ANTHROPIC_API_KEY stored anywhere.
You configure Anthropic to trust your Trigger.dev environment, store three IDs as environment variables, and give the AI SDK’s Anthropic provider a token function.
Follow the OIDC prerequisites. You also need the admin or owner role in your Anthropic organization.
Configure Anthropic
Go to the OIDC page for your Trigger.dev environment and copy the issuer URL and subject. Then open Workload identity in the Claude Console, select Connect workload, and choose Custom OIDC.1
Issuer
Confirm that the discovery document and JWKS are reachable from the public internet, then continue. The Console fetches your signing keys at this step.
2
Federation rule
Name the rule, then paste the complete subject copied from the dashboard into Subject (sub) claim. Leave Additional claim condition blank.Under Enable in workspaces, select a single workspace. Tokens minted by the rule are billed to it and follow its rate limits.The default scope,
workspace:developer, matches a workspace API key. If your tasks only call the Messages API, open Advanced rule options and set it to workspace:inference.3
Target
Choose Create a new one and name the service account, for example
trigger-production. It joins the rule’s workspace automatically.4
Test
The Console shows a token exchange snippet. Copy the
federation_rule_id (fdrl_...), organization_id, and service_account_id (svac_...) from it. The Console listens for a first exchange for 15 minutes; if that window passes, run the test again from the rule’s page.https://api.anthropic.com, so request that audience when minting tokens for this rule.
Store the IDs
Add the three IDs as environment variables on the Trigger.dev environment. None of them is a secret..env
ANTHROPIC_API_KEY is set. Once federation works, delete the old API key in the Claude Console and remove it from the environment.
Install the packages
Create the Claude provider
oidcFederationProvider from the Anthropic SDK performs the exchange, and TokenCache reuses the resulting token until shortly before it expires. The AI SDK’s Anthropic provider calls authToken before each request.
/trigger/claude.ts
workspaceId (wrkspc_...) to oidcFederationProvider.
Use it in a chat agent
Create the provider insiderun, so a cached Anthropic token never outlives the run.
/trigger/chat.ts
Use it in a task
The same provider works with any AI SDK function:/trigger/summarize.ts
How tokens are refreshed
- The exchange.
oidcFederationProviderposts the Trigger.dev token tohttps://api.anthropic.com/v1/oauth/tokenusing the RFC 7523jwt-bearergrant. Anthropic verifies it against your issuer’s JWKS and the rule, then returns an access token prefixedsk-ant-oat01-. - Lifetime. The Anthropic token lasts the shorter of the rule’s token lifetime and twice the remaining lifetime of the Trigger.dev token, so expect about 10 minutes.
- Refresh.
TokenCachereturns the cached token until two minutes before expiry, then exchanges again in the background. Each exchange callsidentityTokenProvider, which requests a new Trigger.dev token.
Verify the connection
Redeploy, then runsummarize or send a message to support-chat. A successful exchange appears in the authentication history in the Claude Console, attributed to the service account.
For local Development runs, which cannot mint OIDC tokens, use your own API key: when ctx.environment.type === "DEVELOPMENT", return createAnthropic() instead, which reads ANTHROPIC_API_KEY.
Troubleshooting
Authentication failed
Anthropic returns the sameAuthentication failed error for every rejected exchange. Open the authentication history to see the reason, then fix the mismatch:
- Issuer mismatch: the rule’s issuer URL must equal the token’s
issexactly, including the absence of a trailing slash. - Subject mismatch: paste the complete subject from the dashboard. Preview branches use the individual branch’s subject.
jti_reused: a token was exchanged twice. KeepidentityTokenProviderrequesting a new token on every call instead of caching one.workspace_id_required: the rule is enabled in more than one workspace. PassworkspaceIdtooidcFederationProvider.

