feat(credentials): add named API keys to credential groups by TheodoreSpeaks · Pull Request #8188 · simstudioai/sim

TheodoreSpeaks · 2026-09-23T05:01:37Z

Summary

Let admins request named API keys with optional descriptions and let each member connect, replace, or disconnect their own encrypted value from Integrations.
Add paginated Credential Group API-key listing and explicit retrieval for dynamic downstream inputs, with current access checks and secret provenance.
Rename OAuth/MCP operation labels to Credential Group while preserving their saved IDs and behavior. Include the additive migration, management UI, and usage docs.

Type of Change

Feature

Testing

Focused regression tests for the integration flow (87 passing); app type check; 26-package lint and lint:check; all 47 audits; docs and block registry gates. The migration and replay passed in temporary PostgreSQL 17 with synthetic data.

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

vercel · 2026-09-23T05:01:43Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Sep 23, 2026 6:33pm UTC

TheodoreSpeaks · 2026-09-23T05:02:38Z

@greptile

TheodoreSpeaks · 2026-09-23T05:02:46Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-09-23T05:02:52Z

@cubic-dev-ai review this PR

@TheodoreSpeaks I have started the AI code review. It will take a few minutes to complete.

greptile-apps · 2026-09-23T05:07:21Z

Confidence Score: 5/5

The PR appears safe to merge; the remaining Integrations error-state issue is non-blocking and limited to contradictory UI messaging.

Findings

Error Shows Empty State ▶

Summary

This PR adds named API-key requests to Credential Groups, including encrypted per-member submissions, management and enrollment interfaces, workflow block operations, API contracts, persistence, migration, documentation, and tests. The changes since the previous review additionally expose member-owned API keys in the organization Integrations page.

Adds member Connect, Replace, and Disconnect controls for requested API keys.
Adds current-viewer API-key identity projection without returning ciphertext.
Reuses the authenticated enrollment boundary to save API-key values.
Preserves existing OAuth and MCP operation identifiers while updating their labels.
One non-blocking query-state presentation issue remains in the Integrations list.

Diagram

sequenceDiagram
  participant Member
  participant IntegrationsUI
  participant OrganizationAPI
  participant EnrollmentAPI
  participant Database

  Member->>IntegrationsUI: Connect or replace named API key
  IntegrationsUI->>OrganizationAPI: Start personal group enrollment
  OrganizationAPI->>Database: Reuse enrollment and issue token
  OrganizationAPI-->>IntegrationsUI: Invitation link
  IntegrationsUI->>EnrollmentAPI: Submit key with token and option ID
  EnrollmentAPI->>Database: Encrypt and upsert member key
  EnrollmentAPI-->>IntegrationsUI: Connected
  IntegrationsUI->>OrganizationAPI: Refresh member inventory
  OrganizationAPI->>Database: Read key identity only
  OrganizationAPI-->>IntegrationsUI: credentialId and optionId

_{Reviews (4) · Last reviewed commit: "feat(credentials): connect requested key..."}

cubic-dev-ai

All reported issues were addressed across 59 files

_{Tip: instead of fixing issues one by one fix them all with cubic

Re-trigger cubic}

TheodoreSpeaks · 2026-09-23T05:26:14Z

@greptile

TheodoreSpeaks · 2026-09-23T05:26:23Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-09-23T05:26:30Z

@cubic-dev-ai review this PR

@TheodoreSpeaks I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 63 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Re-trigger cubic}

TheodoreSpeaks · 2026-09-23T17:31:47Z

@greptile

TheodoreSpeaks · 2026-09-23T17:31:55Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-09-23T17:32:03Z

@cubic-dev-ai review this PR

@TheodoreSpeaks I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 62 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Re-trigger cubic}

TheodoreSpeaks · 2026-09-23T18:33:44Z

@greptile

TheodoreSpeaks · 2026-09-23T18:33:52Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-09-23T18:33:59Z

@cubic-dev-ai review this PR

@TheodoreSpeaks I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

1 issue found across 70 files

Confidence score: 4/5

In apps/sim/app/o/[organizationId]/integrations/member-integrations-list.tsx, account-metadata failures can incorrectly render both the empty-state message and the API-key request error, confusing users about whether integrations are unavailable or loading failed — exclude organizationAccounts.isError from the empty-state condition.

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/sim/app/o/[organizationId]/integrations/member-integrations-list.tsx">

<violation number="1" location="apps/sim/app/o/[organizationId]/integrations/member-integrations-list.tsx:194">
P3: An account-metadata failure now shows both “No integrations are available” and “Could not load API key requests.” Exclude `organizationAccounts.isError` from the empty-state condition.</violation>
</file>

_{You've manually re-run cubic several times on this PR. Each manual re-review checks the full PR again and counts toward your usage quota. To preserve your usage limits, we recommend letting cubic automatically review new commits.

