# Credential (/workflows/blocks/credential)





The **Credential block** returns account references without exposing tokens. Select workspace OAuth credentials, or discover organization OAuth contributions and managed Model Context Protocol (MCP) connections shared with the workspace.

<BlockPreview type="credential" />

## Reuse a credential [#reuse-a-credential]

<WorkflowPreview workflow="CREDENTIAL_SHARE_WORKFLOW" />

Select a Slack credential once. In each downstream Slack block, switch its credential field to advanced mode and enter `<credential.credentialId>`. Changing the selection updates those bindings in one place.

<Callout type="info">
  A credential ID is a reference, not a token. The downstream block resolves and authorizes the credential when it runs. It still needs a compatible service and the required scopes; the same Google email address does not make one Gmail OAuth credential usable for Drive or Calendar.
</Callout>

## Operations [#operations]

| Operation | Behavior |
| - | - |
| **Select Credential** | Return one workspace OAuth credential reference. |
| **List Credentials** | Return workspace OAuth credential references, optionally filtered by providers. |
| **Find Organization Account** | Find exactly one active OAuth contribution by invitation email and provider. |
| **List Organization Accounts** | Page through active OAuth contributions, optionally filtered by email and providers. |
| **Find Organization MCP Connection** | Find exactly one active managed MCP connection by invitation email and MCP provider. |
| **List Organization MCP Connections** | Page through active managed MCP connections, optionally filtered by email and provider. |

These operations do not select secrets or service accounts. Function can read a returned ID string, but does not automatically resolve it to a token.

## Configuration [#configuration]

### Workspace credentials [#workspace-credentials]

For **Select Credential**, choose **Credential** from the workspace's connected OAuth accounts. Advanced mode accepts a **Credential ID** copied from Credentials settings or resolved from an earlier output.

For **List Credentials**, optionally select one or more **Provider** values. The picker shows providers with connected credentials; leave it empty for all workspace OAuth credentials.

### Organization accounts [#organization-accounts]

An organization owner or admin must enable [connected accounts](/platform/connected-accounts) and allow the workflow's workspace. Personal workspaces cannot use an organization pool. The block uses the organization owning the workspace; there is no organization or credential-group selector.

Authorized workflows in an allowed workspace can discover active contributions for its allowed integrations. Results are not limited to the acting person's own accounts, and there is no separate per-workflow discovery grant. Workspace/integration access is checked on each page; normal workflow permissions still apply.

| Operation | Required | Optional |
| - | - | - |
| Find Organization Account | **Email**, **Provider** | — |
| List Organization Accounts | — | **Email**, **Providers**, **Limit**, **Cursor** |
| Find Organization MCP Connection | **Email**, **MCP provider** | — |
| List Organization MCP Connections | — | **Email**, **MCP provider**, **Limit**, **Cursor** |

**Email** means the invitation address associated with the person's verified Sim account. It can differ from the OAuth provider's account email. See [email association](/platform/connected-accounts#how-the-email-is-associated-with-a-sim-user).

List **Limit** defaults to 100 and accepts 1–100. **Cursor** accepts the previous page's `nextCursor` with the same filters. The block does not fetch all pages automatically.

Find fails unless exactly one active connection matches. List returns empty results when none match. Disconnected accounts, revoked invitations, and accounts needing reconnection are excluded; multiple accounts contributed by one person stay separate.

## Outputs [#outputs]

### Workspace OAuth [#workspace-oauth]

| Operation | Outputs |
| - | - |
| Select Credential | `credentialId`, `displayName`, `providerId` |
| List Credentials | `credentials`: array of those objects; `count`: number returned |

Pass `<credential.credentialId>` to compatible credential fields. A deleted credential causes Select to fail; List omits it. Update the selection before rerunning.

### Organization OAuth [#organization-oauth]

**Find Organization Account** returns `credentialId`, `displayName`, `providerId`, and invitation `email`.

**List Organization Accounts** returns `credentials` with those fields plus `accountEmail` verified by the OAuth provider. It also returns:

| Output | Meaning |
| - | - |
| `emails` | Provider account addresses on this page, in credential order; duplicates are preserved |
| `count` | Accounts on this page |
| `hasMore` | Whether another page is available |
| `nextCursor` | Cursor for the next page, or `null` on the last page |

For example, name the block **Account**, choose Find Organization Account, set Email to `alex@example.com`, and select Gmail. Use `<account.credentialId>` in a Gmail block to act with that contribution.

### Managed MCP [#managed-mcp]

| Field | Meaning |
| - | - |
| `credentialId` | Person's managed MCP connection ID |
| `email` | Invitation email |
| `displayName` | Connection display name |
| `mcpServerId` | Shared MCP configuration ID |
| `mcpServerName` | Configured server name |
| `toolNames` | Tools available through that connection |

Find returns one object. List returns objects in `mcpConnections` plus `count`, `hasMore`, and `nextCursor`.

Use `credentialId` to select the person's connection in an MCP Tool block. `mcpServerId` identifies shared configuration, not the person's authorization. No OAuth token or client secret is returned.

## List accounts and process each one [#list-accounts-and-process-each-one]

1. Name the Credential block **Accounts**. Select **List Credentials** and filter **Provider** to Gmail, or use **List Organization Accounts** and filter **Providers** to Gmail.
2. Pass `<accounts.credentials>` into a For Each loop.
3. Inside the loop, set the Gmail credential to `<loop.currentItem.credentialId>`.
4. For organization lists, repeat with `nextCursor` while `hasMore` is true, preserving filters.

Leave organization Email blank to discover accounts without knowing invitation addresses. Listing does not select a downstream account automatically.

## Choose an account by a rule [#choose-an-account-by-a-rule]

<WorkflowPreview workflow="CREDENTIAL_ROUTE_WORKFLOW" />

A Condition reads `<variable.env>` and selects a production or staging Slack credential. Each chosen branch passes its credential reference to a compatible Slack action.

## Connection-event triggers [#connection-event-triggers]

Switch the block to trigger mode, select an **Event**, and deploy in an allowed workspace:

| Event | Trigger |
| - | - |
| Credential Added | New account contribution |
| Credential Reconnected | Existing contribution reconnected |
| Account Connections Submitted | Connection form submitted |

Events include `event`, `timestamp`, `email`, `enrollmentId`, `enrollmentStatus`, `credentialGroupId`, and `credentialGroupName`. Added/reconnected events also include account details such as `credentialId`, `provider`, and `displayName`; `mcpServerId` identifies shared MCP configuration and is null for OAuth accounts.

Every deployed workflow selecting that event in an allowed workspace can receive it. Removing workspace access stops later delivery. Replace legacy Credential Group blocks with Credential; they are not automatically converted.

## Related docs [#related-docs]

* [Connected accounts](/platform/connected-accounts)
* [Credentials](/platform/credentials)
* [Loop](/workflows/blocks/loop)