improvement(managed-agents): select a Claude Platform credential instead of BYOK

- register Claude Platform as a token-paste service-account credential (descriptor + validator)
- add no-OAuth OAUTH_PROVIDERS entry; generalize the shared credential picker with a 'service-account' kind
- block: oauth-input credential picker + dependsOn dropdowns; list route resolves the key server-side (audit-logged)
- run via directExecution with the executor-injected key; drop the internal run route
- remove the interim claude-platform BYOK provider

Author: waleedlatif1

apps/sim/app/api/tools/managed-agent/list/route.ts

@@ -1,18 +1,19 @@
+import { AuditAction, AuditResourceType, recordAudit } from '@sim/audit'
 import { createLogger } from '@sim/logger'
 import { getErrorMessage } from '@sim/utils/errors'
 import { type NextRequest, NextResponse } from 'next/server'
 import {
   listManagedAgentOptionsContract,
-  MANAGED_AGENT_BYOK_PROVIDER,
   type ManagedAgentOption,
   type ManagedAgentResource,
 } from '@/lib/api/contracts/managed-agents'
 import { parseRequest } from '@/lib/api/server'
-import { getBYOKKey } from '@/lib/api-key/byok'
-import { checkSessionOrInternalAuth } from '@/lib/auth/hybrid'
+import { authorizeCredentialUse } from '@/lib/auth/credential-access'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { CLAUDE_PLATFORM_SERVICE_ACCOUNT_PROVIDER_ID } from '@/lib/credentials/token-service-accounts/descriptors'
 import { AGENT_MEMORY_BETA, managedAgentsList } from '@/lib/managed-agents/session-client'
-import { getUserEntityPermissions } from '@/lib/workspaces/permissions/utils'
+import { captureServerEvent } from '@/lib/posthog/server'
+import { resolveOAuthAccountId, resolveServiceAccountToken } from '@/app/api/auth/oauth/utils'
 
 export const dynamic = 'force-dynamic'
 
@@ -55,36 +56,79 @@ function toOption(
 
 /**
  * Resolves Managed Agent dropdown options (agents / environments / vaults /
- * memory stores) for the block editor. The workspace's Claude Platform BYOK
- * key is decrypted server-side and never crosses the client boundary — the
- * browser only ever receives `{ id, label }` options.
+ * memory stores) for the block editor against a selected Claude Platform
+ * credential. The credential's API key is decrypted server-side and never
+ * crosses the client boundary — the browser only ever receives `{ id, label }`
+ * options.
  */
 export const GET = withRouteHandler(async (request: NextRequest) => {
-  const auth = await checkSessionOrInternalAuth(request, { requireWorkflowId: false })
-  if (!auth.success || !auth.userId) {
-    return NextResponse.json({ error: auth.error || 'Unauthorized' }, { status: 401 })
-  }
-
   const parsed = await parseRequest(listManagedAgentOptionsContract, request, {})
   if (!parsed.success) return parsed.response
-  const { workspaceId, resource } = parsed.data.query
+  const { credentialId, resource } = parsed.data.query
+
+  // Authenticates the caller AND verifies they may use this credential.
+  const authz = await authorizeCredentialUse(request, {
+    credentialId,
+    requireWorkflowIdForInternal: false,
+  })
+  if (!authz.ok) {
+    return NextResponse.json({ error: authz.error || 'Unauthorized' }, { status: 403 })
+  }
 
-  const permission = await getUserEntityPermissions(auth.userId, 'workspace', workspaceId)
-  if (!permission) {
-    return NextResponse.json({ error: 'Workspace access denied' }, { status: 403 })
+  const resolved = await resolveOAuthAccountId(credentialId)
+  if (
+    resolved?.credentialType !== 'service_account' ||
+    resolved.providerId !== CLAUDE_PLATFORM_SERVICE_ACCOUNT_PROVIDER_ID
+  ) {
+    return NextResponse.json({ error: 'Not a Claude Platform credential' }, { status: 400 })
   }
 