Fix all with cubic | Re-trigger cubic}

cubic-dev-ai · 2026-09-23T18:37:43Z

            {showEmpty &&
              visible.length === 0 &&
+              visibleApiKeys.length === 0 &&
+              !organizationAccounts.isPending &&


P3: An account-metadata failure now shows both “No integrations are available” and “Could not load API key requests.” Exclude organizationAccounts.isError from the empty-state condition.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/sim/app/o/[organizationId]/integrations/member-integrations-list.tsx, line 194: <comment>An account-metadata failure now shows both “No integrations are available” and “Could not load API key requests.” Exclude `organizationAccounts.isError` from the empty-state condition.</comment> <file context> @@ -171,8 +175,23 @@ export function MemberIntegrationsList({ {showEmpty && visible.length === 0 && + visibleApiKeys.length === 0 && + !organizationAccounts.isPending && !availability.integrationAvailabilityError && !showSlackSetupError && ( </file context>

Suggested change

!organizationAccounts.isPending &&

!organizationAccounts.isPending &&

!organizationAccounts.isError &&

greptile-apps · 2026-09-23T18:37:50Z

            {showEmpty &&
              visible.length === 0 &&
+              visibleApiKeys.length === 0 &&
+              !organizationAccounts.isPending &&


Error Shows Empty State

When the organization-accounts request fails and no other integration matches, this condition still renders the empty state because it excludes only pending requests. The error state below then renders at the same time, so users see both “No integrations are available” and “Could not load API key requests,” obscuring that the inventory failed to load.

Suggested change

!organizationAccounts.isPending &&

!organizationAccounts.isPending &&

!organizationAccounts.isError &&

vercel Bot deployed to Preview September 23, 2026 05:03 View deployment

greptile-apps Bot reviewed Sep 23, 2026

View reviewed changes

Comment thread apps/sim/lib/credential-groups/application/public-enrollment.ts

Comment thread apps/sim/app/credential-groups/enroll/[token]/page.tsx

cubic-dev-ai Bot reviewed Sep 23, 2026

View reviewed changes

vercel Bot temporarily deployed to Preview September 23, 2026 05:20 Inactive

cubic-dev-ai Bot reviewed Sep 23, 2026

View reviewed changes

greptile-apps Bot reviewed Sep 23, 2026

View reviewed changes

Comment thread apps/sim/ee/credential-groups/components/organization-account-api-keys.tsx Outdated

TheodoreSpeaks added 3 commits September 23, 2026 10:26

feat(credentials): add named API keys to credential groups

9d5feeb

fix(credentials): guard named key edits and lifecycle

6fa0111

fix(credentials): reload key requests after edit conflicts

0e4c37a

TheodoreSpeaks force-pushed the codex/research-named-api-key-credentials branch from bc33ac0 to 0e4c37a Compare September 23, 2026 17:30

vercel Bot deployed to Preview September 23, 2026 17:33 View deployment

cubic-dev-ai Bot reviewed Sep 23, 2026

View reviewed changes

feat(credentials): connect requested keys from integrations

6e11707

vercel Bot temporarily deployed to Preview September 23, 2026 18:33 Inactive

cubic-dev-ai Bot reviewed Sep 23, 2026

View reviewed changes

greptile-apps Bot reviewed Sep 23, 2026

View reviewed changes

TheodoreSpeaks closed this Sep 23, 2026

TheodoreSpeaks deleted the codex/research-named-api-key-credentials branch September 23, 2026 18:52

	!organizationAccounts.isPending &&
	!organizationAccounts.isPending &&
	!organizationAccounts.isError &&

Conversation

TheodoreSpeaks commented Sep 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Type of Change

Testing

Checklist

Uh oh!

vercel Bot commented Sep 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

TheodoreSpeaks commented Sep 23, 2026

Uh oh!

TheodoreSpeaks commented Sep 23, 2026

Uh oh!

cubic-dev-ai Bot commented Sep 23, 2026

Uh oh!

greptile-apps Bot commented Sep 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 5/5

Findings

Summary

Uh oh!

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

TheodoreSpeaks commented Sep 23, 2026

Uh oh!

TheodoreSpeaks commented Sep 23, 2026

Uh oh!

cubic-dev-ai Bot commented Sep 23, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

TheodoreSpeaks commented Sep 23, 2026

Uh oh!

TheodoreSpeaks commented Sep 23, 2026

Uh oh!

cubic-dev-ai Bot commented Sep 23, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

TheodoreSpeaks commented Sep 23, 2026

Uh oh!

TheodoreSpeaks commented Sep 23, 2026

Uh oh!

cubic-dev-ai Bot commented Sep 23, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot Sep 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot Sep 23, 2026

Choose a reason for hiding this comment

Uh oh!

This branch was previously deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

TheodoreSpeaks commented Sep 23, 2026 •

edited

Loading

vercel Bot commented Sep 23, 2026 •

edited

Loading

greptile-apps Bot commented Sep 23, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot Sep 23, 2026 •

edited

Loading