Trigger.dev v4.8.4

1 new feature, 10 improvements, 1 bug fix, and 23 server changes.

Highlights

OIDC for tasks and trusted publishing for deployments

Use short-lived identity tokens in both directions: tasks authenticate to external services, and GitHub Actions authenticates to Trigger.dev to deploy.

Outbound: workload identity. Your tasks can access services such as AWS, Anthropic, and Infisical without storing long-lived credentials. Configure the service to trust your organization's OIDC issuer and grant access to specific project environments. See the OIDC docs.

For example, a task can assume an AWS IAM role to access S3 without a stored AWS access key. Enable sessionTags: true on awsCredentialProvider to attach verified run identity tags and restrict IAM permissions by task. This requires sts:TagSession in the role's trust policy; existing integrations remain untagged unless you opt in. See the AWS guide.

Inbound: trusted publishing. Deploy from GitHub Actions without storing a Trigger.dev API key or personal access token. Configure which repository and branches, tags, or GitHub Environments can publish, then use GitHub's OIDC identity to authorize the CLI. Builds run on Trigger.dev's build server without granting the CLI access to environment variables. Trusted publishing also supports Preview branch cleanup and deployment promotion. See the trusted publishing guide.

Improvements

• CLI and MCP server logins now expire after 7 days of inactivity. When an idle login expires, the CLI and MCP server start a new login flow instead of failing with an auth error. In CI, the CLI prompts you to log in again. Self-hosted instances can configure the window with CLI_LOGIN_IDLE_TIMEOUT_DAYS, or set it to 0 to disable for new logins. Logins created before this change are not affected.
• Add infisicalAccessToken from @trigger.dev/sdk/oidc/infisical to authenticate tasks with Infisical using OIDC instead of stored credentials. Supports US, EU, and self-hosted Infisical instances, with custom audiences and organization scoping.
• Deploy from GitHub Actions using Trusted Publishing and GitHub OIDC, without storing a Trigger.dev API key. Deployments run entirely on the build server and do not grant the CLI access to environment variables.
• preview archive and promote now support GitHub Actions Trusted Publishing without storing API keys. Preview deploys for closed or merged pull requests now archive their branch. preview archive also accepts Preview environment API keys via TRIGGER_ACCESS_TOKEN. Failed archive operations now exit with an error; concurrent cleanup jobs succeed when another job has already archived the same branch generation.
• Add a bundled Convex agent skill for integrating Trigger.dev with Convex, covering transactional triggering, Realtime progress, recovery, and scoped-token safety. Install it manually from the package; it is not included in the CLI skills installer.
• Self-hosted supervisors running tasks in microVMs can now delete finished run suspend snapshots from shared storage, instead of leaving them behind.
• Browser realtime subscriptions now resume reliably after the tab is hidden and shown again, via an upgrade to @electric-sql/client 1.3.0. Apps that already depend on 1.3.0 can share a single copy with the SDK.
• Run credentials now work for run results, rescheduling, schedules, and environment-variable operations inside tasks. Run credentials stay scoped to the current environment: shared schedules cannot be changed, and parent environment variables cannot be written.
• chat.agent now accepts only user messages and answers to tool calls from chat clients. Tool approvals and outputs are merged onto the stored call they answer and run with the input from the agent's own history, so a client cannot inject tool calls or change a call's input. chat.headStart drops tool calls from client-provided history; upsertIncomingMessage only adds user messages.
• Create public tokens without scopes from inside tasks using run credentials, without requiring an environment secret key.

Bug fixes

• Fix logs and spans with large numeric object keys failing to ingest, which dropped the rest of their batch.

Server changes

These changes are included in the v4.8.4 Docker image and are already live on Trigger.dev Cloud:

• API keys now support custom per-area access (Runs, Deployments, etc.), optionally scoped to specific tasks. Edit access on an existing key without rotating it; the API keys page marks keys whose access differs from their preset.
• API keys can expire on a custom date. Pick a day from a calendar; the key stops working at the end of that day in your local timezone.
• Restrict an API key to a list of IP addresses. Configure the list when creating or edit it later; the API keys page now shows the IP address each key was last used from.
• Organizations can save custom API key access as named presets and reuse them when creating keys across any project.
• Clicking an API key opens a detail panel showing its access, when it last used each area, and its metadata. From there you can narrow the key's access to only what it used in the last 30 days, without changing its secret.
• Choose an API key's expiry from presets or a calendar in a unified picker, with date previews and expiration at the end of the chosen day in UTC.
• The API keys page now shows when each key expires and when it was revoked. The "How to set env vars" dialog no longer shows the secret key. Custom access is now displayed as a table of permission levels per area, with disabled options shown with the reason.
• Dashboard-created personal access tokens now expire after the lifetime you choose (30, 90, or 365 days by default). Expired tokens return an error showing when it expired and where to create a new one.
• An email goes out 7 days before a personal access token expires, and again when it has, so a CI deploy using it doesn't break by surprise. Set PERSONAL_ACCESS_TOKEN_EXPIRY_EMAILS_ENABLED=false to disable.
• Alerts can be grouped: select multiple alerts and create a group that fires when any or all of them fire, with its own channels and expiry. Groups can be created via the API with their members in one call. Alert members keep evaluating independently but notify only through the group.
• Health alerts can now watch a subset of checks (flow, execution, liveness) instead of always watching all three.
• Alerts now require at least one notification channel (email, Slack, or webhook). The Dashboard Agent chat notification option has been removed.
• Admins and Developers can now delete alerts. Health metric charts now use straight line segments.
• The Environment variables page now filters by environment, opening on the environment you're currently in, with a picker for preview branches. Deleting a variable asks for confirmation.
• The side menu has a new Security section above Manage, grouping API keys, Environment variables, Trusted Publishing, and OIDC.
• Project JWT minting now rejects expiration times longer than 24 hours.
• Dashboard sessions past their deadline now end on their next request, including background data requests and form submissions, not only on page navigation.
• Restore duration wait details and the Skip waitpoint action in the dashboard.
• Fix the Logs page redirecting to Tasks when Logs is visible in the sidebar.
• Fix a new project's first deploys failing with "Failed to get deployment image ref" when two deploys start at the same time.
• Triggering a task with a payload over the offload threshold from inside a running task works again.
• Stop runs waiting for capacity from being requeued and started a second time while their first attempt is still pending.
• Long GitHub organization and repository names on the Trusted Publishing page now truncate to one line, with the full name shown on hover.

How to upgrade

Update the trigger.dev/* packages to v4.8.4 using your package manager:

Self-hosted users: update your Docker image to ghcr.io/triggerdotdev/trigger.dev:v4.8.4.