feat(webapp): gate additional API key creation

Require both the global issuance switch and organization rollout flag before creating additional keys, while leaving existing credentials available for use and revocation. Show nullable creators and identify SDK v4.5.8 as the first compatible public-token version.

Author: carderne

apps/webapp/app/models/api-key.server.ts

@@ -9,6 +9,7 @@ import { customAlphabet } from "nanoid";
 import { MAX_API_KEY_TASK_IDENTIFIERS } from "~/consts";
 import { prisma } from "~/db.server";
 import { RuntimeEnvironmentType } from "~/database-types";
+import { canIssueAdditionalApiKeys } from "~/services/additionalApiKeyIssuance.server";
 import { rbac } from "~/services/rbac.server";
 import { generateAdditionalApiKey, generateRootApiKey } from "~/utils/apiKeys";
 import { controlPlaneResolver } from "~/v3/runOpsMigration/controlPlaneResolver.server";
@@ -129,9 +130,14 @@ export async function createEnvironmentApiKey(
   {
     prismaClient = prisma,
     rbacController = rbac,
+    issuanceAllowed,
   }: {
-    prismaClient?: Pick<PrismaClient, "runtimeEnvironment" | "taskIdentifier" | "apiKey">;
+    prismaClient?: Pick<
+      PrismaClient,
+      "apiKey" | "featureFlag" | "organization" | "runtimeEnvironment" | "taskIdentifier"
+    >;
     rbacController?: Pick<HostRbacController, "prepareApiKeyPolicy">;
+    issuanceAllowed?: (organizationId: string) => Promise<boolean>;
   } = {}
 ) {
   const environment = await prismaClient.runtimeEnvironment.findFirst({
@@ -146,6 +152,13 @@ export async function createEnvironmentApiKey(
     throw new Error("Environment not found");
   }
 
+  const canIssue =
+    issuanceAllowed ??
+    ((organizationId) => canIssueAdditionalApiKeys(organizationId, prismaClient));
+  if (!(await canIssue(environment.organizationId))) {
+    throw new Error("Creating additional API keys is not enabled.");
+  }
+
   if (expiresAt && expiresAt.getTime() <= Date.now()) {
     throw new Error("Expiration must be in the future");
   }

apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.apikeys/route.tsx

@@ -76,6 +76,7 @@ import { findProjectBySlug } from "~/models/project.server";
 import { findEnvironmentBySlug } from "~/models/runtimeEnvironment.server";
 import { ApiKeysPresenter } from "~/presenters/v3/ApiKeysPresenter.server";
 import { FULL_ACCESS_PRESET_ID } from "@trigger.dev/rbac";
+import { canIssueAdditionalApiKeys } from "~/services/additionalApiKeyIssuance.server";
 import { rbac } from "~/services/rbac.server";
 import { dashboardAction, dashboardLoader } from "~/services/routeBuilders/dashboardBuilder";
 import { cn } from "~/utils/cn";
@@ -180,16 +181,21 @@ export const loader = dashboardLoader(
       return organizationId ? { organizationId } : {};
     },
   },
-  async ({ params, searchParams, user, ability }) => {
+  async ({ params, searchParams, user, ability, context }) => {
     try {
       const presenter = new ApiKeysPresenter();
-      const data = await presenter.call({
-        userId: user.id,
-        organizationSlug: params.organizationSlug,
-        projectSlug: params.projectParam,
-        environmentSlug: params.envParam,
-        showRevoked: searchParams.showRevoked,
-      });
+      const [data, additionalApiKeyIssuanceEnabled] = await Promise.all([
+        presenter.call({
+          userId: user.id,
+          organizationSlug: params.organizationSlug,
+          projectSlug: params.projectParam,
+          environmentSlug: params.envParam,
+          showRevoked: searchParams.showRevoked,
+        }),
+        context.organizationId
+          ? canIssueAdditionalApiKeys(context.organizationId)
+          : Promise.resolve(false),
+      ]);
 
