Trigger.dev tokens

• Provider documentation ADDITIONAL_API_KEY_PATTERN in the published SDK core, the webapp customAlphabet([0-9a-zA-Z], 24) generator and the legacy 20-byte root generator at trigger.dev@4.0.0 (re-checked 2026-09-28) · observed 2026-09-28 · provider code (ruling R1): tr_ + one of dev|stg|prod|preview + _sk_ + exactly 24 [0-9A-Za-z] for an additional key, tr_<env>_ + 24 for a current root key and tr_<env>_ + 20 for a legacy root key; the docs corroborate the prefixes
• Reference 1
• Reference 2
• Reference 3
• Reference 4
• Reference 5
• Reference 6
• Reference 7
• Reference 8
• Reference 9
• Reference 10
• Reference 11
• Reference 12

Arrival evidence (#434, product redact-secret#904; #860 handoff trigger-dev.md, READY). T1 under ruling R1: the additional-key regex is in the published SDK core, the 24-byte alphanumeric root and the legacy 20-byte root come from the provider's generators, and the docs name the prefixes. Root and additional keys are one finding type. Legacy 20-byte roots stay in contract because the research found no statement that they stopped authenticating. Excluded: pk_<env>_ public keys (public by design, benign controls), tr_oat_ organization tokens (no generator found, T0), tr_uat_ and public-access JWTs (the jwt family keeps them, ruling R7), tr_proj_ refs and env slugs outside the four. Neither pinned peer has a Trigger.dev rule. Graduated to a registry detector at the 1127bf9 re-pin (redact-secret PR #938).