bug: Realtime returns 401 when using React hook useRealtimeTaskTrigger on preview

[listen3000]

Provide environment information

trigger.dev version 4.1.0.
Only preview branches.

Describe the bug

The realtime endpoint returns 401 and it looks like the JWT is signed with a wrong secret in preview environments. Works fine locally and in production. I have attached the two requests with JWTs (it's stripped HAR).

Reproduction repo

NA

To reproduce

1. Open DevTools.
2. Trigger a task with React's useRealtimeTaskTrigger on a preview branch.

useRealtimeTaskTrigger(taskId, {
  accessToken: token, // The token from auth.createTriggerPublicToken(taskId)
});

2. Find the HTTP request in DevTools that is errored with 401.

Additional information

{
  "log": {
    "version": "1.2",
    "creator": {
      "name": "WebInspector",
      "version": "537.36"
    },
    "pages": [],
    "entries": [
      {
        "_connectionId": "2329",
        "_initiator": {},
        "_priority": "High",
        "_resourceType": "fetch",
        "cache": {},
        "connection": "443",
        "request": {
          "method": "POST",
          "url": "https://api.trigger.dev/api/v1/tasks/generate-proposal/trigger",
          "httpVersion": "http/2.0",
          "headers": [
            {
              "name": ":method",
              "value": "POST"
            },
            {
              "name": ":path",
              "value": "/api/v1/tasks/generate-proposal/trigger"
            },
            {
              "name": ":scheme",
              "value": "https"
            },
            {
              "name": "authorization",
              "value": "Bearer eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJjbWh5b3J6MmkwZzA5bjUzYnF0bDkydGF5IiwicHViIjp0cnVlLCJvdHUiOnRydWUsInNjb3BlcyI6WyJ0cmlnZ2VyOnRhc2tzOmdlbmVyYXRlLXByb3Bvc2FsIl0sImlzcyI6Imh0dHBzOi8vaWQudHJpZ2dlci5kZXYiLCJhdWQiOiJodHRwczovL2FwaS50cmlnZ2VyLmRldiIsImlhdCI6MTc2MzM2MjA5NiwiZXhwIjoxNzYzNDQ4NDk2fQ.TSUD4OuHduTi54Sw7LCvA_79BWFduD3-bdgltY3Al1Y"
            },
            {
              "name": "trigger-version",
              "value": "4.1.0"
            },
            {
              "name": "x-trigger-api-version",
              "value": "2025-07-16"
            },
            {
              "name": "x-trigger-branch",
              "value": "feat/repeatable-section-generation"
            },
            {
              "name": "x-trigger-client",
              "value": "browser"
            },
            {
              "name": "x-trigger-realtime-streams-version",
              "value": "v2"
            },
            {
              "name": "x-trigger-request-idempotency-key",
              "value": "d29834c1-bf82-4d2b-912d-31434ec1820a"
            }
          ],
          "queryString": [],
          "cookies": [],
          "headersSize": -1,
          "bodySize": 1421,
          "postData": {
            "mimeType": "application/json",
            "text": "{...payload...}"
          }
        },
        "response": {
          "status": 200,
          "statusText": "",
          "httpVersion": "http/2.0",
          "headers": [
            {
              "name": "date",
              "value": "Mon, 17 Nov 2025 06:48:20 GMT"
            },
            {
              "name": "x-trigger-jwt",
              "value": "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJjbWh5b3J6MmkwZzA5bjUzYnF0bDkydGF5IiwicHViIjp0cnVlLCJzY29wZXMiOlsicmVhZDpydW5zOnJ1bl9jbWkyczlrdWNsY3ZoMnhuN21vMmtyamNlIl0sImlzcyI6Imh0dHBzOi8vaWQudHJpZ2dlci5kZXYiLCJhdWQiOiJodHRwczovL2FwaS50cmlnZ2VyLmRldiIsImlhdCI6MTc2MzM2MjEwMCwiZXhwIjoxNzYzMzY1NzAwfQ.SjqR5Q_t5183OctFVGzOJBqPcUwwJO_0ENFMtgOhl5M"
            },
            {
              "name": "x-trigger-jwt-claims",
              "value": "{\"sub\":\"cmhyorz2i0g09n53bqtl92tay\",\"pub\":true}"
            }
          ],
          "cookies": [],
          "content": {
            "size": 55,
            "mimeType": "application/json"
          },
          "redirectURL": "",
          "headersSize": -1,
          "bodySize": -1,
          "_transferSize": 710,
          "_error": null,
          "_fetchedViaServiceWorker": false
        },
        "serverIPAddress": "3.230.122.133",
        "startedDateTime": "2025-11-17T06:48:20.222Z",