       const canReadApiKeys = ability.can("read", {
         type: "apiKeys",
@@ -214,6 +220,7 @@ export const loader = dashboardLoader(
         apiKeys: canReadApiKeys ? data.apiKeys : [],
         canReadApiKeys,
         canWriteApiKeys,
+        additionalApiKeyIssuanceEnabled,
         showRevoked: searchParams.showRevoked ?? false,
       });
     } catch (error) {
@@ -276,6 +283,15 @@ export const action = dashboardAction(
     try {
       switch (submission.data.action) {
         case "create": {
+          if (!(await canIssueAdditionalApiKeys(project.organizationId))) {
+            const message = "Creating additional API keys is not enabled.";
+            return typedJsonWithErrorMessage(
+              { ok: false as const, error: message },
+              request,
+              message
+            );
+          }
+
           const presets = await rbac.apiKeyPresets(project.organizationId);
           const preset = validateCreateApiKeyPreset({
             presets,
@@ -335,6 +351,7 @@ export default function Page() {
     apiKeys,
     canReadApiKeys,
     canWriteApiKeys,
+    additionalApiKeyIssuanceEnabled,
     showRevoked,
     hasVercelIntegration,
     availableTasks,
@@ -370,7 +387,7 @@ export default function Page() {
             API keys docs
           </LinkButton>
 
-          {canReadApiKeys ? (
+          {canReadApiKeys && additionalApiKeyIssuanceEnabled ? (
             <NewApiKeyDialog
               canWrite={canWriteApiKeys}
               availableTasks={availableTasks}
@@ -503,7 +520,7 @@ export default function Page() {
                       apiKey.createdBy?.displayName ??
                       apiKey.createdBy?.name ??
                       apiKey.createdBy?.email ??
-                      "Deleted user";
+                      "–";
 
                     return (
                       <TableRow key={apiKey.id} disabled={cannotAuthenticate}>
@@ -653,10 +670,10 @@ function NewApiKeyDialog({
               className="w-full"
             />
             <Callout variant="warning">
-              Requires a version of <InlineCode variant="extra-small">@trigger.dev/sdk</InlineCode>{" "}
-              that supports additional environment API keys. On older versions,{" "}
-              <InlineCode variant="extra-small">auth.createPublicToken()</InlineCode> will return a
-              token the server rejects, because only the root API key can sign one locally.
+              Use <InlineCode variant="extra-small">@trigger.dev/sdk</InlineCode> v4.5.8 or later.
+              Older SDK versions mint an unusable token when{" "}
+              <InlineCode variant="extra-small">auth.createPublicToken()</InlineCode> is called with
+              this API key.
             </Callout>
             <FormButtons
               confirmButton={

apps/webapp/app/services/additionalApiKeyIssuance.server.ts

@@ -0,0 +1,35 @@
+import { type PrismaClient } from "@trigger.dev/database";
+import { prisma } from "~/db.server";
+import { resolveAdditionalApiKeyIssuance } from "~/services/additionalApiKeyIssuance";
+import { FEATURE_FLAG } from "~/v3/featureFlags";
+
+type IssuancePrismaClient = Pick<PrismaClient, "featureFlag" | "organization">;
+
+export async function canIssueAdditionalApiKeys(
+  organizationId: string,
+  prismaClient: IssuancePrismaClient = prisma
+): Promise<boolean> {
+  const [organization, globalFlags] = await Promise.all([
+    prismaClient.organization.findUnique({
+      where: { id: organizationId },
+      select: { featureFlags: true },
+    }),
+    prismaClient.featureFlag.findMany({
+      where: {
+        key: {
+          in: [FEATURE_FLAG.additionalApiKeysEnabled, FEATURE_FLAG.additionalApiKeyIssuanceEnabled],
+        },
+      },
+      select: { key: true, value: true },
+    }),
+  ]);
+
+  if (!organization) {
+    return false;
+  }
+
+  return resolveAdditionalApiKeyIssuance(
+    Object.fromEntries(globalFlags.map((featureFlag) => [featureFlag.key, featureFlag.value])),
+    (organization.featureFlags as Record<string, unknown> | null) ?? undefined
+  );
+}

apps/webapp/app/services/additionalApiKeyIssuance.ts

@@ -0,0 +1,17 @@
+import { FEATURE_FLAG, type FeatureFlagCatalog } from "~/v3/featureFlags";
+
+export function resolveAdditionalApiKeyIssuance(
+  globalFlags: Partial<FeatureFlagCatalog> | Record<string, unknown> | undefined,
+  organizationFlags: Record<string, unknown> | undefined
+): boolean {
+  if (globalFlags?.[FEATURE_FLAG.additionalApiKeyIssuanceEnabled] !== true) {
+    return false;
+  }
+
+  const organizationOverride = organizationFlags?.[FEATURE_FLAG.additionalApiKeysEnabled];
+  if (organizationOverride === true || organizationOverride === false) {
+    return organizationOverride;
+  }
+
+  return globalFlags?.[FEATURE_FLAG.additionalApiKeysEnabled] === true;
+}