-  const byok = await getBYOKKey(workspaceId, MANAGED_AGENT_BYOK_PROVIDER)
-  if (!byok) {
-    // No Claude Platform key linked yet — return an empty list so the
-    // dropdown renders cleanly rather than erroring.
+  let apiKey: string
+  try {
+    const token = await resolveServiceAccountToken(
+      credentialId,
+      CLAUDE_PLATFORM_SERVICE_ACCOUNT_PROVIDER_ID
+    )
+    apiKey = token.accessToken
+  } catch (error) {
+    logger.warn('Failed to resolve Claude Platform credential', { error: getErrorMessage(error) })
     return NextResponse.json({ options: [] })
   }
 
+  // Decrypting and using the credential's key is a credential access — record
+  // it, mirroring the OAuth token route's service-account audit trail.
+  const actorId = authz.requesterUserId
+  const workspaceId = resolved.workspaceId ?? authz.workspaceId ?? null
+  if (actorId) {
+    recordAudit({
+      workspaceId,
+      actorId,
+      action: AuditAction.CREDENTIAL_ACCESSED,
+      resourceType: AuditResourceType.CREDENTIAL,
+      resourceId: credentialId,
+      description: 'Accessed Claude Platform credential to list Managed Agent resources',
+      metadata: {
+        provider: CLAUDE_PLATFORM_SERVICE_ACCOUNT_PROVIDER_ID,
+        credentialType: 'service_account',
+      },
+      request,
+    })
+    captureServerEvent(
+      actorId,
+      'credential_used',
+      {
+        credential_type: 'service_account',
+        provider_id: CLAUDE_PLATFORM_SERVICE_ACCOUNT_PROVIDER_ID,
+        ...(workspaceId ? { workspace_id: workspaceId } : {}),
+      },
+      workspaceId ? { groups: { workspace: workspaceId } } : undefined
+    )
+  }
+
   try {
     const endpoint = RESOURCE_ENDPOINTS[resource]
     const rows = await managedAgentsList<AnthropicListRow>({
-      apiKey: byok.apiKey,
+      apiKey,
       path: endpoint.path,
       beta: endpoint.beta,
       signal: request.signal,
@@ -96,11 +140,7 @@ export const GET = withRouteHandler(async (request: NextRequest) => {
   } catch (error) {
     // Some beta workspaces may not expose every resource (e.g. vaults). Log
     // and degrade to an empty list rather than breaking the editor.
-    logger.warn('Managed agent list proxy failed', {
-      workspaceId,
-      resource,
-      error: getErrorMessage(error),
-    })
+    logger.warn('Managed agent list proxy failed', { resource, error: getErrorMessage(error) })
     return NextResponse.json({ options: [] })
   }
 })

apps/sim/app/api/tools/managed-agent/run/route.ts

@@ -6,7 +6,6 @@ import {
   AnthropicIcon,
   BasetenIcon,
   BrandfetchIcon,
-  ClaudeIcon,
   ContextDevIcon,
   DatagmaIcon,
   DropcontactIcon,
@@ -67,13 +66,6 @@ const PROVIDERS: (BYOKManagerProvider & { id: BYOKProviderId })[] = [
     description: 'LLM calls',
     placeholder: 'sk-ant-...',
   },
-  {
-    id: 'claude-platform',
-    name: 'Claude Platform',
-    icon: ClaudeIcon,
-    description: 'Managed Agents block',
-    placeholder: 'sk-ant-...',
-  },
   {
     id: 'google',
     name: 'Google',
@@ -311,7 +303,6 @@ const PROVIDER_SECTIONS: BYOKProviderSection[] = [
     ids: [
       'openai',
       'anthropic',
-      'claude-platform',
       'google',
       'mistral',
       'xai',

