Every environment used to authenticate with a single secret key. Now each environment can hold as many keys as you want, so every service, CI job, or integration that talks to Trigger.dev carries its own credential. Keys use the format tr_prod_sk_... and tr_preview_sk_..., and Trigger.dev shows the full value only once at creation. After that the value is hashed at rest and the dashboard displays only an obfuscated suffix.
Scope each key to exactly what it needs
Pick an access preset when you create a key. Each preset grants a specific slice of the API:
- Trigger only: trigger runs and batches for all or selected tasks.
- Task operator: trigger tasks and inspect or operate on their runs.
- Observer: read runs, tasks, batches, logs, traces, and queues.
- Operator: observe and operate on runs and queues, and trigger tasks.
- Deploy only: deploy versions, sync environment variables, and manage Preview branches.
- Variables only: read and write environment variables in this environment.
- No restrictions: full access to the environment.
Trigger only and Task operator can be narrowed to a specific set of tasks, up to 10 identifiers per key, so a key can trigger the two tasks a service owns and nothing else.
Expire and revoke without touching the rest
Give a key an expiration date when you create it and it stops working automatically once that date passes. Revoke a key at any time and it stops authenticating immediately. Because keys are independent, retiring one leaves every other key in the environment untouched, with no environment-wide rotation required.
Restricted keys work where you need them too. trigger deploy can authenticate with a TRIGGER_SECRET_KEY set to a Deploy only key, and the SDK's public-token APIs ask the server to mint narrowly scoped tokens, so a key never needs the environment signing secret.
Try it
Open the API keys page in any project environment to create your first scoped key, or read the API keys guide for every preset and restriction.