feat(webapp): add multiple environment API key management

[carderne]

Summary

Projects can create, inspect, expire, and revoke multiple API keys for each environment. Plaintext values are shown only at creation; stored credentials are hashed and the API keys page displays only an obfuscated suffix afterward.

Self-hosted installations support full-access additional keys by default. Authorization extensions can provide additional access presets and optional task selection. Additional keys can also mint scoped public access tokens through the Trigger.dev API without receiving the environment signing key.

Feature notes

• Only admin+ can create API keys (Developer can make in Development branch).
• JWT self-signing will be a server call when used with new _ak_ keys.
• JWTs with long expiry can keep working even with api key deleted (gets priveleges from api key, signed with root key)

Deployment notes

Deploy the management UI and public-token endpoint with new key creation disabled. Enable creation for selected organizations after the authentication path and released SDK have been verified, then expand availability gradually.

Revoking an API key prevents new bearer requests and new token minting. Public tokens already minted by that key remain valid until their own expiration because they are signed by the environment signing key.

TODO

• Add "Created by" to the key table
• Document that streamed batch ingestion is non-atomic and may
  partially accept items before a validation or authorization error.

Follow-ups

• Add an organization-level feature flag for the API key management UI and creation action.
• Add a system-wide gate that can stop new key issuance without disabling authentication for existing keys.
• Replace the generic SDK compatibility warning with the first published compatible version. Old SDK will mint an unusable token if given an _ak_ key.
• Add public documentation covering creation, storage, expiration, revocation, SDK compatibility, and public-token lifetime behavior.
• Add observability for key creation, revocation, policy preparation failures, and public-token mint failures.
• Exercise create, copy-once display, authenticate, mint, expire, and revoke flows end to end before broad enablement.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: d413b317-9465-4d26-820c-8128c9d2440b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/multi-keys-surface

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[changeset-bot]

⚠️ No Changeset found

Latest commit: ca744a5

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[pkg-pr-new]

Open in StackBlitz

@trigger.dev/build

npm i https://pkg.pr.new/@trigger.dev/build@ba81e5e

trigger.dev

npm i https://pkg.pr.new/trigger.dev@ba81e5e

@trigger.dev/core

npm i https://pkg.pr.new/@trigger.dev/core@ba81e5e

@trigger.dev/python

npm i https://pkg.pr.new/@trigger.dev/python@ba81e5e

@trigger.dev/react-hooks

npm i https://pkg.pr.new/@trigger.dev/react-hooks@ba81e5e

@trigger.dev/redis-worker

npm i https://pkg.pr.new/@trigger.dev/redis-worker@ba81e5e

@trigger.dev/rsc

npm i https://pkg.pr.new/@trigger.dev/rsc@ba81e5e

@trigger.dev/schema-to-json

npm i https://pkg.pr.new/@trigger.dev/schema-to-json@ba81e5e

@trigger.dev/sdk

npm i https://pkg.pr.new/@trigger.dev/sdk@ba81e5e

commit: ba81e5e