Skip to main content
Every alert source has two credentials, generated at creation time.

​
The URL

The alertSourceId identifies the source. The URL by itself authenticates nothing — without the token, the request is rejected.

​
The token

Sent in the header:
The token is shown only once, when the source is created. aciona.me stores only a hash — it cannot be recovered later. If you lose it, rotate the credential.

​
Token scope

The token is valid for that source only. A leaked token compromises one alert origin, not the whole organization — which is why creating one source per tool and environment is worth it.

​
Where to store it

Treat it like any production credential:
  • A secret vault or secret manager (AWS Secrets Manager, SSM Parameter Store, Vault).
  • The tool’s own secure header field, when it offers one (New Relic and Datadog mask custom headers).
  • Never in a repository, a shared dashboard or a chat channel.

​
Rotating the token

Rotation generates a new token and invalidates the previous one immediately.
1

Rotate in the dashboard

Under Alert sources, open the source and rotate the token. Copy the new value right away.
2

Update the external tool

Replace the X-Aciona-Token header in the tool’s configuration.
3

Send a test alert

Confirm the response is 202 again.
Between the rotation and the tool update, alerts from that origin are rejected with 401. Do the swap in a window where you can validate immediately.

​
Activating and deactivating a source

An inactive source rejects alerts with 403, without losing the history already ingested. It is the correct way to silence a noisy origin temporarily — better than deleting the source, which breaks the external tool’s configuration.

​
Payload limits

The request body has a size limit (1 MB by default). Larger payloads are rejected with 413. If your tool sends very large payloads, trim the fields in its template.

Webhook response codes