Skip to main content
Use Anthropic’s workload identity federation to exchange a Trigger.dev OIDC token for a short-lived Claude API token. Your tasks and chat agents call Claude with no ANTHROPIC_API_KEY stored anywhere. You configure Anthropic to trust your Trigger.dev environment, store three IDs as environment variables, and give the AI SDK’s Anthropic provider a token function. Follow the OIDC prerequisites. You also need the admin or owner role in your Anthropic organization.

Configure Anthropic

Go to the OIDC page for your Trigger.dev environment and copy the issuer URL and subject. Then open Workload identity in the Claude Console, select Connect workload, and choose Custom OIDC.
1

Issuer

Confirm that the discovery document and JWKS are reachable from the public internet, then continue. The Console fetches your signing keys at this step.
2

Federation rule

Name the rule, then paste the complete subject copied from the dashboard into Subject (sub) claim. Leave Additional claim condition blank.Under Enable in workspaces, select a single workspace. Tokens minted by the rule are billed to it and follow its rate limits.The default scope, workspace:developer, matches a workspace API key. If your tasks only call the Messages API, open Advanced rule options and set it to workspace:inference.
3

Target

Choose Create a new one and name the service account, for example trigger-production. It joins the rule’s workspace automatically.
4

Test

The Console shows a token exchange snippet. Copy the federation_rule_id (fdrl_...), organization_id, and service_account_id (svac_...) from it. The Console listens for a first exchange for 15 minutes; if that window passes, run the test again from the rule’s page.
Anthropic requires the audience https://api.anthropic.com, so request that audience when minting tokens for this rule.

Store the IDs

Add the three IDs as environment variables on the Trigger.dev environment. None of them is a secret.
.env
The provider below always authenticates with the federated token, even if ANTHROPIC_API_KEY is set. Once federation works, delete the old API key in the Claude Console and remove it from the environment.

Install the packages

Create the Claude provider

oidcFederationProvider from the Anthropic SDK performs the exchange, and TokenCache reuses the resulting token until shortly before it expires. The AI SDK’s Anthropic provider calls authToken before each request.
/trigger/claude.ts
If your rule is enabled in more than one workspace, also pass workspaceId (wrkspc_...) to oidcFederationProvider.

Use it in a chat agent

Create the provider inside run, so a cached Anthropic token never outlives the run.
/trigger/chat.ts
Don’t create the provider at module scope or store it in chat.local. A module-scope cache can serve one run’s token to the next run in the same process, and chat.local values are copied into subtask metadata.
Each turn performs one exchange, and every model call in the turn, including tool-call steps, reuses that token.

Use it in a task

The same provider works with any AI SDK function:
/trigger/summarize.ts

How tokens are refreshed

  • The exchange. oidcFederationProvider posts the Trigger.dev token to https://api.anthropic.com/v1/oauth/token using the RFC 7523 jwt-bearer grant. Anthropic verifies it against your issuer’s JWKS and the rule, then returns an access token prefixed sk-ant-oat01-.
  • Lifetime. The Anthropic token lasts the shorter of the rule’s token lifetime and twice the remaining lifetime of the Trigger.dev token, so expect about 10 minutes.
  • Refresh. TokenCache returns the cached token until two minutes before expiry, then exchanges again in the background. Each exchange calls identityTokenProvider, which requests a new Trigger.dev token.

Verify the connection

Redeploy, then run summarize or send a message to support-chat. A successful exchange appears in the authentication history in the Claude Console, attributed to the service account. For local Development runs, which cannot mint OIDC tokens, use your own API key: when ctx.environment.type === "DEVELOPMENT", return createAnthropic() instead, which reads ANTHROPIC_API_KEY.

Troubleshooting

Authentication failed

Anthropic returns the same Authentication failed error for every rejected exchange. Open the authentication history to see the reason, then fix the mismatch:
  • Issuer mismatch: the rule’s issuer URL must equal the token’s iss exactly, including the absence of a trailing slash.
  • Subject mismatch: paste the complete subject from the dashboard. Preview branches use the individual branch’s subject.
  • jti_reused: a token was exchanged twice. Keep identityTokenProvider requesting a new token on every call instead of caching one.
  • workspace_id_required: the rule is enabled in more than one workspace. Pass workspaceId to oidcFederationProvider.

Credit balance is too low

The exchange succeeded and the API accepted the token; the workspace has no credits. Add credits under Plans & Billing in the Claude Console.