@@ -2,7 +2,7 @@ import { db } from '@sim/db'
 import { account, credential, credentialMember } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
 import { authorizeWorkflowByWorkspacePermission } from '@sim/platform-authz/workflow'
-import { and, eq, inArray, isNotNull } from 'drizzle-orm'
+import { and, eq, isNotNull } from 'drizzle-orm'
 import { type NextRequest, NextResponse } from 'next/server'
 import { oauthCredentialsQuerySchema } from '@/lib/api/contracts/credentials'
 import { getValidationErrorMessage } from '@/lib/api/server'
@@ -14,7 +14,6 @@ import { syncWorkspaceOAuthCredentialsForUser } from '@/lib/credentials/oauth'
 import {
   getCanonicalScopesForProvider,
   getServiceAccountProviderForProviderId,
-  providerIdsForService,
 } from '@/lib/oauth/utils'
 import { checkWorkspaceAccess } from '@/lib/workspaces/permissions/utils'
 
@@ -242,7 +241,7 @@ export const GET = withRouteHandler(async (request: NextRequest) => {
           and(
             eq(credential.workspaceId, effectiveWorkspaceId),
             eq(credential.type, 'oauth'),
-            inArray(account.providerId, providerIdsForService(providerParam)),
+            eq(account.providerId, providerParam),
             requesterCanAdmin ? undefined : isNotNull(credentialMember.id)
           )
         )
 
@@ -10,7 +10,6 @@ import { getSession } from '@/lib/auth'
 import { generateRequestId } from '@/lib/core/utils/request'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { deleteCredential } from '@/lib/credentials/deletion'
-import { providerIdsForService } from '@/lib/oauth/utils'
 import { captureServerEvent } from '@/lib/posthog/server'
 
 export const dynamic = 'force-dynamic'
@@ -62,13 +61,7 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
         ? and(eq(account.userId, session.user.id), eq(account.providerId, providerId))
         : and(
             eq(account.userId, session.user.id),
-            or(
-              // The prefix sweep already caught `{base}-{feature}` ids by
-              // accident; an alternate authorization server shares that shape,
-              // so name it explicitly rather than relying on the accident.
-              inArray(account.providerId, providerIdsForService(provider)),
-              like(account.providerId, `${provider}-%`)
-            )
+            or(eq(account.providerId, provider), like(account.providerId, `${provider}-%`))
           )
 
     const targetAccounts = await db.select({ id: account.id }).from(account).where(accountFilter)
 
@@ -547,64 +547,3 @@ describe('OAuth Token API Routes', () => {
     })
   })
 })
-
-describe('Salesforce instance URL resolution', () => {
-  const INSTANCE = 'https://acme--sbx.sandbox.my.salesforce.com'
-
-  beforeEach(() => {
-    vi.clearAllMocks()
-    authOAuthUtilsMockFns.mockResolveOAuthAccountId.mockResolvedValue(null)
-    mockAuthorizeCredentialUse.mockResolvedValue({
-      ok: true,
-      authType: 'session',
-      requesterUserId: 'test-user-id',
-      credentialOwnerUserId: 'owner-user-id',
-    })
-    authOAuthUtilsMockFns.mockRefreshTokenIfNeeded.mockResolvedValue({
-      accessToken: 'fresh-token',
-      refreshed: false,
-    })
-  })
-
-  /**
-   * The org host is smuggled through `scope` because the token response has
-   * nowhere to put it; the tools read it back as their `instanceUrl` param.
-   */
-  function credentialForProvider(providerId: string) {
-    return {
-      id: 'credential-id',
-      accessToken: 'test-token',
-      refreshToken: 'refresh-token',
-      accessTokenExpiresAt: new Date(Date.now() + 3600 * 1000),
-      providerId,
-      scope: `__sf_instance__:${INSTANCE} api refresh_token openid`,
-    }
-  }
-
-  it.each(['salesforce', 'salesforce-sandbox'])(
-    'returns the stored instance URL for a %s credential',
-    async (providerId) => {
-      authOAuthUtilsMockFns.mockGetCredential.mockResolvedValueOnce(
-        credentialForProvider(providerId)
-      )
-
-      const response = await POST(createMockRequest('POST', { credentialId: 'credential-id' }))
-      const data = await response.json()
-
-      expect(response.status).toBe(200)
-      expect(data.instanceUrl).toBe(INSTANCE)
-    }
-  )
-
-  it('omits instanceUrl for a non-Salesforce provider carrying a lookalike scope', async () => {
-    authOAuthUtilsMockFns.mockGetCredential.mockResolvedValueOnce({
-      ...credentialForProvider('google'),
-    })
-
-    const response = await POST(createMockRequest('POST', { credentialId: 'credential-id' }))
-    const data = await response.json()
-
-    expect(response.status).toBe(200)
-    expect(data.instanceUrl).toBeUndefined()
-  })
-})
@@ -12,7 +12,6 @@ import { AuthType, checkSessionOrInternalAuth } from '@/lib/auth/hybrid'
 import { generateRequestId } from '@/lib/core/utils/request'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { TokenServiceAccountValidationError } from '@/lib/credentials/token-service-accounts/errors'
-import { extractSalesforceInstanceUrl, isSalesforceOAuthProviderId } from '@/lib/oauth/salesforce'
 import { captureServerEvent } from '@/lib/posthog/server'
 import {
   getCredential,
@@ -27,6 +26,11 @@ export const dynamic = 'force-dynamic'
 
