> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aciona.me/llms.txt
> Use this file to discover all available pages before exploring further.

# Webhook URL and token

> How the ingestion URL, the authentication token and credential rotation work.

Every alert source has two credentials, generated at creation time.

## The URL

```bash theme={null}
https://ingress.aciona.me/webhooks/<alertSourceId>
```

The `alertSourceId` identifies the source. The URL by itself authenticates nothing — without the token, the request is rejected.

## The token

Sent in the header:

```bash theme={null}
X-Aciona-Token: <sourceToken>
```

<Warning>
  **The token is shown only once**, when the source is created. aciona.me stores only a hash — it cannot be recovered later. If you lose it, rotate the credential.
</Warning>

### Token scope

The token is valid **for that source only**. A leaked token compromises one alert origin, not the whole organization — which is why creating one source per tool and environment is worth it.

### Where to store it

Treat it like any production credential:

* A secret vault or secret manager (AWS Secrets Manager, SSM Parameter Store, Vault).
* The tool's own secure header field, when it offers one (New Relic and Datadog mask custom headers).
* Never in a repository, a shared dashboard or a chat channel.

## Rotating the token

Rotation generates a new token and invalidates the previous one immediately.

<Steps>
  <Step title="Rotate in the dashboard">
    Under **Alert sources**, open the source and rotate the token. Copy the new value right away.
  </Step>

  <Step title="Update the external tool">
    Replace the `X-Aciona-Token` header in the tool's configuration.
  </Step>

  <Step title="Send a test alert">
    Confirm the response is `202` again.
  </Step>
</Steps>

<Warning>
  Between the rotation and the tool update, alerts from that origin are rejected with `401`. Do the swap in a window where you can validate immediately.
</Warning>

## Activating and deactivating a source

An **inactive** source rejects alerts with `403`, without losing the history already ingested. It is the correct way to silence a noisy origin temporarily — better than deleting the source, which breaks the external tool's configuration.

## Payload limits

The request body has a size limit (1 MB by default). Larger payloads are rejected with `413`. If your tool sends very large payloads, trim the fields in its template.

<Card title="Webhook response codes" icon="list" horizontal href="/en/reference/webhook-responses" />