feat(settings): add a self-host section with the managed Chat keys link

Self-hosters had no in-app pointer to the managed service that issues their
Chat keys. New Settings > System > Self-host section, gated on `requiresSelfHosted`
so it is absent on hosted Sim, containing only that link.

Author: TheodoreSpeaks

apps/sim/app/workspace/[workspaceId]/settings/[section]/page.tsx

@@ -58,6 +58,7 @@ const WORKSPACE_SECTION_MAP: Partial<Record<SettingsSection, WorkspaceSettingsSe
   'recently-deleted': 'recently-deleted',
   forks: 'forks',
   'custom-blocks': 'custom-blocks',
+  'self-host': 'self-host',
 }
 
 const ORGANIZATION_SECTION_MAP: Partial<Record<SettingsSection, OrganizationSettingsSection>> = {

apps/sim/app/workspace/[workspaceId]/settings/[section]/settings.tsx

@@ -55,6 +55,11 @@ const RecentlyDeleted = dynamic(() =>
     '@/app/workspace/[workspaceId]/settings/components/recently-deleted/recently-deleted'
   ).then((m) => m.RecentlyDeleted)
 )
+const SelfHost = dynamic(() =>
+  import('@/app/workspace/[workspaceId]/settings/components/self-host/self-host').then(
+    (m) => m.SelfHost
+  )
+)
 const Billing = dynamic(() =>
   import('@/app/workspace/[workspaceId]/settings/components/billing/billing').then((m) => m.Billing)
 )
@@ -200,6 +205,7 @@ export function SettingsPage({ section }: SettingsPageProps) {
       {effectiveSection === 'workflow-mcp-servers' && <WorkflowMcpServers />}
       {effectiveSection === 'inbox' && <Inbox />}
       {effectiveSection === 'recently-deleted' && <RecentlyDeleted />}
+      {effectiveSection === 'self-host' && <SelfHost />}
       {effectiveSection === 'admin' && <Admin />}
       {effectiveSection === 'mothership' && <Mothership />}
     </SettingsSectionProvider>

apps/sim/app/workspace/[workspaceId]/settings/components/self-host/self-host.test.tsx

@@ -0,0 +1,26 @@
+/**
+ * @vitest-environment node
+ */
+import { renderToStaticMarkup } from 'react-dom/server'
+import { describe, expect, it } from 'vitest'
+import { SelfHost } from '@/app/workspace/[workspaceId]/settings/components/self-host/self-host'
+
+describe('SelfHost settings section', () => {
+  it('links to the managed Chat keys page', () => {
+    const markup = renderToStaticMarkup(<SelfHost />)
+
+    expect(markup).toContain('href="https://www.sim.ai/selfhost/settings/chat-keys"')
+  })
+
+  /**
+   * The section is deliberately only the managed link — no status readouts,
+   * capability inventories, or environment-variable listings.
+   */
+  it('renders exactly one link and no other controls', () => {
+    const markup = renderToStaticMarkup(<SelfHost />)
+
+    expect(markup.match(/<a /g)).toHaveLength(1)
+    expect(markup).not.toContain('<button')
+    expect(markup).not.toContain('<input')
+  })
+})

apps/sim/app/workspace/[workspaceId]/settings/components/self-host/self-host.tsx

@@ -0,0 +1,29 @@
+'use client'
+
+import { ChipLink } from '@sim/emcn'
+import { SITE_URL } from '@/lib/core/utils/urls'
+import { SettingsPanel } from '@/app/workspace/[workspaceId]/settings/components/settings-panel'
+import { SettingsSection } from '@/app/workspace/[workspaceId]/settings/components/settings-section/settings-section'
+
+/** Chat keys are issued by the managed service, not by this deployment. */
+const CHAT_KEYS_HREF = `${SITE_URL}/selfhost/settings/chat-keys`
+
+export function SelfHost() {
+  return (
+    <SettingsPanel>
+      <SettingsSection label='Chat keys'>
+        <div className='flex items-center justify-between px-2'>
+          <div className='flex flex-col justify-center gap-[1px]'>
+            <span className='text-[var(--text-body)] text-sm'>Managed on sim.ai</span>
+            <span className='text-[var(--text-muted)] text-caption'>
+              Manage the model-provider keys that power Chat on this deployment.
+            </span>
+          </div>
+          <ChipLink href={CHAT_KEYS_HREF} target='_blank' rel='noopener noreferrer'>
+            Manage keys
+          </ChipLink>
+        </div>
+      </SettingsSection>
+    </SettingsPanel>
+  )
+}

