feat(webapp): add multiple environment API key management

[carderne]

Summary

Projects can create, inspect, expire, and revoke multiple API keys for each environment. Plaintext values are shown only at creation; stored credentials are hashed and the API keys page displays only an obfuscated suffix afterward.

Self-hosted installations support full-access additional keys by default. Authorization extensions can provide additional access presets and optional task selection. Additional keys can also mint scoped public access tokens through the Trigger.dev API without receiving the environment signing key.

Feature notes

• Only admin+ can create API keys (Developer can make in Development branch).
• JWT self-signing will be a server call when used with new _ak_ keys.
• JWTs with long expiry can keep working even with api key deleted (gets priveleges from api key, signed with root key)
• Unfiltered session listings intentionally preserve the existing broad task-read behavior. Filtered listings enforce task-level scopes for every requested task.
• Buffered runs without a task identifier are not safely authorizable, so cancel/replay requests fail closed rather than resolving an unscoped run.
• Batch and waitpoint endpoints intentionally return server-minted, narrowly scoped public tokens to all callers. These tokens have bounded lifetimes and may remain valid until expiry after API-key revocation.

Deployment notes

Deploy the management UI and public-token endpoint with new key creation disabled. Enable creation for selected organizations after the authentication path and released SDK have been verified, then expand availability gradually.

Revoking an API key prevents new bearer requests and new token minting. Public tokens already minted by that key remain valid until their own expiration because they are signed by the environment signing key.

TODO

• Add "Created by" to the key table
• Document that streamed batch ingestion is non-atomic and may
  partially accept items before a validation or authorization error.

Follow-ups

• Add an organization-level feature flag for the API key management UI and creation action.
• Document rollout ordering: enable additional-key lookup before enabling issuance.
• Add a system-wide gate that can stop new key issuance without disabling authentication for existing keys.
• Replace the generic SDK compatibility warning with the first published compatible version. Old SDK will mint an unusable token if given an _ak_ key.
• Add public documentation covering creation, storage, expiration, revocation, SDK compatibility, and public-token lifetime behavior.
• Add observability for key creation, revocation, policy preparation failures, and public-token mint failures.
• Exercise create, copy-once display, authenticate, mint, expire, and revoke flows end to end before broad enablement.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: e643624e-bd8d-4021-a04f-5e17bd6c2666

📥 Commits

Reviewing files that changed from the base of the PR and between b537812 and 3952cbe.

📒 Files selected for processing (1)

• apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.apikeys/route.tsx

🚧 Files skipped from review as they are similar to previous changes (1)

• apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.apikeys/route.tsx

📜 Recent review details

⏰ Context from checks skipped due to timeout. (20)

• GitHub Check: webapp / 🧪 Unit Tests: Webapp (1, 12)
• GitHub Check: webapp / 🧪 Unit Tests: Webapp (12, 12)
• GitHub Check: webapp / 🧪 Unit Tests: Webapp (6, 12)
• GitHub Check: webapp / 🧪 Unit Tests: Webapp (5, 12)
• GitHub Check: webapp / 🧪 Unit Tests: Webapp (2, 12)
• GitHub Check: e2e-webapp / 🧪 E2E Tests: Webapp
• GitHub Check: webapp / 🧪 Unit Tests: Webapp (9, 12)
• GitHub Check: webapp / 🧪 Unit Tests: Webapp (7, 12)
• GitHub Check: webapp / 🧪 Unit Tests: Webapp (10, 12)
• GitHub Check: webapp / 🧪 Unit Tests: Webapp (8, 12)
• GitHub Check: webapp / 🧪 Unit Tests: Webapp (11, 12)
• GitHub Check: webapp / 🧪 Unit Tests: Webapp (3, 12)
• GitHub Check: webapp / 🧪 Unit Tests: Webapp (4, 12)
• GitHub Check: runops-guard / runops-guard
• GitHub Check: obsmap / 🧪 Unit Tests: Observability Map
• GitHub Check: typecheck / typecheck
• GitHub Check: code-quality / code-quality
• GitHub Check: report
• GitHub Check: 🛡️ E2E Auth Tests (full)
• GitHub Check: Analyze (javascript-typescript)

---

Walkthrough

This PR adds feature-flagged environment API key creation and revocation with RBAC-based presets, task scoping, expiration validation, persistence, telemetry, and audit crumbs. It updates API key listing and management UI with organization scoping, revoked-key filtering, status metadata, and creation or revocation dialogs. It adds public-token minting with scope and expiration validation and JWT signing. Authentication services now accept injectable dependencies. Tests and change notes cover the changes.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 6.67% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the primary change: multiple environment API key management.
Description check	✅ Passed	The description clearly covers scope, behavior, deployment, security, observability, and follow-ups, despite omitting several template sections.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/multi-keys-surface

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[changeset-bot]

🦋 Changeset detected

Latest commit: 3952cbe

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 27 packages

Name	Type
@trigger.dev/sdk	Patch
@trigger.dev/python	Patch
@internal/dashboard-agent	Patch
@internal/sdk-compat-tests	Patch
@trigger.dev/build	Patch
@trigger.dev/core	Patch
@trigger.dev/react-hooks	Patch
@trigger.dev/redis-worker	Patch
@trigger.dev/rsc	Patch
@trigger.dev/schema-to-json	Patch
@trigger.dev/database	Patch
@trigger.dev/otlp-importer	Patch
@trigger.dev/rbac	Patch
@trigger.dev/sso	Patch
trigger.dev	Patch
@internal/cache	Patch
@internal/clickhouse	Patch
@internal/llm-model-catalog	Patch
@internal/metrics-pipeline	Patch
@internal/redis	Patch
@internal/replication	Patch
@internal/run-engine	Patch
@internal/run-store	Patch
@internal/schedule-engine	Patch
@internal/testcontainers	Patch
@internal/tracing	Patch
@internal/tsql	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