apps/sim/app/workspace/[workspaceId]/settings/components/byok/byok.tsx

@@ -12,8 +12,12 @@ import {
   type OAuthProvider,
   parseProvider,
 } from '@/lib/oauth'
-import { getMissingRequiredScopes } from '@/lib/oauth/utils'
+import { getMissingRequiredScopes, getServiceByProviderAndId } from '@/lib/oauth/utils'
 import { ConnectOAuthModal } from '@/app/workspace/[workspaceId]/components/connect-oauth-modal'
+import {
+  ConnectServiceAccountModal,
+  type ServiceAccountProviderId,
+} from '@/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal'
 import { ConnectSlackBotModal } from '@/app/workspace/[workspaceId]/integrations/components/connect-slack-bot-modal/connect-slack-bot-modal'
 import { formatDisplayText } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/formatted-text'
 import { getWorkflowSearchLabelHighlight } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/workflow-search-highlight'
@@ -50,6 +54,7 @@ export function CredentialSelector({
   const [showConnectModal, setShowConnectModal] = useState(false)
   const [showOAuthModal, setShowOAuthModal] = useState(false)
   const [showSlackBotModal, setShowSlackBotModal] = useState(false)
+  const [showServiceAccountModal, setShowServiceAccountModal] = useState(false)
   const [editingValue, setEditingValue] = useState('')
   const [isEditing, setIsEditing] = useState(false)
   const activeWorkflowId = useWorkflowRegistry((state) => state.activeWorkflowId)
@@ -101,16 +106,23 @@ export function CredentialSelector({
   const credentialKind = subBlock.credentialKind
 
   const credentials = useMemo(() => {
-    // A custom-bot picker lists only the reusable Slack bot credentials
-    // (service-account type), including in trigger mode.
-    if (credentialKind === 'custom-bot') {
+    // A custom-bot or service-account picker lists only the reusable
+    // service-account credentials, including in trigger mode.
+    if (credentialKind === 'custom-bot' || credentialKind === 'service-account') {
       return rawCredentials.filter((cred) => cred.type === 'service_account')
     }
     return isTriggerMode && !subBlock.allowServiceAccounts
       ? rawCredentials.filter((cred) => cred.type !== 'service_account')
       : rawCredentials
   }, [rawCredentials, isTriggerMode, credentialKind, subBlock.allowServiceAccounts])
 
+  // Resolved service-account provider metadata for the token-paste connect
+  // modal (only used when `credentialKind === 'service-account'`).
+  const serviceAccountService = useMemo(
+    () => (serviceId ? getServiceByProviderAndId(provider, serviceId) : undefined),
+    [provider, serviceId]
+  )
+
   const selectedCredential = useMemo(
     () => credentials.find((cred) => cred.id === selectedId),
     [credentials, selectedId]
@@ -189,6 +201,10 @@ export function CredentialSelector({
       setShowSlackBotModal(true)
       return
     }
+    if (credentialKind === 'service-account') {
+      setShowServiceAccountModal(true)
+      return
+    }
     setShowConnectModal(true)
   }, [credentialKind])
 
@@ -235,9 +251,13 @@ export function CredentialSelector({
           ? credentials.length > 0
             ? 'Connect another custom bot'
             : 'Set up a custom bot'
-          : credentials.length > 0
-            ? `Connect another ${getProviderName(provider)} account`
-            : `Connect ${getProviderName(provider)} account`,
+          : credentialKind === 'service-account'
+            ? credentials.length > 0
+              ? `Add another ${getProviderName(provider)} key`
+              : `Add ${getProviderName(provider)} key`
+            : credentials.length > 0
+              ? `Connect another ${getProviderName(provider)} account`
+              : `Connect ${getProviderName(provider)} account`,
       value: '__connect_account__',
       iconElement: <ExternalLink className='size-3' />,
     })
@@ -407,6 +427,22 @@ export function CredentialSelector({
           }}
         />
       )}
+
+      {showServiceAccountModal && serviceAccountService?.serviceAccountProviderId && (
+        <ConnectServiceAccountModal
+          open={showServiceAccountModal}
+          onOpenChange={(open) => {
+            setShowServiceAccountModal(open)
+            if (!open) refetchCredentials()
+          }}
+          workspaceId={workspaceId}
+          serviceAccountProviderId={
+            serviceAccountService.serviceAccountProviderId as ServiceAccountProviderId
+          }
+          serviceName={serviceAccountService.name}
+          serviceIcon={serviceAccountService.icon}
+        />
+      )}
     </div>
   )
 }