Skip to main content
Every alert source has two credentials, generated at creation time.

​
The URL

The alertSourceId identifies the source. The URL by itself authenticates nothing — without the token, the request is rejected.

​
The token

Sent in the header:
The token is shown only once, when the source is created. aciona.me stores only a hash — it cannot be recovered later. If you lose it, rotate the credential.

​
Token scope

The token is valid for that source only. A leaked token compromises one alert origin, not the whole organization — which is why creating one source per tool and environment is worth it.

​
Where to store it

Treat it like any production credential:
  • A secret vault or secret manager (AWS Secrets Manager, SSM Parameter Store, Vault).
  • The tool’s own secure header field, when it offers one (New Relic and Datadog mask custom headers).
  • Never in a repository, a shared dashboard or a chat channel.

​
Rotating the token

Rotation generates a new token and invalidates the previous one immediately. The action is available to the owner and admin roles.
1

Rotate in the dashboard

Under Alert sources, in the table’s Actions column, click Rotate token on the source’s row.
2

Confirm by typing the source name

The confirmation button is enabled only when you type the exact source name. The match is case-sensitive and accent-sensitive.
3

Copy the new token right away

The token shows up right below the creation form, with a copy button. It is displayed only once.
4

Update the external tool

Replace the X-Aciona-Token header in the tool’s configuration.
5

Send a test alert

Confirm the response is 202 again.
Between the rotation and the tool update, alerts from that origin are rejected with 401. Do the swap in a window where you can validate immediately.
The Last rotation column shows when the token was last rotated and by whom. When the person who rotated it is no longer part of the organization, the column shows only the date and the author unavailable label.
There is an hourly rotation limit per source. If you hit it, the rotation is rejected and the current token stays valid — nothing changes until a new successful attempt.

​
Activating and deactivating a source

An inactive source rejects alerts with 403, without losing the history already ingested. It is the correct way to silence a noisy origin temporarily — better than deleting the source, which breaks the external tool’s configuration.

​
Payload limits

The request body has a size limit (1 MB by default). Larger payloads are rejected with 413. If your tool sends very large payloads, trim the fields in its template.

Webhook response codes