        "time": 557.810000000245,
        "timings": {
          "blocked": 379.2660000001731,
          "dns": -1,
          "ssl": -1,
          "connect": -1,
          "send": 0.329,
          "wait": 176.28999999958882,
          "receive": 1.9250000004831236,
          "_blocked_queueing": 378.9390000001731,
          "_workerStart": -1,
          "_workerReady": -1,
          "_workerFetchStart": -1,
          "_workerRespondWithSettled": -1
        }
      },
      {
        "_connectionId": "2329",
        "_initiator": {},
        "_priority": "High",
        "_resourceType": "fetch",
        "cache": {},
        "connection": "443",
        "request": {
          "method": "GET",
          "url": "https://api.trigger.dev/realtime/v1/runs/run_cmi2s9kuclcvh2xn7mo2krjce?log=full&offset=-1",
          "httpVersion": "http/2.0",
          "headers": [
            {
              "name": ":method",
              "value": "GET"
            },
            {
              "name": ":path",
              "value": "/realtime/v1/runs/run_cmi2s9kuclcvh2xn7mo2krjce?log=full&offset=-1"
            },
            {
              "name": ":scheme",
              "value": "https"
            },
            {
              "name": "authorization",
              "value": "Bearer eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJjbWh5b3J6MmkwZzA5bjUzYnF0bDkydGF5IiwicHViIjp0cnVlLCJzY29wZXMiOlsicmVhZDpydW5zOnJ1bl9jbWkyczlrdWNsY3ZoMnhuN21vMmtyamNlIl0sImlzcyI6Imh0dHBzOi8vaWQudHJpZ2dlci5kZXYiLCJhdWQiOiJodHRwczovL2FwaS50cmlnZ2VyLmRldiIsImlhdCI6MTc2MzM2MjEwMCwiZXhwIjoxNzYzMzY1NzAwfQ.SjqR5Q_t5183OctFVGzOJBqPcUwwJO_0ENFMtgOhl5M"
            },
            {
              "name": "trigger-version",
              "value": "4.1.0"
            },
            {
              "name": "x-trigger-api-version",
              "value": "2025-07-16"
            },
            {
              "name": "x-trigger-branch",
              "value": "feat/repeatable-section-generation"
            },
            {
              "name": "x-trigger-electric-version",
              "value": "1.0.0-beta.1"
            }
          ],
          "queryString": [
            {
              "name": "log",
              "value": "full"
            },
            {
              "name": "offset",
              "value": "-1"
            }
          ],
          "cookies": [],
          "headersSize": -1,
          "bodySize": 0
        },
        "response": {
          "status": 401,
          "statusText": "",
          "httpVersion": "http/2.0",
          "headers": [
            {
              "name": "date",
              "value": "Mon, 17 Nov 2025 06:48:20 GMT"
            }
          ],
          "cookies": [],
          "content": {
            "size": 127,
            "mimeType": "application/json"
          },
          "redirectURL": "",
          "headersSize": -1,
          "bodySize": -1,
          "_transferSize": 392,
          "_error": null,
          "_fetchedViaServiceWorker": false
        },
        "serverIPAddress": "3.230.122.133",
        "startedDateTime": "2025-11-17T06:48:20.789Z",
        "time": 250.6919999996171,
        "timings": {
          "blocked": 122.44799999977113,
          "dns": -1,
          "ssl": -1,
          "connect": -1,
          "send": 0.32499999999999996,
          "wait": 127.41100000067381,
          "receive": 0.5079999991721706,
          "_blocked_queueing": 120.94799999977113,
          "_workerStart": -1,
          "_workerReady": -1,
          "_workerFetchStart": -1,
          "_workerRespondWithSettled": -1
        }
      }
    ]
  }
}

[ericallam]

How did you generate the access token? Was the preview branch env var set when you did that?

[listen3000]

Hi @ericallam! Thanks for a quick reply.

I'm genereting the token using Deno 2.1.4 (Supabase Edge Function) like this:

import { auth, configure } from 'npm:@trigger.dev/sdk@4.1.0';

configure({
  secretKey: Deno.env.get('TRIGGER_SECRET_KEY'), // tr_preview_a...
  previewBranch: Deno.env.get('TRIGGER_BRANCH'), // feat/foo
});

const triggerToken = await auth.createTriggerPublicToken(taskId);

[ericallam]

Thank you for this report, I've reproduced the issue and working on a fix now!