# Trigger downstream **URL:** \ **Category:** Drone Support\ **Created:** [September 19, 2017, 7:28am UTC](https://drone.discourse.group/t/trigger-downstream/10451 "2017-09-19T07:28:29Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![ozbillwang](https://yyz1.discourse-cdn.com/flex003/user_avatar/drone.discourse.group/ozbillwang/32/3947_2.png) [@ozbillwang](https://drone.discourse.group/u/ozbillwang)\ **Post date:** [September 19, 2017, 7:28am UTC](https://drone.discourse.group/t/trigger-downstream/10451/1 "2017-09-19T07:28:29Z")
Regarding topic of `Trigger downstream`, I got several options: [http://addons.drone.io/trigger/](http://addons.drone.io/trigger/) [http://plugins.drone.io/drone-plugins/drone-downstream/](http://plugins.drone.io/drone-plugins/drone-downstream/) which one I should use? Second queustion, why drone itself need drone token to trigger downstream? ---
**Author:** ![bradrydzewski](https://yyz1.discourse-cdn.com/flex003/user_avatar/drone.discourse.group/bradrydzewski/32/3513_2.png) [@bradrydzewski](https://drone.discourse.group/u/bradrydzewski)\ **Post date:** [September 19, 2017, 2:53pm UTC](https://drone.discourse.group/t/trigger-downstream/10451/2 "2017-09-19T14:53:45Z")
> [@On another topic](https://drone.discourse.group/t/718/1): > > Second queustion, why drone itself need drone token to trigger downstream? there are two reasons. 1. without a token, someone could send a malicious pull request that changes the .drone.yml and triggers builds, deployments, etc. This would be a security issue. 2. drone does not know what an individual plugin _is_ or _does_. It treats all plugins equally, and only concerns itself with starting the container and collecting the logs and exit code. ---
**Author:** ![ozbillwang](https://yyz1.discourse-cdn.com/flex003/user_avatar/drone.discourse.group/ozbillwang/32/3947_2.png) [@ozbillwang](https://drone.discourse.group/u/ozbillwang)\ **Post date:** [September 19, 2017, 8:45pm UTC](https://drone.discourse.group/t/trigger-downstream/10451/3 "2017-09-19T20:45:17Z")
Thanks, @bradrydzewski . Seems this is only in drone related with its own design. Could drone team think to include trigger downstream job as its core services, which shouldn’t ask for any tokon. And can you confirm my first question? A new question. How to transfer the new generated environment variables to downstream job? export a source file doesn’t work in this scenario, because new job will has its own workspace, and maybe run on different agent. ---
**Author:** ![bradrydzewski](https://yyz1.discourse-cdn.com/flex003/user_avatar/drone.discourse.group/bradrydzewski/32/3513_2.png) [@bradrydzewski](https://drone.discourse.group/u/bradrydzewski)\ **Post date:** [September 19, 2017, 8:57pm UTC](https://drone.discourse.group/t/trigger-downstream/10451/4 "2017-09-19T20:57:26Z")
> [@On another topic](https://drone.discourse.group/t/718/1): > > Regarding topic of Trigger downstream, I got several options: Please use [http://plugins.drone.io/drone-plugins/drone-downstream/](http://plugins.drone.io/drone-plugins/drone-downstream/) > [@On another topic](https://drone.discourse.group/t/718/3): > > Could drone team think to include trigger downstream job as its core services, which shouldn’t ask for any tokon. There are no plans to include this as a core feature in the 1.0 release at this time. The reason is that, for me, it is not clear how we decide when a repository has permission to trigger a downstream build for another repository. Any solution we implement in drone core would need to be rock solid with strong security guarantees, and at this time I do not have a solution for this problem. > [@On another topic](https://drone.discourse.group/t/718/3): > > A new question. How to transfer the new generate environment variables to downstream job? The drone API supports passing build arguments to downstream builds, which are exposed to the pipeline as environment variables. ```plaintext BuildStart(string, string, int, map[string]string) (*Build, error) ``` I do not think the downstream plugin provides the ability to set the parameters. So you would have to work with the plugin maintainers to add that capability. Alternatively, you can simply curl the drone endpoint in your pipeline script: ```plaintext curl -X POST -H "Authorization: Bearer {token}" https://drone.company.com/api/repos/{owner}/{repo}/builds/{build}?ENV_VAR_1={value}&ENV_VAR_2={value}&... ``` ---
**Author:** ![ozbillwang](https://yyz1.discourse-cdn.com/flex003/user_avatar/drone.discourse.group/ozbillwang/32/3947_2.png) [@ozbillwang](https://drone.discourse.group/u/ozbillwang)\ **Post date:** [September 19, 2017, 11:02pm UTC](https://drone.discourse.group/t/trigger-downstream/10451/5 "2017-09-19T23:02:41Z")
> [@On another topic](https://drone.discourse.group/t/718/4): > > curl -X POST -H “Authorization: Bearer {token}” [https://drone.company.com/api/repos/{owner}/{repo}/builds/{build}?ENV\_VAR\_1={value}&ENV\_VAR\_2={value}&](https://drone.company.com/api/repos/%7Bowner%7D/%7Brepo%7D/builds/%7Bbuild%7D?ENV_VAR_1=%7Bvalue%7D&ENV_VAR_2=%7Bvalue%7D&)… Thanks, I think the way to deal with Drone API is more suitable than `plugins/downstream` in our case. I can simply write a script to transfer the new variables.