apps/sim/app/workspace/[workspaceId]/settings/navigation.test.ts

@@ -51,6 +51,7 @@ describe('unified settings navigation', () => {
       { id: 'sandboxes', label: 'Sandboxes', section: 'workspace' },
       { id: 'inbox', label: 'Sim Mailer', section: 'workspace' },
       { id: 'recently-deleted', label: 'Recently deleted', section: 'workspace' },
+      { id: 'self-host', label: 'Self-host', section: 'workspace' },
       { id: 'sso', label: 'Single sign-on', section: 'organization' },
       { id: 'sessions', label: 'Session policies', section: 'organization' },
       { id: 'data-retention', label: 'Data retention', section: 'organization' },
@@ -87,6 +88,7 @@ describe('unified settings navigation', () => {
       'apikeys',
       'sandboxes',
       'recently-deleted',
+      'self-host',
     ])
     expect(idsForSection('organization')).toEqual([
       'organization',

apps/sim/components/settings/navigation.test.ts

@@ -1,7 +1,7 @@
 /**
  * @vitest-environment node
  */
-import { resetEnvMock, setEnv } from '@sim/testing'
+import { resetEnvFlagsMock, resetEnvMock, setEnv, setEnvFlags } from '@sim/testing'
 import { afterAll, beforeEach, describe, expect, it } from 'vitest'
 import {
   ACCOUNT_SETTINGS_ITEMS,
@@ -32,9 +32,13 @@ import {
  */
 beforeEach(() => {
   setEnv({ NEXT_PUBLIC_SANDBOX_ENABLED: 'true', NEXT_PUBLIC_E2B_ENABLED: undefined })
+  resetEnvFlagsMock()
 })
 
-afterAll(resetEnvMock)
+afterAll(() => {
+  resetEnvMock()
+  resetEnvFlagsMock()
+})
 
 describe('settings navigation boundaries', () => {
   it('preserves the order of all four settings catalogs', () => {
@@ -58,6 +62,7 @@ describe('settings navigation boundaries', () => {
       'sandboxes',
       'inbox',
       'recently-deleted',
+      'self-host',
       'sso',
       'sessions',
       'data-retention',
@@ -99,6 +104,7 @@ describe('settings navigation boundaries', () => {
       'recently-deleted',
       'forks',
       'custom-blocks',
+      'self-host',
     ])
   })
 
@@ -127,6 +133,50 @@ describe('settings navigation boundaries', () => {
     ).not.toContain('sandboxes')
   })
 
+  /**
+   * The Self-host section links out to the managed service that issues this
+   * deployment's Chat keys. On Sim Cloud that surface is reached from the
+   * account plane instead, so the section must not exist there at all — in the
+   * sidebar catalog or in the workspace-plane gate the route consults.
+   */
+  it('shows the Self-host section only on a self-hosted deployment', () => {
+    setEnvFlags({ isHosted: false })
+
+    expect(buildUnifiedSettingsNavigation().map(({ id }) => id)).toContain('self-host')
+    expect(
+      resolveWorkspaceNavigation({
+        permission: 'admin',
+        permissionConfig: {},
+        entitlements: {
+          byok: true,
+          inbox: true,
+          customBlocks: true,
+          forks: true,
+          sandboxes: true,
+        },
+      }).map(({ id }) => id)
+    ).toContain('self-host')
+  })
+
+  it('drops the Self-host section on hosted Sim', () => {
+    setEnvFlags({ isHosted: true })
+
+    expect(buildUnifiedSettingsNavigation().map(({ id }) => id)).not.toContain('self-host')
+    expect(
+      resolveWorkspaceNavigation({
+        permission: 'admin',
+        permissionConfig: {},
+        entitlements: {
+          byok: true,
+          inbox: true,
+          customBlocks: true,
+          forks: true,
+          sandboxes: true,
+        },
+      }).map(({ id }) => id)
+    ).not.toContain('self-host')
+  })
+
   it('keeps the Sandboxes section on the pre-Daytona E2B flag alone', () => {
     setEnv({ NEXT_PUBLIC_SANDBOX_ENABLED: undefined, NEXT_PUBLIC_E2B_ENABLED: 'true' })
 
