasMore is true; the block does not fetch all pages automatically.

For example, name a Credential block account, choose Find Organization Account, set Email to alex@example.com, and select Gmail. Reference <account.credentialId> in a Gmail block to act using Alex's contribution.

Managed MCP outputs

Find Organization MCP Connection returns:

Output	Type	Description
`credentialId`	`string`	The person's managed MCP connection ID; use this connection for MCP calls
`email`	`string`	Invitation email used to find the connection
`displayName`	`string`	Connection display name
`mcpServerId`	`string`	Shared MCP configuration ID
`mcpServerName`	`string`	Configured MCP server name
`toolNames`	`json`	Tool names available to this connection

List Organization MCP Connections returns these objects in mcpConnections, plus count, hasMore, and nextCursor. Pagination works the same way as for organization OAuth accounts; nextCursor is null on the last page.

For a managed MCP account, use the returned credentialId to select the person's connection in the MCP Tool block. mcpServerId identifies the shared provider configuration; it does not identify a person's authorization. No OAuth token or client secret is returned by the Credential block.

Connection-event triggers

Switch the Credential block to trigger mode to start a workflow when an account connects or a connection form is submitted. Select an Event and deploy the workflow in an allowed workspace.

Event	When it runs
Credential Added	A person adds a new account contribution
Credential Reconnected	A person reconnects an existing contribution
Account Connections Submitted	A person submits the connection form

Events include event, timestamp, email, enrollmentId, enrollmentStatus, credentialGroupId, and credentialGroupName. Added and reconnected events also include account details such as credentialId, provider, and displayName; mcpServerId identifies shared configuration for an MCP connection and is null for an OAuth account.

Each deployed workflow that selects the event in an allowed workspace can receive it. Removing workspace access stops subsequent event delivery. Legacy Credential Group blocks must be replaced with the Credential block; they are not automatically converted.

Examples

Select a Google account once, then reference <credential.credentialId> in the Gmail, Drive, and Calendar blocks. Change the account in one place and every block follows.

Route to a different account by logic

A Condition picks the production or staging credential from a workflow variable, and the downstream Slack block posts with whichever one ran.

List all accounts and fan out

Credential (List, Provider: Gmail) → ForEach Loop → Gmail (Send) using <loop.currentItem.credentialId>

How to wire a Credential block

Select Credential

Drop a Credential block and select your OAuth credential from the picker
In the downstream block, switch to advanced mode on its credential field
Enter <credentialBlockName.credentialId> as the value

The same reference works for any OAuth block. In a Gmail or Slack block's credential field (advanced mode), enter <myCredential.credentialId>.

List Credentials

Drop a Credential block, set Operation to List Credentials
Optionally select one or more Providers to narrow results (only your connected providers appear)
Wire <credentialBlockName.credentials> into a ForEach Loop as the items source
Inside the loop, reference <loop.currentItem.credentialId> in downstream blocks' credential fields

Common Questions

Workspace OAuth credentials, organization OAuth contributions, and organization managed MCP connections. Secrets and service accounts are not selected through these operations.

Connected accounts must be enabled for the organization, and the workflow's workspace must be allowed in Organization settings → Connected accounts → Workspace access. Personal workspaces cannot use an organization pool.

Functionally identical — both pass the same credential ID to the downstream block. The Credential block adds value when you need to use one credential in many blocks (change it once), or when you want to select between credentials dynamically using a Condition block.

Yes. Reference <credential.credentialId> in your Function block's code. The function receives the ID string. It does not automatically resolve credential IDs to tokens; use a compatible integration or MCP block to perform an authenticated action.

The Select operation will throw an error at execution time: 'Credential not found'. The List operation will simply omit the deleted credential from the results. Update the Credential block to select a valid credential before re-running.

Credential

Common Questions

On this page