use TRIGGER_ACCESS_TOKEN

Author: carderne

.changeset/deploy-api-keys.md

@@ -2,4 +2,4 @@
 "trigger.dev": patch
 ---
 
-Allow `trigger deploy` to authenticate with an environment API key from `TRIGGER_SECRET_KEY`, including deploy-only keys and Preview deployments.
+Allow `trigger deploy` to authenticate with an environment API key from `TRIGGER_ACCESS_TOKEN`.

packages/cli-v3/src/commands/deploy.ts

@@ -270,7 +270,7 @@ async function _deployCommand(dir: string, options: DeployCommandOptions) {
   verifyDirectory(dir, projectPath);
 
   const authorization = await authenticateForDeploy({
-    secretKey: process.env.TRIGGER_SECRET_KEY,
+    accessToken: process.env.TRIGGER_ACCESS_TOKEN,
     apiUrl: process.env.TRIGGER_API_URL ?? options.apiUrl,
     profile: options.profile,
     silent: options.plain,

packages/cli-v3/src/deploy/auth.test.ts

@@ -8,11 +8,11 @@ import { authenticateForDeploy, userIdForDeploy } from "./auth.js";
 import { readAuthConfigProfile } from "../utilities/configFiles.js";
 
 describe("authenticateForDeploy", () => {
-  it("gives TRIGGER_SECRET_KEY precedence without logging in", async () => {
+  it("uses an API key from TRIGGER_ACCESS_TOKEN without logging in", async () => {
     let loginCalled = false;
 
     const result = await authenticateForDeploy({
-      secretKey: "tr_prod_sk_deploy",
+      accessToken: "tr_prod_sk_deploy",
       apiUrl: "https://example.trigger.dev",
       profile: "default",
       silent: true,
@@ -37,7 +37,7 @@ describe("authenticateForDeploy", () => {
 
   it("derives hosted dashboard links without user metadata", async () => {
     const result = await authenticateForDeploy({
-      secretKey: "tr_preview_sk_deploy",
+      accessToken: "tr_preview_sk_deploy",
       apiUrl: "https://api.example.trigger.dev",
       profile: "default",
       silent: true,
@@ -52,7 +52,7 @@ describe("authenticateForDeploy", () => {
 
   it("uses the normal cloud URLs when no API URL is set", async () => {
     const result = await authenticateForDeploy({
-      secretKey: "tr_prod_sk_deploy",
+      accessToken: "tr_prod_sk_deploy",
       profile: "default",
       silent: true,
       login: async () => ({ ok: false, error: "should not be called" }),
@@ -70,7 +70,7 @@ describe("authenticateForDeploy", () => {
     });
 
     const result = await authenticateForDeploy({
-      secretKey: "tr_prod_sk_deploy",
+      accessToken: "tr_prod_sk_deploy",
       profile: "selfhosted",
       silent: true,
       login: async () => ({ ok: false, error: "should not be called" }),
@@ -88,7 +88,7 @@ describe("authenticateForDeploy", () => {
     });
 
     const result = await authenticateForDeploy({
-      secretKey: "tr_prod_sk_deploy",
+      accessToken: "tr_prod_sk_deploy",
       apiUrl: "https://api.trigger.dev",
       profile: "selfhosted",
       silent: true,
@@ -100,9 +100,10 @@ describe("authenticateForDeploy", () => {
     });
   });
 
-  it("keeps login authentication when no secret key is set", async () => {
+  it("passes a PAT through to the login path", async () => {
     let loginOptions: unknown;
     const result = await authenticateForDeploy({
+      accessToken: "tr_pat_abc123",
       apiUrl: "https://example.trigger.dev",
       profile: "ci",
       silent: false,
@@ -121,52 +122,53 @@ describe("authenticateForDeploy", () => {
     expect(result).toEqual({ ok: false, error: "login result" });
   });
 
-  it("rejects a PAT in TRIGGER_SECRET_KEY with a helpful error", async () => {
-    const result = await authenticateForDeploy({
-      secretKey: "tr_pat_abc123",
-      profile: "default",
-      silent: true,
-      login: async () => ({ ok: false, error: "should not be called" }),
-    });
-
-    expect(result).toEqual({
-      ok: false,
-      error: expect.stringContaining("TRIGGER_ACCESS_TOKEN"),
-    });
-  });
-
-  it("rejects an OAT in TRIGGER_SECRET_KEY with a helpful error", async () => {
+  it("passes an OAT through to the login path", async () => {
+    let loginOptions: unknown;
     const result = await authenticateForDeploy({
-      secretKey: "tr_oat_abc123",
-      profile: "default",
-      silent: true,
-      login: async () => ({ ok: false, error: "should not be called" }),
+      accessToken: "tr_oat_abc123",
+      apiUrl: "https://example.trigger.dev",
+      profile: "ci",
+      silent: false,
+      login: async (options) => {
+        loginOptions = options;
+        return { ok: false, error: "login result" };
+      },
     });
 
