Skip to main content
Infisical support was added in 4.8.4. Use @trigger.dev/sdk and the Trigger.dev CLI (trigger.dev) 4.8.4 or later, then follow the OIDC prerequisites.

Configure Infisical

  1. In Infisical, create a Machine Identity and enable OIDC Auth.
  2. Go to the OIDC page for your Trigger.dev environment and configure the identity with: Leave CA Certificate blank. Set Access Token TTL and Access Token Max TTL to 900 seconds (15 minutes) rather than relying on the defaults.
  3. Add the identity to your Infisical project with read access only to the environments and secrets your task needs.

Read a secret in your task

siteUrl defaults to https://us.infisical.com. Set it to https://eu.infisical.com for EU, or your self-hosted instance’s URL. The audience defaults to siteUrl without a trailing slash; pass audience if your identity expects a different value. Optional organizationSlug scopes the session to an Infisical organization the identity can access. The helper returns { accessToken, tokenType, expiresAt } and does not cache tokens. Authenticate inside run, and call it again before expiresAt if your task needs access for longer than the configured token lifetime.