Skip to Content
WebhooksDestinations

Webhook Destinations

Spectrum can deliver a webhook to a signed HTTPS endpoint, a Slack channel, or a Telegram chat. Destination credentials are stored securely and are never returned by the API after creation.

HTTPS URL

Enter a public https:// URL that accepts POST requests. Internal, loopback, and non-routable destinations are rejected. Spectrum signs each request with the one-time signing key shown after creation; see Signing & Verification.

Slack

Slack delivery uses a bot installed in your workspace. You need a Bot User OAuth Token and the destination channel ID.

Create the Slack bot token

  1. Open Slack API apps, select Create New App, then From scratch.
  2. Name the app and choose the target workspace.
  3. Open OAuth & Permissions.
  4. Under Scopes → Bot Token Scopes, add chat:write.
  5. Select Install to Workspace and approve the installation.
  6. Copy the Bot User OAuth Token. It starts with xoxb-; xoxp- user tokens and xapp- app tokens are not supported.

Treat the token like a password. Anyone with it can post to channels the bot can access.

Add the bot to a channel

In the target Slack channel, run:

/invite @Your Bot Name

Open the channel details and copy its channel ID from the bottom of the About tab. Use the stable ID, such as C0123456789, rather than #channel-name. Private channel IDs may begin with G and still require the bot to be a member.

Enter the xoxb- token and channel ID in the webhook wizard, then send a test delivery. If the bot is not in the channel, Slack returns not_in_channel; invite it, then replay the failed delivery.

Telegram

Telegram delivery uses a bot created through BotFather. You need its token and the destination chat ID.

Create the Telegram bot token

  1. In Telegram, open @BotFather.
  2. Send /newbot.
  3. Choose a display name and a username ending in bot.
  4. Copy the token BotFather returns. It has the form <botId>:<secret>.

Treat the token like a password: anyone holding it controls the bot.

Add the bot and find the chat ID

  • Direct message: open the bot and press Start. A bot cannot initiate a conversation.
  • Group: add the bot as a member. Group and supergroup IDs are negative and commonly begin with -100.
  • Channel: add the bot as an administrator with permission to Post messages. Membership alone is insufficient.
  • Public channel: you may use its @channelname instead of a numeric ID.

For a private chat or group, send a message after adding the bot, then retrieve its updates:

curl -s "https://api.telegram.org/bot<BOT_TOKEN>/getUpdates" \
  | jq '.result[] | (.message.chat // .channel_post.chat) | select(. != null)'

Copy the matching chat object’s id, including its minus sign. Enter the token and chat ID in the wizard, then send a test delivery.

Failures and credential rotation

  • Provider rate limits are retried using Slack’s or Telegram’s retry hint.
  • Invalid or revoked tokens, inaccessible chats, missing channel membership, and missing posting permission cannot succeed until configuration is fixed; these deliveries are dead-lettered.
  • Replace a bot token from the webhook settings after rotating or reinstalling it.
  • Once access is fixed, replay the webhook’s dead-lettered deliveries.
  • HMAC signing keys apply only to HTTPS destinations; Slack and Telegram authenticate with their bot tokens.
Contract EventsDelivery & Retries