feat(webapp): share rate limit bucket across additional API keys per environment by carderne · Pull Request #4508 · triggerdotdev/trigger.dev

carderne · 2026-08-05T09:09:37Z

What

Rate-limit the API by environment rather than per API key.

Previously the limiter keyed its bucket on the hash of the full Authorization header — one bucket per key. With additional environment API keys (tr_*_sk_*), an environment can mint many keys and each got its own full bucket, so more keys = higher effective rate limit. This collapses all of an environment's keys onto a single shared per-environment bucket, so the ceiling is exactly the configured limit regardless of key mix.

How

authorizationRateLimitMiddleware now lets the override return { config?, identifier? }. identifier, when present, is the rate limit bucket key; otherwise it falls back to the hashed Authorization header (unchanged legacy behavior, still used by engineRateLimiter and any unauthenticated fallthrough).
apiRateLimiter's override resolves the environment id and uses it as the identifier:
- Additional keys (isAdditionalApiKey) resolve via a new resolveAdditionalApiKeyRateLimitScope() — a scope-agnostic keyHash → (environmentId, org limiter config) lookup. It is deliberately permissive (restricted keys resolve too) because it's used only for bucketing, never as an auth decision — request auth still goes through the RBAC bearer controller, which enforces scopes. Revoked/expired keys are excluded so they can't hold a bucket warm.
- Root/legacy keys reuse the environment already resolved by authenticateAuthorizationHeader and key on environment.id too.
The identifier is always the stable environment id, never the secret key (which can rotate and would split the bucket).
The whole override result is cached per key by the existing SWR cache, so no extra per-request lookup and no separate Redis mapping is added.

Behavior notes

Root + additional keys of the same environment now share one bucket (ceiling = configured limit, not a multiple of it). Restricted additional keys are included — they were the biggest gap, since they authenticate via the RBAC controller and previously fell back to per-key buckets.
Public JWTs keep their existing fixed-window, per-token bucketing.
One-time bucket reset on deploy (bucket keys change); harmless.

Tests

New: two tokens resolving to the same identifier share one bucket.
New: with no identifier, bucketing stays per-key (legacy behavior preserved).
Updated existing override tests to the new { config } return shape.

Base: feat/multi-keys-surface. Closes TRI-12888.

changeset-bot · 2026-08-05T09:09:42Z

🦋 Changeset detected

Latest commit: e9ae728

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 27 packages

Name	Type
@trigger.dev/sdk	Patch
@trigger.dev/python	Patch
@internal/dashboard-agent	Patch
@internal/sdk-compat-tests	Patch
@trigger.dev/build	Patch
@trigger.dev/core	Patch
@trigger.dev/react-hooks	Patch
@trigger.dev/redis-worker	Patch
@trigger.dev/rsc	Patch
@trigger.dev/schema-to-json	Patch
@trigger.dev/database	Patch
@trigger.dev/otlp-importer	Patch
@trigger.dev/rbac	Patch
@trigger.dev/sso	Patch
trigger.dev	Patch
@internal/cache	Patch
@internal/clickhouse	Patch
@internal/llm-model-catalog	Patch
@internal/metrics-pipeline	Patch
@internal/redis	Patch
@internal/replication	Patch
@internal/run-engine	Patch
@internal/run-store	Patch
@internal/schedule-engine	Patch
@internal/testcontainers	Patch
@internal/tracing	Patch
@internal/tsql	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

coderabbitai · 2026-08-05T09:09:45Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 8d8e390b-6b3b-4285-8ea5-da8f3d06070b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

A number passed to `expirationTime` is a Unix timestamp in seconds, not milliseconds as the JSDoc claimed. Following the old docs produced a token that effectively never expired. Also fail loudly when an additional API key reaches a local self-signing fallback. Those keys are not the environment's JWT signing material, so the token would never verify. Every endpoint that returns a public access token sets `x-trigger-jwt`, so this is unreachable today.

The API key policy methods are optional on the plugin-facing controller contract, so `Pick` over it yields optional members that these call sites would have to guard. Both already receive the LazyController singleton, which has substituted its fail-closed defaults, so point them at HostRbacController and keep the call sites guard-free.

Require both the global issuance switch and organization rollout flag before creating additional keys, while leaving existing credentials available for use and revocation. Show nullable creators and identify SDK v4.5.8 as the first compatible public-token version.

