Trigger.dev v4.7.3 tightens permissions for starting and resuming sessions

Trigger.dev’s October 6 release of v4.7.3 introduces a breaking permissions change for session creation and resumption. Requests to POST /api/v1/sessions require both session-write and task-trigger permissions. For scoped API keys and public tokens, that means write:sessions—or access to the target session—plus permission to trigger its task. Trigger.dev advises developers using those credentials for chat sessions to check their task-trigger access.

The release also separates two useful kinds of labeling. The chat.createStartSessionAction, chat.headStart and chat.startHeadStart helpers accept a tags option that labels the session itself, making it filterable by tag on the Sessions page. By contrast, triggerConfig.tags continues to label the session’s runs, not the session.

For self-hosted operators, a new BLOCKED_EMAIL_DOMAINS environment variable blocks sign-in and sign-up from specified email domains. Trigger.dev also reports faster trace loading and Logs-page searches, with overly expensive searches prompting users to narrow the time range rather than returning a generic error.

The release notes list the server changes as live on Trigger.dev Cloud and included in the v4.7.3 Docker image. The upgrade instructions call for updating the trigger.dev/ packages to v4.7.3; self-hosted users are directed to ghcr.io/triggerdotdev/trigger.dev:v4.7.3.