Discord
Send Safeguard notifications to a Discord channel. The bot permissions or webhook Safeguard needs, which tokens work, and step-by-step setup.
What it does
The Discord card sends Safeguard notifications (new findings, scan results and alerts) to a channel on your Discord server. Find the card under Integrations on the Notification tab.
Public vs private
This does not apply to Discord: you always connect a channel on a server you manage. A bot can post to any channel it can see; a webhook posts to the one channel it was created in.
Supported auth methods
| Method (dialog label) | Use it when | Notes |
|---|---|---|
| Bot Token (Full Access) | You want to pick the server and channel from a list | The token of a bot in a Discord application you own, added to your server |
| Webhook URL (Send Only) | You want the smallest possible grant | A channel webhook URL (https://discord.com/api/webhooks/...) |
Permissions required
Safeguard only posts messages and lists servers and channels. It never reads messages, members or roles.
Bot token
| Bot permission or call | Required? | What Safeguard uses it for |
|---|---|---|
bot scope when you add the bot to the server | Required | Adding the bot to your server so it can list it (/users/@me/guilds) and its channels |
| Send Messages | Required | Posting notifications to the channel |
| View Channels | Required | Seeing the notification channel |
| Embed Links | Optional | Showing notification embeds |
The token is checked with GET /users/@me, which needs no permission.
Webhook URL
| Permission | Required? | What Safeguard uses it for |
|---|---|---|
| The webhook URL itself | Required | Posting to that webhook's channel. Discord needs no other authentication for a webhook |
| Manage Webhooks (for the person creating it) | Required | Creating the webhook in Discord |
Least privilege: a webhook URL, or a bot with only View Channels and Send Messages on the notification channel.
Token types
| Token type | Works? | Notes |
|---|---|---|
| Bot token of your own Discord application | Yes | Sent as Authorization: Bot <token> |
| Channel webhook URL | Yes (recommended for least privilege) | Send only; no server or channel list |
| A user account token | No | The dialog takes a bot token |
| OAuth2 client secret | No | The dialog needs the bot token, not the client secret |
Expiry: bot tokens and webhook URLs do not expire. Reset the bot token or delete the webhook to revoke them.
What we never need: Administrator, Manage Server, Manage Channels, Manage Roles, Read Message History or any privileged gateway intent.
Step-by-step setup
Create the credential in Discord
Webhook:
- In Discord, open the channel's settings and go to Integrations > Webhooks.
- Create a webhook, give it a name, and copy its URL. Anyone with the URL can post to the channel.
Bot token:
- In the Discord Developer Portal, create an application and open its Bot settings. Copy the bot token (reset it if it is hidden).
- Build an authorization link with the
botscope and the permissions View Channels and Send Messages (plus Embed Links), and open it to add the bot to your server. - Make sure the bot can see the notification channel.
Or check it with curl
# Bot token
curl -s -H "Authorization: Bot $DISCORD_BOT_TOKEN" https://discord.com/api/v10/users/@me
# Webhook URL (returns the webhook without posting)
curl -s "<webhook-url>"Connect it in Safeguard
- Open Integrations and choose the Notification tab.
- Click Connect on the Discord card.
- Enter an Integration Name and, optionally, a description.
- Choose the Authentication Type:
- Bot Token (Full Access): paste the Bot Token. "Connected as bot:" appears; then choose the server and channel under Server & Channel.
- Webhook URL (Send Only): paste the Webhook URL.
- Click Next, then Connect.
Webhooks and triggers
This card only sends messages to Discord; it does not receive Discord events. Safeguard posts when the events you subscribed to happen (for example a scan finishing or a new critical finding).
What we read and store
- Read: with a bot token, the bot's identity, the servers it is in, and their channels.
- Stored: the connection's name, server and channel, and the bot token or webhook URL. Safeguard never shows them again in the dialog.
- Sent to Discord: notification text about your Safeguard projects and findings.
- No customer data from this integration is sent to third-party LLMs.
Troubleshooting
| Message you see | Cause | Fix |
|---|---|---|
Discord validation failed: ... or Unable to validate Discord credentials | Discord refused the bot token (reset, mistyped, or a client secret was pasted) | Copy the bot token from the application's Bot settings again |
Invalid Discord webhook URL format | The URL does not start with https://discord.com/api/webhooks/ | Copy the webhook URL from the channel's Integrations settings |
Invalid Discord webhook URL | Discord does not know this webhook (deleted, or the token part is wrong) | Create a new webhook and paste its URL |
Failed to fetch channels for selected server | The bot is not in the server, or cannot see its channels | Add the bot with the bot scope, and give it View Channels |
| Messages do not arrive | The bot lacks Send Messages in the channel | Grant Send Messages on the channel |
Rotation and disconnect
- Rotate: reset the bot token in the Developer Portal (or create a new webhook), open the Discord connection on the Notification tab, choose Update, paste the new value and choose Save Changes.
- Disconnect: choose Delete on the connection, then delete the webhook or remove the bot from your server.
Vendor references
- Discord message resource (Create Message), checked 2026-10-16.
- Discord webhook resource, checked 2026-10-16.
- Discord OAuth2 (bot authorization flow), checked 2026-10-16.
Microsoft Teams
Send Safeguard notifications to a Microsoft Teams channel. What each connection type needs, the current limits, and step-by-step setup.
Google Chat
Send Safeguard notifications to a Google Chat space, and optionally let a Chat app answer questions there. What the webhook needs and step-by-step setup.