feat(credentials): Salesforce client-credentials + Pipedrive API-token service accounts

Salesforce: third client-credentials minter — SSRF-allowlisted My Domain
token endpoint (production/sandbox/developer partitioned domains), fixed
conservative TTL (Salesforce never returns expires_in; JWT exp clamp when
parseable), live instance_url threaded through the existing instanceUrl
context plumbing so all 40 tools work unchanged.

Pipedrive: token-paste provider with explicit authStyle threading —
descriptor declares x-api-token, resolver/token route/executor carry the
signal, and one shared getPipedriveAuthHeaders helper drives all 18 tools
plus both selector proxy routes (OAuth Bearer behavior untouched).

Zoom: user-scoped tool descriptions note that server-to-server tokens do
not support the 'me' keyword

Author: waleedlatif1

apps/docs/content/docs/en/integrations/meta.json

@@ -12,6 +12,7 @@
     "linear-service-account",
     "monday-service-account",
     "notion-service-account",
+    "pipedrive-service-account",
     "shopify-service-account",
     "trello-service-account",
     "wealthbox-service-account",

apps/docs/content/docs/en/integrations/pipedrive-service-account.mdx

@@ -0,0 +1,74 @@
+---
+title: Pipedrive API Tokens
+description: Connect Pipedrive to Sim with a personal API token instead of an OAuth login
+---
+
+import { Callout } from 'fumadocs-ui/components/callout'
+import { Step, Steps } from 'fumadocs-ui/components/steps'
+import { FAQ } from '@/components/ui/faq'
+
+Pipedrive personal API tokens let your workflows authenticate to Pipedrive without a person's OAuth login. The token is issued per user per company, doesn't expire on its own, and stays valid until it's regenerated or the user is deactivated — no OAuth consent to renew.
+
+The token carries the full data access of the Pipedrive user it belongs to, in that one company. For production workflows, create it from a dedicated Pipedrive user so a teammate leaving or regenerating their token doesn't break your automations.
+
+## Prerequisites
+
+Any Pipedrive user with API access enabled can copy their token. If the API page is hidden, a Pipedrive admin may have disabled API access for non-admin users — an admin can enable it from the company's user settings.
+
+<Callout type="warn">
+Each user has exactly **one** active API token per company. Regenerating it immediately invalidates the old value everywhere it's used, with no grace period. If the token is shared with other integrations, coordinate before regenerating.
+</Callout>
+
+## Finding the API Token
+
+<Steps>
+  <Step>
+    In Pipedrive, click your account name in the top right, then **Company settings** → **Personal preferences** → **API** — or go directly to `https://app.pipedrive.com/settings/api`
+  </Step>
+  <Step>
+    Copy **Your personal API token** (generate one if the field is empty)
+  </Step>
+</Steps>
+
+<Callout type="warn">
+The API token grants everything its user can see and do in Pipedrive. Treat it like a password — do not commit it to source control or share it publicly. Sim encrypts the token at rest.
+</Callout>
+
+## Adding the API Token to Sim
+
+<Steps>
+  <Step>
+    Open your workspace **Settings** and go to the **Integrations** tab
+  </Step>
+  <Step>
+    Search for "Pipedrive Service Account" and click it, then click **Add to Sim** and choose **Add API token**
+  </Step>
+  <Step>
+    Paste the **API token**, and optionally set a display name and description
+  </Step>
+  <Step>
+    Click **Add API token**. Sim verifies the token against Pipedrive (`GET /v1/users/me`) and names the credential after the Pipedrive user and company — if verification fails, you'll see a specific error explaining what went wrong.
+  </Step>
+</Steps>
+
+## Using the API Token in Workflows
+
+Add a Pipedrive block to your workflow. In the credential dropdown, your Pipedrive API token appears alongside any OAuth credentials. Select it and configure the block as you normally would.
+
+Sim sends the token in Pipedrive's `x-api-token` header (the documented scheme for personal API tokens), so every Pipedrive tool works unchanged.
+
+<Callout type="info">
+Pipedrive gives API-token traffic lower burst rate limits than OAuth (roughly a quarter of the OAuth allowance, by plan), and every company shares one daily API budget across all users and both auth methods. Heavy workflow schedules can eat into the budget your other Pipedrive integrations use.
+</Callout>
+
+## Rotating the Token
+
+Pipedrive tokens don't expire on a schedule. To rotate one, regenerate it on the same **Personal preferences** → **API** page, then paste the new value into the credential in Sim right away — the old token stops working the moment a new one is generated.
+
+<FAQ items={[
+  { question: "Why an API token instead of OAuth?", answer: "The token doesn't depend on any user staying logged in or re-consenting, and it never expires on its own. Issued from a dedicated Pipedrive user, it's a stable credential for automated workflows." },
+  { question: "What can the token access?", answer: "Everything the Pipedrive user it belongs to can access, in that one company. There are no scopes to narrow it — pick the issuing user accordingly." },
+  { question: "My token validates but a mailbox or projects block fails — why?", answer: "API tokens ignore scopes, but features like Mailbox and Projects still depend on your Pipedrive plan. A valid token doesn't unlock endpoints your plan doesn't include." },
+  { question: "What happens if the user who owns the token is deactivated?", answer: "The token stops working immediately. Issue a new token from an active user (ideally a dedicated integration user) and update the credential in Sim." },
+  { question: "Why are my workflows hitting rate limits more than with OAuth?", answer: "Pipedrive gives API-token requests about a quarter of the OAuth burst allowance, and the company-wide daily API budget is shared across all users and integrations. Space out heavy schedules or switch busy workflows to OAuth credentials." },
+]} />

