@trigger.dev/sdk and the Trigger.dev CLI (trigger.dev) 4.8.4 or later, then follow the OIDC prerequisites.
Configure Infisical
- In Infisical, create a Machine Identity and enable OIDC Auth.
-
Go to the OIDC page for your Trigger.dev environment and configure the identity with:
Leave CA Certificate blank. Set Access Token TTL and Access Token Max TTL to 900 seconds (15 minutes) rather than relying on the defaults.
- Add the identity to your Infisical project with read access only to the environments and secrets your task needs.
Read a secret in your task
siteUrl defaults to https://us.infisical.com. Set it to https://eu.infisical.com for EU, or your self-hosted instance’s URL. The audience defaults to siteUrl without a trailing slash; pass audience if your identity expects a different value. Optional organizationSlug scopes the session to an Infisical organization the identity can access.
The helper returns { accessToken, tokenType, expiresAt } and does not cache tokens. Authenticate inside run, and call it again before expiresAt if your task needs access for longer than the configured token lifetime.