apps/webapp/app/v3/featureFlags.ts

@@ -22,6 +22,10 @@ export const FEATURE_FLAG = {
   // Grace-linger stamp carried alongside runOpsMintKind on flip. See mintFlipGrace.ts.
   runOpsMintKindPrev: "runOpsMintKindPrev",
   runOpsMintKindFlippedAt: "runOpsMintKindFlippedAt",
+  // Per-organization rollout for creating additional environment API keys.
+  additionalApiKeysEnabled: "additionalApiKeysEnabled",
+  // System-wide kill switch for issuing additional environment API keys.
+  additionalApiKeyIssuanceEnabled: "additionalApiKeyIssuanceEnabled",
   // System-wide kill switch for additional (scoped) environment API-key lookup.
   // Defaults off; enable during rollout once the new lookup path is trusted.
   additionalApiKeyLookupEnabled: "additionalApiKeyLookupEnabled",
@@ -64,9 +68,10 @@ export const FeatureFlagCatalog = {
   // by stampMintKindFlip on a genuine flip. Display-only (see ORG_LOCKED_FLAGS).
   [FEATURE_FLAG.runOpsMintKindPrev]: z.enum(["cuid", "runOpsId"]),
   [FEATURE_FLAG.runOpsMintKindFlippedAt]: z.string().datetime(),
-  // Strict z.boolean() (not z.coerce.boolean()): coercion turns the string
-  // "false" into true, which would silently enable this kill switch the wrong
-  // way if written as a string. Cold/absent resolves to the safe `false`.
+  // Strict booleans prevent a stringified "false" from silently enabling API-key
+  // creation or lookup. Cold/absent values resolve to the safe `false`.
+  [FEATURE_FLAG.additionalApiKeysEnabled]: z.boolean(),
+  [FEATURE_FLAG.additionalApiKeyIssuanceEnabled]: z.boolean(),
   [FEATURE_FLAG.additionalApiKeyLookupEnabled]: z.boolean(),
 };
 
@@ -86,7 +91,8 @@ export const ORG_LOCKED_FLAGS: FeatureFlagKey[] = [
   FEATURE_FLAG.taskEventRepository,
   FEATURE_FLAG.runOpsMintKindPrev,
   FEATURE_FLAG.runOpsMintKindFlippedAt,
-  // System-wide only — an org must not be able to override the rollout switch.
+  // System-wide only — orgs must not be able to override these kill switches.
+  FEATURE_FLAG.additionalApiKeyIssuanceEnabled,
   FEATURE_FLAG.additionalApiKeyLookupEnabled,
 ];
 

apps/webapp/test/additionalApiKeyIssuance.test.ts

@@ -0,0 +1,62 @@
+import { describe, expect, it } from "vitest";
+import { resolveAdditionalApiKeyIssuance } from "~/services/additionalApiKeyIssuance";
+import { FEATURE_FLAG, FeatureFlagCatalog, ORG_LOCKED_FLAGS } from "~/v3/featureFlags";
+
+describe("additional API key issuance controls", () => {
+  it("registers strict rollout and system-wide flags", () => {
+    expect(
+      FeatureFlagCatalog[FEATURE_FLAG.additionalApiKeysEnabled].safeParse("false").success
+    ).toBe(false);
+    expect(
+      FeatureFlagCatalog[FEATURE_FLAG.additionalApiKeyIssuanceEnabled].safeParse("false").success
+    ).toBe(false);
+    expect(ORG_LOCKED_FLAGS).not.toContain(FEATURE_FLAG.additionalApiKeysEnabled);
+    expect(ORG_LOCKED_FLAGS).toContain(FEATURE_FLAG.additionalApiKeyIssuanceEnabled);
+  });
+
+  it("defaults to disabled", () => {
+    expect(resolveAdditionalApiKeyIssuance(undefined, undefined)).toBe(false);
+  });
+
+  it("requires the system-wide issuance gate", () => {
+    expect(
+      resolveAdditionalApiKeyIssuance(
+        { [FEATURE_FLAG.additionalApiKeyIssuanceEnabled]: false },
+        { [FEATURE_FLAG.additionalApiKeysEnabled]: true }
+      )
+    ).toBe(false);
+  });
+
+  it("allows an organization override when issuance is enabled", () => {
+    expect(
+      resolveAdditionalApiKeyIssuance(
+        { [FEATURE_FLAG.additionalApiKeyIssuanceEnabled]: true },
+        { [FEATURE_FLAG.additionalApiKeysEnabled]: true }
+      )
+    ).toBe(true);
+  });
+
+  it("uses the global rollout value when the organization has no override", () => {
+    expect(
+      resolveAdditionalApiKeyIssuance(
+        {
+          [FEATURE_FLAG.additionalApiKeysEnabled]: true,
+          [FEATURE_FLAG.additionalApiKeyIssuanceEnabled]: true,
+        },
+        undefined
+      )
+    ).toBe(true);
+  });
+
+  it("allows an organization to opt out of a global rollout", () => {
+    expect(
+      resolveAdditionalApiKeyIssuance(
+        {
+          [FEATURE_FLAG.additionalApiKeysEnabled]: true,
+          [FEATURE_FLAG.additionalApiKeyIssuanceEnabled]: true,
+        },
+        { [FEATURE_FLAG.additionalApiKeysEnabled]: false }
+      )
+    ).toBe(false);
+  });
+});