apps/sim/app/api/auth/oauth/token/route.test.ts

@@ -12,11 +12,15 @@ import {
 import { NextRequest } from 'next/server'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
-const { mockAuthorizeCredentialUse } = vi.hoisted(() => ({
+const { mockAuthorizeCredentialUse, mockResolveServiceAccountToken } = vi.hoisted(() => ({
   mockAuthorizeCredentialUse: vi.fn(),
+  mockResolveServiceAccountToken: vi.fn(),
 }))
 
-vi.mock('@/app/api/auth/oauth/utils', () => authOAuthUtilsMock)
+vi.mock('@/app/api/auth/oauth/utils', () => ({
+  ...authOAuthUtilsMock,
+  resolveServiceAccountToken: mockResolveServiceAccountToken,
+}))
 
 vi.mock('@/lib/auth/credential-access', () => ({
   authorizeCredentialUse: mockAuthorizeCredentialUse,
@@ -195,6 +199,67 @@ describe('OAuth Token API Routes', () => {
       expect(data).toHaveProperty('error', 'Failed to refresh access token')
     })
 
+    describe('service account path', () => {
+      it('should thread authStyle from the resolver into the response', async () => {
+        authOAuthUtilsMockFns.mockResolveOAuthAccountId.mockResolvedValueOnce({
+          accountId: '',
+          credentialId: 'sa-credential-id',
+          credentialType: 'service_account',
+          providerId: 'pipedrive-service-account',
+          workspaceId: 'workspace-id',
+          usedCredentialTable: true,
+        })
+        mockAuthorizeCredentialUse.mockResolvedValueOnce({
+          ok: true,
+          authType: 'session',
+          requesterUserId: 'test-user-id',
+          workspaceId: 'workspace-id',
+        })
+        mockResolveServiceAccountToken.mockResolvedValueOnce({
+          accessToken: 'pasted-api-token',
+          authStyle: 'x-api-token',
+        })
+
+        const req = createMockRequest('POST', { credentialId: 'sa-credential-id' })
+
+        const response = await POST(req)
+        const data = await response.json()
+
+        expect(response.status).toBe(200)
+        expect(data).toHaveProperty('accessToken', 'pasted-api-token')
+        expect(data).toHaveProperty('authStyle', 'x-api-token')
+      })
+
+      it('should omit authStyle for Bearer token-paste providers', async () => {
+        authOAuthUtilsMockFns.mockResolveOAuthAccountId.mockResolvedValueOnce({
+          accountId: '',
+          credentialId: 'sa-credential-id',
+          credentialType: 'service_account',
+          providerId: 'hubspot-service-account',
+          workspaceId: 'workspace-id',
+          usedCredentialTable: true,
+        })
+        mockAuthorizeCredentialUse.mockResolvedValueOnce({
+          ok: true,
+          authType: 'session',
+          requesterUserId: 'test-user-id',
+          workspaceId: 'workspace-id',
+        })
+        mockResolveServiceAccountToken.mockResolvedValueOnce({
+          accessToken: 'pat-token',
+        })
+
+        const req = createMockRequest('POST', { credentialId: 'sa-credential-id' })
+
+        const response = await POST(req)
+        const data = await response.json()
+
+        expect(response.status).toBe(200)
+        expect(data).toHaveProperty('accessToken', 'pat-token')
+        expect(data).not.toHaveProperty('authStyle')
+      })
+    })
+
     describe('credentialAccountUserId + providerId path', () => {
       it('should reject unauthenticated requests', async () => {
         hybridAuthMockFns.mockCheckSessionOrInternalAuth.mockResolvedValueOnce({

apps/sim/app/api/auth/oauth/token/route.ts

@@ -180,6 +180,8 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
             accessToken: result.accessToken,
             cloudId: result.cloudId,
             domain: result.domain,
+            instanceUrl: result.instanceUrl,
+            authStyle: result.authStyle,
           },
           { status: 200 }
         )

