You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Add OpenID Connect (OIDC) support so Trigger.dev runs can obtain short-lived, workload-scoped credentials from cloud providers and secret managers at runtime, instead of relying on long-lived static secrets stored as environment variables.
Trigger.dev acts as an OIDC identity provider: each run is issued a short-lived signed identity token whose claims describe the workload (org / project / environment / task). Customers configure their cloud provider once to trust Trigger.dev's issuer and scope a role to specific claims. At runtime the run exchanges its identity token for temporary provider credentials — no static keys to store, rotate, or leak.
This is the same workload-identity-federation pattern used by GitHub Actions, GitLab CI, CircleCI, Buildkite, Fly.io, and Render.
Why
Eliminate static secrets. Today, using AWS/GCP/etc. from a task requires storing long-lived access keys as env vars — the highest-value secret sprawl we have. OIDC removes them entirely.
Least privilege + auditability. Access is granted to a role scoped by claims (e.g. only production runs of a given project), not to shared keys. Credentials are minted per-run and expire quickly.
Generic — any service that trusts an OIDC issuer (expose the raw token + a discovery/JWKS endpoint).
Consolidation note
This is the single canonical OIDC feature ticket. It absorbs the earlier general request (TRI-7034 "OIDC support", Featurebase), which is closed as a duplicate of this. This ticket retains the original GitHub issue link (#1851).
Implementation design lives in the project doc: "OIDC Workload Identity — Implementation Design".
Add OpenID Connect (OIDC) support so Trigger.dev runs can obtain short-lived, workload-scoped credentials from cloud providers and secret managers at runtime, instead of relying on long-lived static secrets stored as environment variables.
Trigger.dev acts as an OIDC identity provider: each run is issued a short-lived signed identity token whose claims describe the workload (org / project / environment / task). Customers configure their cloud provider once to trust Trigger.dev's issuer and scope a role to specific claims. At runtime the run exchanges its identity token for temporary provider credentials — no static keys to store, rotate, or leak.
This is the same workload-identity-federation pattern used by GitHub Actions, GitLab CI, CircleCI, Buildkite, Fly.io, and Render.
Why
productionruns of a given project), not to shared keys. Credentials are minted per-run and expire quickly.Target integrations
AssumeRoleWithWebIdentity(STS). Primary / first target (this is what most requests ask for).Consolidation note
This is the single canonical OIDC feature ticket. It absorbs the earlier general request (TRI-7034 "OIDC support", Featurebase), which is closed as a duplicate of this. This ticket retains the original GitHub issue link (#1851).
Implementation design lives in the project doc: "OIDC Workload Identity — Implementation Design".