fix(monday): support OAuth 2.1

[BillLeoutsakosvl346]

Summary

Fix Monday account connections for the OAuth 2.1 flow used by the production Monday app.

The observed production failure occurs at authorization with invalid_scope because the live Monday app version does not accept the seven scopes Sim requests. The connector was also still configured for the legacy Monday flow: PKCE was disabled, code exchange and refresh used the legacy token endpoint, and refresh-token rotation and JWT access-token expiry were not handled. Updating only the Monday app settings would therefore expose later callback and refresh failures.

This PR:

• adds a bounded, secret-safe Monday OAuth 2.1 code exchange using PKCE and the new token endpoint
• derives access-token expiry from the JWT exp claim, then expires_in, then the documented one-hour fallback
• enables JSON client-credential requests and mandatory refresh-token rotation for ordinary credentials
• requires PKCE and refresh tokens for newly enrolled managed Monday credentials
• rejects Monday GraphQL user-info errors even when the response is HTTP 200
• preserves existing legacy Monday credentials with no expiry or refresh token
• leaves the API-key path, callback route, base URL logic, environment capabilities, and database schema unchanged

Production report: https://sim-ai.slack.com/archives/C093DF8MA21/p1788311390749429

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation
• Other: ___________

Testing

Passed locally:

• focused Monday OAuth, managed OAuth, standard-provider, credential persistence, and API-key tests: 148 tests
• full apps/sim Vitest suite: 2,869 files passed, 7 skipped; 39,606 tests passed, 67 skipped
• bun run --cwd apps/sim type-check
• bun run --cwd apps/sim lint:check
• bun run check:api-validation
• bun run check

Review focus:

• the exact callback and PKCE verifier forwarded to the Monday v2 token endpoint
• mandatory persistence of every rotated refresh token
• compatibility behavior for legacy credentials that have no expiry and no refresh token
• secret-safe handling of malformed or oversized token responses

Required Monday rollout configuration

Before production rollout, configure the matching Monday app version in Monday Developer Center:

1. Enable the new OAuth flow.
2. Enable all seven scopes requested by Sim: boards:read, boards:write, updates:read, updates:write, webhooks:read, webhooks:write, and me:read.
3. Register the exact callback for each environment. Production must include https://www.sim.ai/api/auth/oauth2/callback/monday.
4. Validate the draft with Active for me.
5. Deploy this compatible code before publishing the corrected production Monday app version.

Users whose authorization already failed must start the connection again after the app version is published. Existing credentials are intentionally not migrated in this PR.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

Screenshots/Videos

Not applicable; this change has no UI modifications.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Sep 2, 2026 2:58am UTC

[greptile-apps]

Greptile Summary

The PR updates Monday authentication to support its production OAuth 2.1 flow.

• Enables PKCE and refresh-token requirements for ordinary and managed Monday enrollment.
• Uses Monday’s new JSON token endpoint for authorization-code and refresh exchanges.
• Derives access-token expiry from JWT claims with bounded fallbacks and persists rotated refresh tokens.
• Adds bounded token and user-info response handling, including GraphQL error detection.
• Preserves legacy Monday credentials that have neither expiry nor refresh-token metadata.

Confidence Score: 5/5

The PR appears safe to merge, with no concrete changed-code defect established.

The reviewed enrollment, token exchange, refresh rotation, expiry derivation, legacy compatibility, and bounded-response paths are internally consistent, and no reachable blocking failure remains.

Important Files Changed

Filename	Overview
apps/sim/lib/oauth/monday.ts	Adds a bounded, PKCE-aware Monday authorization-code exchange and JWT-based access-token expiry resolution.
apps/sim/lib/oauth/oauth.ts	Moves Monday refreshes to the OAuth 2.1 endpoint, JSON credentials, rotation enforcement, and JWT-derived expiry.
apps/sim/lib/auth/connectors/providers.ts	Enables PKCE for the ordinary Monday connector, installs the custom exchange, and hardens user-info parsing.
apps/sim/lib/auth/connectors/managed-oauth.ts	Requires PKCE and refresh-token persistence for newly enrolled managed Monday credentials.
apps/sim/lib/oauth/monday.test.ts	Covers the new exchange body, expiry precedence, malformed responses, secret-safe errors, and response limits.

Sequence Diagram

sequenceDiagram
  participant U as User
  participant S as Sim OAuth callback
  participant M as Monday OAuth
  participant D as Credential store
  U->>S: Start Monday authorization
  S->>M: Authorization request with PKCE challenge
  M-->>S: Authorization code
  S->>M: Exchange code, verifier, and callback URI
  M-->>S: Access token, rotated refresh token, scopes
  S->>D: Persist tokens and derived expiry
  D-->>S: Expiring credential
  S->>M: Refresh using JSON client credentials
  M-->>S: New access and refresh tokens
  S->>D: Persist rotated refresh token and expiry

Loading

_{Reviews (1): Last reviewed commit: "fix(monday): support OAuth 2.1" | Re-trigger Greptile}

[cubic-dev-ai]

All reported issues were addressed across 9 files

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[BillLeoutsakosvl346]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@BillLeoutsakosvl346 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 9 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}