apps/sim/app/api/auth/oauth/utils.ts

@@ -12,7 +12,10 @@ import {
   getClientCredentialAccountMinter,
   parseClientCredentialAccountSecretBlob,
 } from '@/lib/credentials/client-credential-accounts/server'
-import { isTokenServiceAccountProviderId } from '@/lib/credentials/token-service-accounts/descriptors'
+import {
+  getTokenServiceAccountDescriptor,
+  isTokenServiceAccountProviderId,
+} from '@/lib/credentials/token-service-accounts/descriptors'
 import {
   parseTokenServiceAccountSecretBlob,
   type TokenServiceAccountSecretBlob,
@@ -341,6 +344,14 @@ export interface ServiceAccountTokenResult {
   cloudId?: string
   /** Atlassian and domain-scoped token providers (e.g. Shopify) — the site/store domain. */
   domain?: string
+  /** Salesforce only — the org's instance URL the token must be used against. */
+  instanceUrl?: string
+  /**
+   * Set when the token must be sent in an `x-api-token` header instead of
+   * `Authorization: Bearer` (e.g. Pipedrive personal API tokens). Absent means
+   * Bearer; OAuth credentials never carry it.
+   */
+  authStyle?: 'x-api-token'
 }
 
 /**
@@ -369,13 +380,17 @@ async function getTokenServiceAccountSecret(
 interface CachedClientCredentialToken {
   accessToken: string
   expiresAtMs: number
+  /** Salesforce only — the instance URL returned alongside the minted token. */
+  instanceUrl?: string
 }
 
 /**
  * Per-instance cache of minted client-credential access tokens (Zoom S2S,
- * Box CCG), keyed by credential id. Entries are served while more than
- * {@link CLIENT_CREDENTIAL_TOKEN_MIN_TTL_MS} of validity remains, so a hot
- * credential mints roughly once per token TTL (~1h) per instance.
+ * Box CCG, Salesforce client-credentials), keyed by credential id. Entries are
+ * served while more than {@link CLIENT_CREDENTIAL_TOKEN_MIN_TTL_MS} of
+ * validity remains, so a hot credential mints roughly once per token TTL
+ * (~1h for Zoom/Box; Salesforce reports a conservative 10-minute TTL because
+ * its responses never carry an expiry) per instance.
  *
  * The cache is intentionally process-local with no eviction on credential
  * update: a rotated secret can serve the previously minted token for at most
@@ -402,7 +417,7 @@ async function resolveClientCredentialAccountToken(
   return coalesceLocally(`ccsa:${credentialId}`, async () => {
     const cached = clientCredentialTokenCache.get(credentialId)
     if (cached && cached.expiresAtMs - Date.now() > CLIENT_CREDENTIAL_TOKEN_MIN_TTL_MS) {
-      return { accessToken: cached.accessToken }
+      return { accessToken: cached.accessToken, instanceUrl: cached.instanceUrl }
     }
 
     const [credentialRow] = await db
@@ -429,8 +444,9 @@ async function resolveClientCredentialAccountToken(
     clientCredentialTokenCache.set(credentialId, {
       accessToken: mint.accessToken,
       expiresAtMs: Date.now() + mint.expiresInSeconds * 1000,
+      instanceUrl: mint.instanceUrl,
     })
-    return { accessToken: mint.accessToken }
+    return { accessToken: mint.accessToken, instanceUrl: mint.instanceUrl }
   })
 }
 
@@ -484,7 +500,12 @@ export async function resolveServiceAccountToken(
 ): Promise<ServiceAccountTokenResult> {
   if (providerId && isTokenServiceAccountProviderId(providerId)) {
     const secret = await getTokenServiceAccountSecret(credentialId, providerId)
-    return { accessToken: secret.apiToken, domain: secret.domain }
+    const descriptorAuthStyle = getTokenServiceAccountDescriptor(providerId)?.authStyle
+    return {
+      accessToken: secret.apiToken,
+      domain: secret.domain,
+      ...(descriptorAuthStyle === 'x-api-token' ? { authStyle: descriptorAuthStyle } : {}),
+    }
   }
   if (providerId && isClientCredentialAccountProviderId(providerId)) {
     return resolveClientCredentialAccountToken(credentialId, providerId)
@@ -720,35 +741,34 @@ export async function getOAuthToken(userId: string, providerId: string): Promise
 }
 
