Credentials

Credentials provide a secure way to manage API keys, tokens, and third-party service connections across your workflows. Instead of hardcoding sensitive values into your workflow, you store them as credentials and reference them at runtime.

Sim supports two categories of credentials: secrets for static values like API keys, and OAuth accounts for authenticated service connections like Google or Slack.

Getting Started

To manage credentials, open your workspace Settings and navigate to the Secrets tab.

From here you can search, create, and delete both secrets and OAuth connections.

Secrets

Secrets are key-value pairs that store sensitive data like API keys, tokens, and passwords. Each secret has a key (used to reference it in workflows) and a value (the actual secret).

Creating a Secret

Using Secrets in Workflows

To reference a secret in any input field, type {{ to open the dropdown. It will show your available secrets grouped by scope.

Select the secret you want to use. The reference will appear highlighted in blue, indicating it will be resolved at runtime.

Bulk Import

You can import multiple secrets at once by pasting .env-style content:

1. Click + Add, then switch to Bulk mode
2. Paste your environment variables in KEY=VALUE format
3. Choose the scope for all imported secrets
4. Click Create

The parser supports standard KEY=VALUE pairs, quoted values, comments (#), and blank lines.

OAuth Accounts

OAuth accounts are authenticated connections to third-party services like Google, Slack, GitHub, and more. Sim handles the OAuth flow, token storage, and automatic refresh.

You can connect multiple accounts per provider — for example, two separate Gmail accounts for different workflows.

Connecting an OAuth Account

Using OAuth Accounts in Workflows

Blocks that require authentication (e.g. Gmail, Slack, Google Sheets) display a credential selector dropdown. Select the OAuth account you want the block to use.

You can also connect additional accounts directly from the block by selecting Connect another account at the bottom of the dropdown.

Workspace vs. Personal

Credentials can be scoped to your workspace (shared with your team) or kept personal (private to you).

Resolution Order

When a workflow runs, Sim resolves secrets in this order:

1. Workspace secrets are checked first
2. Personal secrets are used as a fallback — from the user who triggered the run (manual) or the workflow owner (automated runs via API, webhook, or schedule)

Access Control

Each credential has role-based access control:

• Admin — can view, edit, delete, and manage who has access
• Member — can use the credential in workflows (read-only)

When you create a workspace secret, all current workspace members are automatically granted access. Personal secrets are only accessible to you by default.

Sharing a Credential

To share a credential with specific team members:

1. Click Details on the credential
2. Invite members by email
3. Assign them an Admin or Member role

Best Practices

• Use workspace credentials for production so workflows work regardless of who triggers them
• Use personal credentials for development to keep your test keys separate
• Name keys descriptively — STRIPE_SECRET_KEY over KEY1
• Connect multiple OAuth accounts when you need different permissions or identities per workflow
• Never hardcode secrets in workflow input fields — always use {{KEY}} references