Developer section: these pages cover the S6S workflow engine for self-hosted installs and developers. On s6s.ai, API keys and MCP access are issued by S6S on request (contact us); on a self-hosted install, an admin creates them on the API Keys page. For the AI Visibility product, start at the AI Visibility docs.

Credentials

Workflows that call external services need credentials. S6S encrypts them with AES-256-GCM and refreshes expiring OAuth tokens at run time for Google, X, Slack, GitHub and HubSpot.

Two types of credentials

OAuth providers

Google, X (Twitter), Slack, GitHub, Notion, HubSpot, Microsoft, Salesforce, QuickBooks, Dropbox, LinkedIn. One-click “Connect” flow. Tokens refresh automatically at run time for Google, X, Slack, GitHub and HubSpot (and for learned OAuth providers that have a token URL). For other providers, reconnect when access expires.

On a self-hosted install, each OAuth provider needs OAUTH_<PROVIDER>_CLIENT_ID and OAUTH_<PROVIDER>_CLIENT_SECRET set before its Connect flow works.

For Google sub-services (Drive, Sheets, YouTube, Gmail), they all share one Google OAuth connection but each API must be enabled separately in Google Cloud Console.

API key providers

For example Telegram and Discord (bot tokens), Stripe, Airtable, a database connection string, or a generic API key. Paste your key. Stored encrypted.

For learned integrations, a missing credential in the deploy response can include setup_url and setup_instructions to help users get their keys. The fields are left out when S6S has no setup details.

How credentials work in workflows

S6S knows which provider each built-in action needs (for example slack needs a Slack connection). Set "credential" on the step to choose the connection: "default" uses any ready connection for that provider; an account label (for example the connected email address) or a credential ID uses that exact connection. If you leave it out, S6S uses "default". On an http step, "credential" names the provider whose key to send.
On deploy, S6S checks that a matching credential is connected for your account.
If missing: the response includes a missing_credentials array with a connect_url for each.
The connect_url opens a dedicated connect page — OAuth providers start a consent flow, API key providers show an input form.
Once connected, redeploy or run the workflow — credentials are injected automatically.

A deploy with a missing credential still saves the workflow but does not start a run. Abridged response (it also carries hash and, for recipes, refToId):

Deploy response with missing credentials

{
  "ok": true,
  "workflowId": "8c1f2a4e-5b6d-4e7f-9a0b-1c2d3e4f5a6b",
  "versionId": "0d9e8f7a-6b5c-4d3e-2f1a-0b9c8d7e6f5a",
  "version": 1,
  "runId": null,
  "connectedProviders": [],
  "monitorUrl": "https://s6s.ai/workflows/8c1f2a4e-5b6d-4e7f-9a0b-1c2d3e4f5a6b",
  "dashboard_url": "https://s6s.ai/credentials",
  "missing_credentials": [
    {
      "provider": "slack",
      "ref": "default",
      "node_name": "Slack: notify",
      "connect_url": "https://s6s.ai/credentials/connect/slack"
    }
  ],
  "message": "Workflow saved but cannot run — missing credentials for: slack. Connect them at https://s6s.ai/credentials then re-deploy or trigger the workflow."
}

Managing credentials

Dashboard

The /credentials page shows all connected services with their status. It is not in the sidebar; open it directly.

Connect new

Click a provider to start an OAuth flow or paste an API key.

Revoke

Delete a credential binding to remove access. Workflows using it fail until you reconnect.

API

GET /api/v1/credentials lists your credential bindings. Secrets are never exposed in API responses.

Google sub-services

Several Google services share a single OAuth connection. Each Google API must be enabled individually in Google Cloud Console.

Service	Credential
`google_drive`	`google`
`google_sheets`	`google`
`youtube`	`google`
`gmail`	`google`
`google_calendar`	`google`

The deploy response includes api_setup_hints with direct enable URLs for each required Google API. Share these links with your users.

Security

All secrets encrypted at rest with AES-256-GCM
Google, X, Slack, GitHub and HubSpot OAuth tokens refresh within 5 minutes of expiry; an expired token that cannot be refreshed fails the step with a credential error (for example CREDENTIAL_REAUTHORIZATION_REQUIRED) instead of running with a dead token
Workflow JSON holds only a credential reference, and credential values are redacted from step outputs and errors
Use credentialRef in workflow definitions — never raw tokens

← Triggers Dynamic Integrations →