Summary
Using the new app builder to build dashboards against a GraphQL API that relies on per-user OAuth, resource calls suddenly began failing with "Access forbidden. Resources with user authentication cannot be called in workflows invoked outside of Agents, Apps, and direct workflow runs" — and the only workaround found (a shared resource authenticated as a single user) defeats the API's fine-grained per-user permissions.
AI Response
This error reflects an intentional, longstanding Retool restriction rather than a regression: resources configured with per-user authentication only pass the invoking user's credentials when called directly from an app, an agent, or a direct workflow run, and are blocked when invoked from a detached workflow context. It surfaced now because the new app builder can route resource calls through workflows/functions, so calls that previously ran in-app now execute in a workflow context that lacks the user's OAuth credentials. There is no toggle to disable the restriction itself; the reliable path is to keep the resource call executing in a supported context (app/agent/direct run) so the per-user credentials are carried through, since switching to a single shared credential is the only alternative and it inherently drops per-user permissions.
Sources
Google Sheet Error in Retool Workflows
A Retool staff reply reproduces the exact error and confirms it is an expected, non-new limitation — user-authenticated resources can't run in workflow contexts that lack the invoking user's credentials.
A Retool changelog post confirming the new app builder triggers workflows from functions, corroborating why resource calls now hit the workflow-context restriction on user-authenticated resources.
The Community Team is testing out a new automation. Let us know if it's helpful (or not) by leaving a 
, 
, or 
. Or by marking this post as the "Solution"! Let us know if you have any feedback here. 