Record bounded outcomes for additional key creation, policy preparation, revocation, and public-token minting.

pkg-pr-new · 2026-08-05T17:11:24Z

Open in StackBlitz

@trigger.dev/build

npm i https://pkg.pr.new/@trigger.dev/build@316db63

trigger.dev

npm i https://pkg.pr.new/trigger.dev@316db63

@trigger.dev/core

npm i https://pkg.pr.new/@trigger.dev/core@316db63

@trigger.dev/python

npm i https://pkg.pr.new/@trigger.dev/python@316db63

@trigger.dev/react-hooks

npm i https://pkg.pr.new/@trigger.dev/react-hooks@316db63

@trigger.dev/redis-worker

npm i https://pkg.pr.new/@trigger.dev/redis-worker@316db63

@trigger.dev/rsc

npm i https://pkg.pr.new/@trigger.dev/rsc@316db63

@trigger.dev/schema-to-json

npm i https://pkg.pr.new/@trigger.dev/schema-to-json@316db63

@trigger.dev/sdk

npm i https://pkg.pr.new/@trigger.dev/sdk@316db63

commit: 316db63

…environment

…n read

Use environment identifiers when displaying remaining API capacity and ignore additional keys tied to deleted projects.

Co-authored-by: devin-ai-integration[bot] <158243242+devin-ai-integration[bot]@users.noreply.github.com>

devin-ai-integration

Devin Review found 2 new potential issues.

carderne marked this pull request as ready for review August 5, 2026 09:20

This comment was marked as resolved.

Sign in to view

carderne added 12 commits August 5, 2026 18:07

feat(webapp): add multiple environment API key management

e3483c1

test(webapp): use _sk_ additional API key infix

c5d83a4

fix(webapp): keep API key limit out of server-only module

0dd613e

feat(webapp): add API key lifecycle metrics

baca6f9

Record bounded outcomes for additional key creation, policy preparation, revocation, and public-token minting.

fixes for review comments

6548fb8

preseetId hardening

ddd5fdd

format

24cb43a

review fixes

cdbe1fa

improve new api key modal

b537812

carderne force-pushed the feature/tri-12888-add-redis-cache-for-additional-api-key-environment-lookup branch from ba817b9 to 316db63 Compare August 5, 2026 17:08

This comment was marked as resolved.

Sign in to view

carderne added 7 commits August 5, 2026 17:14

format

3952cbe

feat(webapp): share rate limit bucket across additional API keys per …

c345394

…environment

remove comments

e9f4728

fix(webapp): bucket restricted additional API keys by environment too

a2651e5

feat(webapp): bucket root API keys per environment too

0eae5e1

fix(webapp): version rate-limit cache key and validate cached shape o…

8c6e59b

…n read

use new resolver for api keys

191b9b7

carderne and others added 3 commits August 5, 2026 17:14

fix(webapp): keep environment rate-limit buckets consistent

a4971d2

Use environment identifiers when displaying remaining API capacity and ignore additional keys tied to deleted projects.

Update .server-changes/additional-api-key-rate-limit-bucket.md

e5f3de0

Co-authored-by: devin-ai-integration[bot] <158243242+devin-ai-integration[bot]@users.noreply.github.com>

fix(webapp): keep public API keys on separate rate-limit buckets

cd2a0c0

carderne force-pushed the feature/tri-12888-add-redis-cache-for-additional-api-key-environment-lookup branch from 316db63 to cd2a0c0 Compare August 5, 2026 17:14

devin-ai-integration Bot reviewed Aug 5, 2026

View reviewed changes

Comment thread ...app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.limits/route.tsx Outdated

Comment thread apps/webapp/app/models/runtimeEnvironment.server.ts

fix limits presenter for preview branches

e9ae728

carderne force-pushed the feature/tri-12888-add-redis-cache-for-additional-api-key-environment-lookup branch from eb0e8f7 to e9ae728 Compare August 6, 2026 09:42

Navigation Menu

Uh oh!

Uh oh!

feat(webapp): share rate limit bucket across additional API keys per environment - #4508

feat(webapp): share rate limit bucket across additional API keys per environment#4508
carderne wants to merge 23 commits into
feat/multi-keys-surfacefrom
feature/tri-12888-add-redis-cache-for-additional-api-key-environment-lookup

carderne commented Aug 5, 2026 •

edited

Loading

Uh oh!

changeset-bot Bot commented Aug 5, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Aug 5, 2026 •

edited

Loading

Review skipped

Uh oh!

This comment was marked as resolved.

Uh oh!

This comment was marked as resolved.

Uh oh!

This comment was marked as resolved.

Uh oh!

This comment was marked as resolved.

Uh oh!

pkg-pr-new Bot commented Aug 5, 2026

Uh oh!

This comment was marked as resolved.

Uh oh!

devin-ai-integration Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Uh oh!

Conversation

carderne commented Aug 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What

How

Behavior notes

Tests

Uh oh!

changeset-bot Bot commented Aug 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

coderabbitai Bot commented Aug 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

This comment was marked as resolved.

Uh oh!

This comment was marked as resolved.

Uh oh!

This comment was marked as resolved.

Uh oh!

This comment was marked as resolved.

Uh oh!

pkg-pr-new Bot commented Aug 5, 2026

Uh oh!

This comment was marked as resolved.

Uh oh!

devin-ai-integration Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

carderne commented Aug 5, 2026 •

edited

Loading

changeset-bot Bot commented Aug 5, 2026 •

edited

Loading

coderabbitai Bot commented Aug 5, 2026 •

edited

Loading