View all changelogs

Workload identity (OIDC)

Your tasks can now prove who they are, so services like Anthropic don't need a stored API key.

Chris Arderne

Chris Arderne

Software Engineer, Trigger.dev

Image for Workload identity (OIDC)

Today we're launching OpenID Connect (OIDC) support on Trigger.dev Cloud.

OIDC allows your tasks to request a short-lived token to access AWS, Anthropic and other services, instead of you storing secrets. Each token expires after 5 minutes.

It's available now for all Trigger.dev Cloud users.

Workload identity for tasks

OIDC is an open standard for proving who you are with a signed token. A service like Anthropic checks the token's signature and decides what it's allowed to do, so it doesn't need a stored key.

This is safer than storing an API key because:

  • There's no long-lived key that can leak from your code, logs or environment variables.
  • A token that does leak stops working within 5 minutes.
  • To revoke access, you change the rule in the service you're connecting to, for example Anthropic. There's no key to rotate.

You can set it up in the dashboard under Security → OIDC. After that, a task asks for a token when it needs one:


const { token } = await auth.getOIDCToken({ audience: "https://api.anthropic.com" });

Tokens are signed with RS256 and expire after 5 minutes. The subject identifies the organization, project and environment, so Production, Staging and each Preview environment can get different permissions. For example, Production and Preview can use separate Anthropic workspaces, each with its own billing and rate limits.

Here's a task calling Anthropic without a long-lived API key:

trigger/summarize.ts

import { auth, task } from "@trigger.dev/sdk";
import { createAnthropic } from "@ai-sdk/anthropic";
import { oidcFederationProvider } from "@anthropic-ai/sdk/lib/credentials/oidc-federation";
import { generateText } from "ai";
export const summarize = task({
id: "summarize",
run: async (payload: { text: string }) => {
// Swap a Trigger.dev OIDC token for a short-lived Anthropic token.
const exchange = oidcFederationProvider({
identityTokenProvider: async () =>
(await auth.getOIDCToken({ audience: "https://api.anthropic.com" })).token,
// IDs from the Claude Console, not secrets.
federationRuleId: process.env.ANTHROPIC_FEDERATION_RULE_ID!,
organizationId: process.env.ANTHROPIC_ORGANIZATION_ID!,
serviceAccountId: process.env.ANTHROPIC_SERVICE_ACCOUNT_ID!,
baseURL: "https://api.anthropic.com",
fetch,
});
const { token } = await exchange();
const anthropic = createAnthropic({ authToken: token });
const { text } = await generateText({
model: anthropic("claude-sonnet-5-5"),
prompt: `Summarize in two sentences:\n\n${payload.text}`,
});
return { summary: text };
},
});

You'll need the SDK and CLI at v4.8.3 or later. Redeploy after upgrading, then start a new run on that deployment. Local trigger dev runs can't mint tokens, so keep using your own credentials there.

The Bun runtime, now even bunnier

Deploy your first agent today

Get set up in minutes, either on your own or with your coding agent.

Get started for free