Skip to content
Spawnbase Docs

Webhook secrecy

The webhook URLs you paste in Settings → Integrations (upload events, log alerts) are Discord webhook URLs. Discord treats the URL itself as the credential: anyone who has it can post into that channel as the webhook, and can delete the webhook.

  • Paste it only in the dashboard settings page. Spawnbase staff will never ask for it anywhere else.
  • Don’t put it in server.cfg, resource files, screenshots or repos — same rule as API tokens.
  • Keep the target channel’s permissions tight; a leaked URL plus a public channel is the worst combination.
  • Suspect a leak? In Discord: Server Settings → Integrations → delete the webhook (that kills the URL instantly), create a new one, paste the new URL into Spawnbase, and use Test send to confirm.
  • A failing or compromised webhook never affects uploads or logs — delivery is best-effort and separate from the data path.