 /**
- * Refreshes an OAuth token if needed based on credential information.
- * Also handles service account credentials by generating a JWT-based token.
- * @param credentialId The ID of the credential to check and potentially refresh
- * @param userId The user ID who owns the credential (for security verification)
- * @param requestId Request ID for log correlation
- * @param scopes Optional scopes for service account token generation
- * @returns The valid access token or null if refresh fails
+ * Resolves a credential to its access token plus provider metadata
+ * (`cloudId`/`domain`/`instanceUrl`/`authStyle`). Behaves exactly like
+ * {@link refreshAccessTokenIfNeeded} but returns the full
+ * {@link ServiceAccountTokenResult} so callers that build provider requests
+ * directly (e.g. selector routes) can honor non-Bearer auth styles such as
+ * Pipedrive's `x-api-token`. OAuth credentials resolve with `accessToken`
+ * only.
  */
-export async function refreshAccessTokenIfNeeded(
+export async function resolveCredentialAccessToken(
   credentialId: string,
   userId: string,
   requestId: string,
   scopes?: string[],
   impersonateEmail?: string
-): Promise<string | null> {
+): Promise<ServiceAccountTokenResult | null> {
   const resolved = await resolveOAuthAccountId(credentialId)
   if (!resolved) {
     return null
   }
 
   if (resolved.credentialType === 'service_account' && resolved.credentialId) {
     logger.info(`[${requestId}] Using service account token for credential`)
-    const { accessToken } = await resolveServiceAccountToken(
+    return resolveServiceAccountToken(
       resolved.credentialId,
       resolved.providerId,
       scopes,
       impersonateEmail
     )
-    return accessToken
   }
 
   // Use the already-resolved account ID to avoid a redundant resolveOAuthAccountId query
@@ -794,13 +814,13 @@ export async function refreshAccessTokenIfNeeded(
       requestId,
       userId: credential.userId,
     })
-    if (fresh) return fresh
+    if (fresh) return { accessToken: fresh }
 
     // If refresh was only triggered proactively (Microsoft refresh-token aging),
     // the still-valid access token is a fine fallback.
     if (!accessTokenNeedsRefresh && accessToken) {
       logger.info(`[${requestId}] Refresh unavailable; reusing still-valid access token`)
-      return accessToken
+      return { accessToken }
     }
     return null
   }
@@ -811,7 +831,34 @@ export async function refreshAccessTokenIfNeeded(
   }
 
   logger.info(`[${requestId}] Access token is valid for credential`)
-  return accessToken
+  return { accessToken }
+}
+
+/**
+ * Refreshes an OAuth token if needed based on credential information.
+ * Also handles service account credentials by generating a JWT-based token.
+ * Thin string wrapper over {@link resolveCredentialAccessToken}.
+ * @param credentialId The ID of the credential to check and potentially refresh
+ * @param userId The user ID who owns the credential (for security verification)
+ * @param requestId Request ID for log correlation
+ * @param scopes Optional scopes for service account token generation
+ * @returns The valid access token or null if refresh fails
+ */
+export async function refreshAccessTokenIfNeeded(
+  credentialId: string,
+  userId: string,
+  requestId: string,
+  scopes?: string[],
+  impersonateEmail?: string
+): Promise<string | null> {
+  const result = await resolveCredentialAccessToken(
+    credentialId,
+    userId,
+    requestId,
+    scopes,
+    impersonateEmail
+  )
+  return result?.accessToken ?? null
 }
 
 /**

apps/sim/app/api/tools/pipedrive/get-files/route.ts

@@ -11,6 +11,7 @@ import {
 import { generateRequestId } from '@/lib/core/utils/request'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { getFileExtension, getMimeTypeFromExtension } from '@/lib/uploads/utils/file-utils'
+import { getPipedriveAuthHeaders } from '@/tools/pipedrive/utils'
 
 export const dynamic = 'force-dynamic'
 
@@ -54,7 +55,8 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
     const parsed = await parseRequest(pipedriveGetFilesContract, request, {})
     if (!parsed.success) return parsed.response
 
-    const { accessToken, sort, limit, start, downloadFiles } = parsed.data.body
+    const { accessToken, authStyle, sort, limit, start, downloadFiles } = parsed.data.body
+    const authHeaders = getPipedriveAuthHeaders({ accessToken, authStyle })
 
     const baseUrl = 'https://api.pipedrive.com/v1/files'
     const queryParams = new URLSearchParams()
@@ -75,10 +77,7 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
 
     const response = await secureFetchWithPinnedIP(apiUrl, urlValidation.resolvedIP!, {
       method: 'GET',
-      headers: {
-        Authorization: `Bearer ${accessToken}`,
-        Accept: 'application/json',
-      },
+      headers: authHeaders,
     })
 
     const data = (await response.json()) as PipedriveApiResponse
@@ -114,7 +113,7 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
             fileUrlValidation.resolvedIP!,
             {
               method: 'GET',
-              headers: { Authorization: `Bearer ${accessToken}` },
+              headers: authHeaders,
             }
           )