Infisical is an open source secrets manager. If your API keys and credentials already live there, you can now connect it to Trigger.dev and have those secrets land in your environment variables.
Until now, the way to pull Infisical secrets into Trigger.dev was the syncEnvVars build extension, which resolves them at build time when you deploy. The new native Secret Sync lives inside Infisical and pushes secrets straight onto your Trigger.dev environment variables page. You set it up once, then manage everything from Infisical.
How it works
Two pieces, both set up from the Infisical dashboard:
- Connect your account. Add a Trigger.dev App Connection in Infisical using a Personal Access Token. Self-hosting? Point it at your own instance URL. Trigger.dev Cloud is the default.
- Create a Secret Sync. Pick the connection, choose an organization and project (pulled live from your Trigger.dev account), select the target environment (Production, Staging, Development, or Preview), and point it at the secret path you want to sync.
Once it's running, update a secret in Infisical and the sync pushes it to Trigger.dev. Your tasks pick up the new value on their next run, no redeploy. It overwrites only the keys it syncs, so the variables you set by hand can be left alone.
Marked as secret by default
The sync has a Mark variables as secret option, on by default. Synced values are stored as secret environment variables in Trigger.dev, so they're redacted when read back on the environment variables page, the same as any secret you set by hand.
Getting started
You'll need a Trigger.dev Personal Access Token (dashboard, account menu, Personal Access Tokens) and an Infisical project. Then follow the Trigger.dev Secret Sync guide to wire it up.