apps/webapp/test/createEnvironmentApiKey.test.ts

@@ -4,6 +4,7 @@ import rbacPlugin, { type RoleBaseAccessController } from "@trigger.dev/rbac";
 import { expect, vi } from "vitest";
 import { MAX_API_KEY_TASK_IDENTIFIERS } from "~/consts";
 import { createEnvironmentApiKey } from "~/models/api-key.server";
+import { FEATURE_FLAG } from "~/v3/featureFlags";
 import {
   createRuntimeEnvironment,
   createTestOrgProjectWithMember,
@@ -20,15 +21,59 @@ function policyController(
 
 async function setup(prisma: PrismaClient) {
   const { organization, project, user } = await createTestOrgProjectWithMember(prisma);
-  const environment = await createRuntimeEnvironment(prisma, {
-    projectId: project.id,
-    organizationId: organization.id,
-    type: "PRODUCTION",
-    slug: uniqueId("prod"),
-  });
+  const [environment] = await Promise.all([
+    createRuntimeEnvironment(prisma, {
+      projectId: project.id,
+      organizationId: organization.id,
+      type: "PRODUCTION",
+      slug: uniqueId("prod"),
+    }),
+    prisma.organization.update({
+      where: { id: organization.id },
+      data: { featureFlags: { [FEATURE_FLAG.additionalApiKeysEnabled]: true } },
+    }),
+    prisma.featureFlag.upsert({
+      where: { key: FEATURE_FLAG.additionalApiKeyIssuanceEnabled },
+      create: { key: FEATURE_FLAG.additionalApiKeyIssuanceEnabled, value: true },
+      update: { value: true },
+    }),
+  ]);
   return { organization, project, user, environment };
 }
 
+containerTest(
+  "rejects creation when the system-wide issuance gate is disabled",
+  async ({ prisma }) => {
+    const { user, environment } = await setup(prisma);
+    await prisma.featureFlag.update({
+      where: { key: FEATURE_FLAG.additionalApiKeyIssuanceEnabled },
+      data: { value: false },
+    });
+    const controller = policyController(async () => ({
+      ok: true,
+      policy: { presetId: null, scopes: ["admin"] },
+    }));
+
+    await expect(
+      createEnvironmentApiKey(
+        {
+          environmentId: environment.id,
+          taskEnvironmentId: environment.id,
+          userId: user.id,
+          name: "Disabled",
+          presetId: "FULL_ACCESS",
+        },
+        { prismaClient: prisma, rbacController: controller }
+      )
+    ).rejects.toThrow("Creating additional API keys is not enabled");
+
+    expect(controller.prepareApiKeyPolicy).not.toHaveBeenCalled();
+    await expect(
+      prisma.apiKey.count({ where: { runtimeEnvironmentId: environment.id } })
+    ).resolves.toBe(0);
+  }
+);
+
 containerTest("standalone fallback creates one explicit full-access key", async ({ prisma }) => {
   const { user, environment } = await setup(prisma);
   const fallback = rbacPlugin.create({ primary: prisma, replica: prisma }, { forceFallback: true });