Open in StackBlitz

@trigger.dev/build

npm i https://pkg.pr.new/@trigger.dev/build@b537812

trigger.dev

npm i https://pkg.pr.new/trigger.dev@b537812

@trigger.dev/core

npm i https://pkg.pr.new/@trigger.dev/core@b537812

@trigger.dev/python

npm i https://pkg.pr.new/@trigger.dev/python@b537812

@trigger.dev/react-hooks

npm i https://pkg.pr.new/@trigger.dev/react-hooks@b537812

@trigger.dev/redis-worker

npm i https://pkg.pr.new/@trigger.dev/redis-worker@b537812

@trigger.dev/rsc

npm i https://pkg.pr.new/@trigger.dev/rsc@b537812

@trigger.dev/schema-to-json

npm i https://pkg.pr.new/@trigger.dev/schema-to-json@b537812

@trigger.dev/sdk

npm i https://pkg.pr.new/@trigger.dev/sdk@b537812

commit: b537812

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

[github-actions]

Observability map

As of 3952cbe.

18/100 over 412 measured of 428 entry points (base 18, no change)

What this PR changed

route	base	head	now failing
/_app/orgs/:organizationSlug/projects/:projectParam/env/:envParam/apikeys	67	50	error-classification
/api/v1/auth/public-tokens	new	not measured

FIX FIRST

• /api/v1/projects/:projectRef/envvars (sensitive) - auth-boundary, request-context
• /auth/sso (sensitive) - auth-boundary, request-context
• /_app/orgs/:organizationSlug/settings/team (sensitive) - error-classification, auth-scope, request-context

AUDIT 3 of 50 sensitive mutations record an actor. 47 without one.
CONTEXT 11 of 412 entry points name a tenant on a failure path. 325 appear only here, 39 of them sensitive, in the JSON rather than the fix list.

What the score is made of

CHECKS
error-classification 167 applicable, 94 pass, 0 sole, global without it 10
auth-boundary 62 applicable, 57 pass, 0 sole, global without it 15
auth-scope 19 applicable, 17 pass, 0 sole, global without it 18
request-context 412 applicable, 11 pass, 223 sole, global without it 64
audit-trail 50 applicable, 3 pass, 0 sole, not in the score

Report only, nothing here gates the merge. The rules and their reasons: internal-packages/observability-map/README.md.

[devin-ai-integration]

Devin Review found 1 new potential issue.

[devin-ai-integration]

🟡 Key creation screen can claim a limited key grants unrestricted access

The permissions summary shown while creating a key falls back to the unrestricted description (PRESET_SCOPE_DETAILS.FULL_ACCESS at apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.apikeys/route.tsx:1011) whenever the chosen access level isn't in the hard-coded list, so a limited key is advertised as granting everything.
Impact: Someone creating a key can be told it has unrestricted access when it does not, leading to keys being created and trusted based on wrong information.

How an unlisted access preset ends up rendering the full-access summary

PRESET_SCOPE_DETAILS is a hard-coded map keyed by preset id (FULL_ACCESS, TRIGGER_ONLY, TASK_OPERATOR, ENVIRONMENT_OBSERVER, ENVIRONMENT_OPERATOR, DEPLOY_ONLY, ENV_VARS_ONLY), while the actual preset catalogue comes from the RBAC controller at runtime (rbac.apiKeyPresets, surfaced through the loader). When the controller returns a preset whose id is not in that map, ApiKeyScopePanel silently substitutes the FULL_ACCESS detail, which sets detail.admin = true; the panel then renders the amber admin box ("A single scope that grants everything below") and marks every capability row as "Full access", even though the header still shows the restricted preset's label.

This is reachable without a plugin adding new ids: defaultPresetId (route.tsx:584-587) picks the first available preset when FULL_ACCESS is unavailable, and that id may not appear in the radio groups rendered by PresetOptions, so the form can be submitted with a preset the user never explicitly picked while the panel described it as full access. Consider deriving the scope summary from data returned by the controller (e.g. describeApiKeyPolicy) instead of a client-side hard-coded map, or rendering an explicit "scopes unavailable" state for unknown preset ids rather than defaulting to full access.

Prompt for agents

In the API keys route (apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.apikeys/route.tsx), ApiKeyScopePanel resolves the capability summary from the hard-coded PRESET_SCOPE_DETAILS map and falls back to the FULL_ACCESS entry when the selected preset id is missing from that map. The preset catalogue is supplied at runtime by the RBAC controller (rbac.apiKeyPresets), so a preset id outside the hard-coded list — including the auto-selected defaultPresetId when FULL_ACCESS is unavailable — renders the 'admin' box and 'Full access' on every capability row for a key that is actually restricted. Fix by not defaulting unknown preset ids to the full-access detail: either drive the panel from data the controller can describe for the preset, or render a neutral 'scope details unavailable' state, and make sure the auto-selected default preset is always one that is actually rendered as a selectable option.

---

Was this helpful? React with 👍 or 👎 to provide feedback.