-    expect(result).toEqual({
-      ok: false,
-      error: expect.stringContaining("TRIGGER_ACCESS_TOKEN"),
+    expect(loginOptions).toEqual({
+      embedded: true,
+      defaultApiUrl: "https://example.trigger.dev",
+      profile: "ci",
+      silent: false,
     });
+    expect(result).toEqual({ ok: false, error: "login result" });
   });
 
-  it("rejects a secret key that doesn't look like an API key", async () => {
+  it("keeps login authentication when no access token is set", async () => {
+    let loginOptions: unknown;
     const result = await authenticateForDeploy({
-      secretKey: "not-a-valid-key",
-      profile: "default",
-      silent: true,
-      login: async () => ({ ok: false, error: "should not be called" }),
+      apiUrl: "https://example.trigger.dev",
+      profile: "ci",
+      silent: false,
+      login: async (options) => {
+        loginOptions = options;
+        return { ok: false, error: "login result" };
+      },
     });
 
-    expect(result).toEqual({
-      ok: false,
-      error: expect.stringContaining("does not look like a Trigger.dev API key"),
+    expect(loginOptions).toEqual({
+      embedded: true,
+      defaultApiUrl: "https://example.trigger.dev",
+      profile: "ci",
+      silent: false,
     });
+    expect(result).toEqual({ ok: false, error: "login result" });
   });
 
   it("throws a descriptive error for an invalid API URL", async () => {
     await expect(
       authenticateForDeploy({
-        secretKey: "tr_prod_sk_deploy",
+        accessToken: "tr_prod_sk_deploy",
         apiUrl: "not-a-url",
         profile: "default",
         silent: true,

packages/cli-v3/src/deploy/auth.ts

@@ -27,13 +27,13 @@ type LoginForDeploy = (options: {
 }) => Promise<LoginResult>;
 
 export async function authenticateForDeploy({
-  secretKey,
+  accessToken,
   apiUrl,
   profile,
   silent,
   login,
 }: {
-  secretKey?: string;
+  accessToken?: string;
   apiUrl?: string;
   profile: string;
   silent: boolean;
@@ -42,7 +42,13 @@ export async function authenticateForDeploy({
   const authConfig = readAuthConfigProfile(profile);
   const resolvedApiUrl = apiUrl ?? authConfig?.apiUrl ?? CLOUD_API_URL;
 
-  if (!secretKey) {
+  const isApiKey =
+    !!accessToken &&
+    accessToken.startsWith(apiKeyPrefix) &&
+    !accessToken.startsWith(personalTokenPrefix) &&
+    !accessToken.startsWith(organizationTokenPrefix);
+
+  if (!isApiKey) {
     return login({
       embedded: true,
       defaultApiUrl: resolvedApiUrl,
@@ -51,30 +57,13 @@ export async function authenticateForDeploy({
     });
   }
 
-  if (secretKey.startsWith(personalTokenPrefix) || secretKey.startsWith(organizationTokenPrefix)) {
-    return {
-      ok: false,
-      error: `TRIGGER_SECRET_KEY is set to a ${
-        secretKey.startsWith(personalTokenPrefix) ? "Personal" : "Organization"
-      } Access Token. Use TRIGGER_ACCESS_TOKEN instead, or remove TRIGGER_SECRET_KEY and use \`trigger login\`.`,
-    };
-  }
-
-  if (!secretKey.startsWith(apiKeyPrefix)) {
-    return {
-      ok: false,
-      error:
-        "TRIGGER_SECRET_KEY does not look like a Trigger.dev API key. API keys start with \`tr_\` (e.g. \`tr_prod_...\`).",
-    };
-  }
-
   return {
     ok: true,
     profile,
     dashboardUrl: dashboardUrlForApiUrl(resolvedApiUrl),
     auth: {
       apiUrl: resolvedApiUrl,
-      accessToken: secretKey,
+      accessToken,
       tokenType: "apiKey",
     },
   };