Trigger.dev vs withHuman

Trigger.dev

Tokens complete from a backend, a pre-signed callback URL or the browser with a token scoped to one waitpoint. 10-minute default timeout on tokens.

withHuman

The approval API is small and carefully specified, with a public OpenAPI 3.1 document, mandatory idempotency keys and agent credentials that can never approve. The service is in early access under its own terms, with no status page, published rate limits or changelog, and the open-source repository the site links to returned 404 on 8 October 2026.

Trigger.dev

1. Pass an explicit timeout to wait.createToken() and handle ok: false as a timeout
2. Use an idempotency key when creating the token so a retried step doesn't send the reviewer a second request
3. Give the browser the publicAccessToken, never the secret key, and don't call token.url from client code
4. Tag tokens with the user or task ID so pending approvals can be listed per reviewer
5. Start the MCP server with --readonly when the agent only needs to inspect runs

withHuman

1. Send an Idempotency-Key header on POST /api/aap/v1/requests. The call answers 400 without one
2. Read the decision with GET /api/aap/v1/requests/{id}?wait=30s and repeat while status is pending. wait is capped at 30 seconds
3. Set timeout between one second and seven days, and treat expired and cancelled as a refusal
4. Start an approved call within five minutes of decided_at, because the decision carries an expires_at
5. Cancel a request when you stop waiting, so reviewers stop seeing it