 const logger = createLogger('OAuthTokenAPI')
 
+const SALESFORCE_INSTANCE_URL_REGEX = /__sf_instance__:([^\s]+)/
+// Stop at a comma or whitespace: better-auth persists Zoho's scopes comma-joined
+// (no spaces), so a greedy `\S+` would swallow the whole scope list into the host.
+// The Desk base URL itself never contains a comma or space.
+
 /**
  * Get an access token for a specific credential
  * Supports both session-based authentication (for client-side requests)
@@ -283,9 +287,13 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
         )
       }
 
-      const instanceUrl = isSalesforceOAuthProviderId(credential.providerId)
-        ? extractSalesforceInstanceUrl(credential.scope)
-        : undefined
+      let instanceUrl: string | undefined
+      if (credential.providerId === 'salesforce' && credential.scope) {
+        const instanceMatch = credential.scope.match(SALESFORCE_INSTANCE_URL_REGEX)
+        if (instanceMatch) {
+          instanceUrl = instanceMatch[1]
+        }
+      }
 
       // Zoho Desk persists its data-center-specific REST base URL in the scope
       // string (derived from the token response api_domain) so callers never
@@ -402,9 +410,14 @@ export const GET = withRouteHandler(async (request: NextRequest) => {
         )
       }
 
-      const instanceUrl = isSalesforceOAuthProviderId(credential.providerId)
-        ? extractSalesforceInstanceUrl(credential.scope)
-        : undefined
+      // For Salesforce, extract instanceUrl from the scope field
+      let instanceUrl: string | undefined
+      if (credential.providerId === 'salesforce' && credential.scope) {
+        const instanceMatch = credential.scope.match(SALESFORCE_INSTANCE_URL_REGEX)
+        if (instanceMatch) {
+          instanceUrl = instanceMatch[1]
+        }
+      }
 
       // Zoho Desk persists its data-center-specific REST base URL in the scope
       // string (derived from the token response api_domain) so callers never
 
@@ -466,8 +466,7 @@ function secretFingerprintOf(encryptedServiceAccountKey: string): string {
 
 /**
  * Resolves a client-credential service-account credential to a short-lived
- * access token: decrypts the stored credential material (client id + secret,
- * or the private key and run-as username for key-based grants) and mints via
+ * access token: decrypts the stored client id/secret + org id and mints via
  * the provider's registered minter (skipping the connect-time identity
  * lookup), read-through the per-instance cache. Wrapped in `coalesceLocally`
  * so concurrent block executions on one instance share a single mint.
@@ -527,9 +526,6 @@ async function resolveClientCredentialAccountToken(
           clientSecret: blob.clientSecret,
           orgId: blob.orgId,
           dataCenter: blob.dataCenter,
-          authMethod: blob.authMethod,
-          privateKey: blob.privateKey,
-          username: blob.username,
         },
         { skipIdentity: true }
       )
 
@@ -37,19 +37,6 @@ vi.mock('@/lib/credentials/access', () => ({
 
 vi.mock('@/lib/oauth/utils', () => ({
   getAllOAuthServices: vi.fn(() => [{ providerId: 'google-email', name: 'Gmail' }]),
-  // Real implementation: a credential id matches its service's OAuth id, an
-  // alternate authorization server, or the family's service-account id.
-  credentialProviderMatchesService: (
-    credentialProviderId: string,
-    service: {
-      providerId: string
-      serviceAccountProviderId?: string
-      additionalProviderIds?: readonly string[]
-    }
-  ) =>
-    service.providerId === credentialProviderId ||
-    service.serviceAccountProviderId === credentialProviderId ||
-    (service.additionalProviderIds?.includes(credentialProviderId) ?? false),
 }))
 
 import { GET } from '@/app/api/auth/oauth2/authorize/route'
 
