Custom OIDC integrations

​

Configure trust

1. Register your organization’s issuer, https://oidc.trigger.dev/YOUR_ORG_SLUG, using its discovery endpoint or signing keys as required.
2. Configure the expected audience. Use the service’s required value, or choose one if it allows you to.
3. Restrict access to the exact environment subject, directly or through the service’s identity-mapping rules.
4. Grant the identity only the permissions your task needs.

​

Request a token

import { auth, task } from "@trigger.dev/sdk";

export const federatedTask = task({
  id: "federated-task",
  run: async () => {
    const { token } = await auth.getOIDCToken({
      audience: "https://service.example.com",
    });

    // Use the service's documented token exchange or authentication flow here.
    // Never log or return the token.
  },
});