feat(webapp): add multiple environment API key management

[carderne]

Summary

Projects can create, inspect, expire, and revoke multiple API keys for each environment. Plaintext values are shown only at creation; stored credentials are hashed and the API keys page displays only an obfuscated suffix afterward.

Self-hosted installations support full-access additional keys by default. Authorization extensions can provide additional access presets and optional task selection. Additional keys can also mint scoped public access tokens through the Trigger.dev API without receiving the environment signing key.

Feature notes

• Only admin+ can create API keys (Developer can make in Development branch).
• JWT self-signing will be a server call when used with new _ak_ keys.
• JWTs with long expiry can keep working even with api key deleted (gets priveleges from api key, signed with root key)
• Unfiltered session listings intentionally preserve the existing broad task-read behavior. Filtered listings enforce task-level scopes for every requested task.
• Buffered runs without a task identifier are not safely authorizable, so cancel/replay requests fail closed rather than resolving an unscoped run.
• Batch and waitpoint endpoints intentionally return server-minted, narrowly scoped public tokens to all callers. These tokens have bounded lifetimes and may remain valid until expiry after API-key revocation.

Deployment notes

Deploy the management UI and public-token endpoint with new key creation disabled. Enable creation for selected organizations after the authentication path and released SDK have been verified, then expand availability gradually.

Revoking an API key prevents new bearer requests and new token minting. Public tokens already minted by that key remain valid until their own expiration because they are signed by the environment signing key.

TODO

• Add "Created by" to the key table
• Document that streamed batch ingestion is non-atomic and may
  partially accept items before a validation or authorization error.

Follow-ups

• Add an organization-level feature flag for the API key management UI and creation action.
• Document rollout ordering: enable additional-key lookup before enabling issuance.
• Add a system-wide gate that can stop new key issuance without disabling authentication for existing keys.
• Replace the generic SDK compatibility warning with the first published compatible version. Old SDK will mint an unusable token if given an _ak_ key.
• Add public documentation covering creation, storage, expiration, revocation, SDK compatibility, and public-token lifetime behavior.
• Add observability for key creation, revocation, policy preparation failures, and public-token mint failures.
• Exercise create, copy-once display, authenticate, mint, expire, and revoke flows end to end before broad enablement.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

Walkthrough

This PR adds feature-flagged environment API key creation and revocation with RBAC-based presets, task scoping, expiration validation, persistence, telemetry, and audit crumbs. It updates API key listing and management UI with organization scoping, revoked-key filtering, status metadata, and creation or revocation dialogs. It adds public-token minting with scope and expiration validation and JWT signing. Authentication services now accept injectable dependencies. Tests and change notes cover the changes.

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description is detailed but omits the template's issue link, checklist, testing steps, changelog, and screenshots sections.	Add the required template sections, document the tests that were run, and include screenshots or mark them as not applicable.
Docstring Coverage	⚠️ Warning	Docstring coverage is 6.67% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the primary change: adding management for multiple environment API keys.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/multi-keys-surface

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[changeset-bot]

⚠️ No Changeset found

Latest commit: d4830db

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[pkg-pr-new]

Open in StackBlitz

@trigger.dev/build

npm i https://pkg.pr.new/@trigger.dev/build@87506ba

trigger.dev

npm i https://pkg.pr.new/trigger.dev@87506ba

@trigger.dev/core

npm i https://pkg.pr.new/@trigger.dev/core@87506ba

@trigger.dev/python

npm i https://pkg.pr.new/@trigger.dev/python@87506ba

@trigger.dev/react-hooks

npm i https://pkg.pr.new/@trigger.dev/react-hooks@87506ba

@trigger.dev/redis-worker

npm i https://pkg.pr.new/@trigger.dev/redis-worker@87506ba

@trigger.dev/rsc

npm i https://pkg.pr.new/@trigger.dev/rsc@87506ba

@trigger.dev/schema-to-json

npm i https://pkg.pr.new/@trigger.dev/schema-to-json@87506ba

@trigger.dev/sdk

npm i https://pkg.pr.new/@trigger.dev/sdk@87506ba

commit: 87506ba

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

[github-actions]

Observability map

As of d4830db.

18/100 over 412 measured of 428 entry points (base 18, no change)

What this PR changed

route	base	head	now failing
/_app/orgs/:organizationSlug/projects/:projectParam/env/:envParam/apikeys	67	50	error-classification
/api/v1/auth/public-tokens	new	not measured

FIX FIRST

• /api/v1/projects/:projectRef/envvars (sensitive) - auth-boundary, request-context
• /auth/sso (sensitive) - auth-boundary, request-context
• /_app/orgs/:organizationSlug/settings/team (sensitive) - error-classification, auth-scope, request-context

AUDIT 3 of 50 sensitive mutations record an actor. 47 without one.
CONTEXT 11 of 412 entry points name a tenant on a failure path. 325 appear only here, 39 of them sensitive, in the JSON rather than the fix list.

What the score is made of

CHECKS
  error-classification  167 applicable,  94 pass,   0 sole, global without it 10
  auth-boundary          62 applicable,  57 pass,   0 sole, global without it 15
  auth-scope             19 applicable,  17 pass,   0 sole, global without it 18
  request-context       412 applicable,  11 pass, 223 sole, global without it 64
  audit-trail            50 applicable,   3 pass,   0 sole, not in the score

The score and findings here are report-only and never gate the merge. Separately, a required test suite keeps this tool's symbol and route lists in sync with the code they name, and can fail a pull request that renames or removes a symbol they reference, or that adds the first route with a segment they anticipate. Each failure names the list to edit. The rules and their reasons: internal-packages/observability-map/README.md.

[trigger-dot-bot]

Preview Deployment

Status	Preview	Commit	Updated
🔴 Error	–	d4830db	Aug 6, 11:01 UTC

[devin-ai-integration]

Devin Review found 1 new potential issue.

View 1 additional finding in Devin Review.

[devin-ai-integration]

🔍 createEnvironmentApiKey only checks org membership, not dev-environment ownership

The environment lookup scopes to organization: { members: { some: { userId } } } only. For a DEVELOPMENT environment (which is per-org-member), any org member's id would satisfy this, so the function on its own would let one member mint a key on another member's dev environment. The single current caller is safe because the route resolves the environment through findEnvironmentBySlug, which restricts DEVELOPMENT to the caller's own orgMember, and then enforces write:apiKeys. Since this is now an exported model function, future callers won't get that protection — consider folding the dev-ownership condition into the lookup here.

---

Was this helpful? React with 👍 or 👎 to provide feedback.