@@ -90,9 +90,6 @@ export const PUT = withRouteHandler(
         clientSecret: body.clientSecret,
         orgId: body.orgId,
         dataCenter: body.dataCenter,
-        authMethod: body.authMethod,
-        privateKey: body.privateKey,
-        username: body.username,
         request,
       })
       if (!result.success) {
 
@@ -30,7 +30,7 @@ import {
 } from '@/lib/credentials/service-account-secret'
 import { isTokenServiceAccountProviderId } from '@/lib/credentials/token-service-accounts/descriptors'
 import { TokenServiceAccountValidationError } from '@/lib/credentials/token-service-accounts/errors'
-import { getServiceConfigByProviderId, providerIdsForService } from '@/lib/oauth'
+import { getServiceConfigByProviderId } from '@/lib/oauth'
 import { SLACK_CUSTOM_BOT_PROVIDER_ID } from '@/lib/oauth/types'
 import { captureServerEvent } from '@/lib/posthog/server'
 import { checkWorkspaceAccess } from '@/lib/workspaces/permissions/utils'
@@ -237,7 +237,7 @@ export const GET = withRouteHandler(async (request: NextRequest) => {
       whereClauses.push(eq(credential.type, type))
     }
     if (providerId) {
-      whereClauses.push(inArray(credential.providerId, providerIdsForService(providerId)))
+      whereClauses.push(eq(credential.providerId, providerId))
     }
 
     const isWorkspaceAdmin = workspaceAccess.canAdmin
@@ -331,9 +331,6 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
       clientSecret,
       orgId,
       dataCenter,
-      authMethod,
-      privateKey,
-      username,
     } = parsed.data.body
 
     const workspaceAccess = await checkWorkspaceAccess(workspaceId, session.user.id)
@@ -395,9 +392,6 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
           clientSecret,
           orgId,
           dataCenter,
-          authMethod,
-          privateKey,
-          username,
         })
         resolvedProviderId = secret.providerId
         resolvedAccountId = null
 
@@ -25,7 +25,7 @@ import {
   type OAuthProvider,
   parseProvider,
 } from '@/lib/oauth'
-import { getScopeDescription, getServiceConfigByProviderId } from '@/lib/oauth/utils'
+import { getScopeDescription } from '@/lib/oauth/utils'
 import { useCreateCredentialDraft, useWorkspaceCredentials } from '@/hooks/queries/credentials'
 import { useConnectOAuthService } from '@/hooks/queries/oauth/oauth-connections'
 
@@ -129,34 +129,11 @@ export function ConnectOAuthModal(props: ConnectOAuthModalProps) {
   const { open, onOpenChange, mode } = props
   const isConnect = mode === 'connect'
 
-  const declaredProviderId = useMemo(
+  const providerId = useMemo(
     () => props.providerId ?? (props.serviceId ? getProviderIdFromServiceId(props.serviceId) : ''),
     [props.providerId, props.serviceId]
   )
 
-  /**
-   * Authorization servers this service can be connected through, when it has
-   * more than one (Salesforce production vs sandbox). Offered on connect only:
-   * a reauthorize must return to the server that issued the credential.
-   */
-  const { authServerOptions, authServerHint } = useMemo(() => {
-    const service = isConnect ? getServiceConfigByProviderId(declaredProviderId) : null
-    const labels = service?.providerIdLabels
-    if (!service?.additionalProviderIds?.length || !labels) {
-      return { authServerOptions: [], authServerHint: undefined }
-    }
-    return {
-      authServerOptions: [service.providerId, ...service.additionalProviderIds].map((value) => ({
-        value,
-        label: labels[value] ?? value,
-      })),
-      authServerHint: service.providerIdPickerHint,
-    }
-  }, [isConnect, declaredProviderId])
-
-  const [selectedProviderId, setSelectedProviderId] = useState<string | null>(null)
-  const providerId = selectedProviderId ?? declaredProviderId
-
   const [displayName, setDisplayName] = useState('')
   const [description, setDescription] = useState('')
   const [validationError, setValidationError] = useState<string | null>(null)
@@ -225,7 +202,6 @@ export function ConnectOAuthModal(props: ConnectOAuthModalProps) {
   useEffect(() => {
     if (!open) {
       prefilled.current = false
-      setSelectedProviderId(null)
       return
     }
     if (!isConnect || prefilled.current || credentialsLoading) return
@@ -353,18 +329,6 @@ export function ConnectOAuthModal(props: ConnectOAuthModalProps) {
           </p>
         )}
 
-        {authServerOptions.length > 0 && (
-          <ChipModalField
-            type='dropdown'
-            title='Environment'
-            value={providerId}
-            onChange={setSelectedProviderId}
-            options={authServerOptions}
-            align='start'
-            hint={authServerHint}
-          />
-        )}
-
         {isConnect && (
           <ChipModalField
             type='input'