@@ -367,6 +417,7 @@ describe('settings navigation boundaries', () => {
         'inbox',
         'recently-deleted',
         'custom-blocks',
+        'self-host',
       ],
       mutable: [],
     },
@@ -384,6 +435,7 @@ describe('settings navigation boundaries', () => {
         'inbox',
         'recently-deleted',
         'custom-blocks',
+        'self-host',
       ],
       mutable: ['secrets', 'custom-tools', 'mcp', 'workflow-mcp-servers', 'recently-deleted'],
     },
@@ -439,6 +491,7 @@ describe('settings navigation boundaries', () => {
       'recently-deleted',
       'forks',
       'custom-blocks',
+      'self-host',
     ])
   })
 

apps/sim/components/settings/navigation.ts

@@ -73,6 +73,7 @@ export type WorkspaceSettingsSection =
   | 'recently-deleted'
   | 'forks'
   | 'custom-blocks'
+  | 'self-host'
 
 export type SettingsSection =
   | AccountSettingsSection
@@ -119,6 +120,7 @@ export type UnifiedSettingsSection =
   | 'data-drains'
   | 'mothership'
   | 'recently-deleted'
+  | 'self-host'
 
 export type UnifiedNavigationSection = 'account' | 'workspace' | 'organization' | 'platform'
 
@@ -141,6 +143,12 @@ export interface UnifiedSettingsNavigationItem {
   requiresEnterprise?: boolean
   requiresMax?: boolean
   requiresHosted?: boolean
+  /**
+   * The inverse of {@link UnifiedSettingsNavigationItem.requiresHosted}: the
+   * section exists only on a self-hosted deployment and is absent on Sim Cloud,
+   * where the same surface is reached from the managed service instead.
+   */
+  requiresSelfHosted?: boolean
   selfHostedOverride?: boolean
   requiresSuperUser?: boolean
   requiresAdminRole?: boolean
@@ -680,6 +688,20 @@ export const SETTINGS_SECTION_REGISTRY: readonly SettingsSectionRegistryEntry[]
       workspace: { id: 'recently-deleted', group: 'system', order: 9 },
     },
   },
+  {
+    label: 'Self-host',
+    icon: Server,
+    unified: {
+      id: 'self-host',
+      description: 'Manage this deployment from the Sim managed service.',
+      group: 'workspace',
+      order: 10,
+      requiresSelfHosted: true,
+    },
+    planes: {
+      workspace: { id: 'self-host', group: 'system', order: 12 },
+    },
+  },
   {
     label: 'Single sign-on',
     icon: LogIn,
@@ -821,6 +843,9 @@ export function buildUnifiedSettingsNavigation(): UnifiedSettingsNavigationItem[
     // `selfHostedOverride` short-circuit would otherwise reveal the tab on a
     // deployment that has the entitlement but no provider to run what it builds.
     if (unified.id === 'sandboxes' && !isSandboxExecutionAvailable()) return []
+    // Dropped here so the sidebar, the route's `parseSection` gate, and section
+    // metadata all agree that the section does not exist on Sim Cloud.
+    if (unified.requiresSelfHosted && isHosted) return []
     const { group, ...item } = unified
     return [
       {
@@ -996,6 +1021,7 @@ const WORKSPACE_MUTATION_PERMISSION: Record<WorkspaceSettingsSection, Permission
   'recently-deleted': 'write',
   forks: 'admin',
   'custom-blocks': 'admin',
+  'self-host': 'admin',
 }
 
 export interface WorkspaceMutationCapabilities {
@@ -1028,6 +1054,8 @@ export function resolveWorkspaceNavigation({
     if (item.id === 'custom-blocks' && !entitlements.customBlocks) return []
     // Removed, not locked: a missing provider is not something an upgrade fixes.
     if (item.id === 'sandboxes' && !isSandboxExecutionAvailable()) return []
+    // Absent on Sim Cloud, where the managed service owns these settings.
+    if (item.id === 'self-host' && isHosted) return []
 
     const lockedBy = LOCKABLE_WORKSPACE_SECTIONS[item.id]
     const locked = lockedBy !== undefined && !entitlements[lockedBy]