Service webhooks (GitLab, Sentry, Linear, Stripe, PagerDuty)

GitLab, Sentry, Linear, Stripe and PagerDuty can post their own events into a channel as cards, through an incoming webhook's service URL, each checked with that service's signature.

Before you start

• You need an incoming webhook for the channel. Making one needs the Manage integrations permission (Owners, Admins, or a custom role that grants it).
• Incoming webhooks are on every plan (Free: up to 3 per org, Ministry and Creator: 25, Business: 100). One webhook can serve several services at once.
• You need admin rights in the other service to add a webhook there.

How it works

Every incoming webhook has one URL per service, made by adding the service's name to the end:

Each of these services makes its own signing secret, so the order is always the same:

1. In Missived, open Org Settings → Integrations → Incoming webhooks. Make a webhook (pick the service under "Made for" and the page shows that service's steps), or open an existing one and choose Connect a service.
2. In the service, add a webhook with the URL Missived shows.
3. Copy the secret the service gives you and paste it into Missived.

Missived keeps the secret encrypted and never shows it again, only its last four characters. You can replace it, or forget it, under Connect a service.

Every delivery's signature is checked against the exact bytes received before anything is read. Then:

• No secret pasted yet: refused with 409 (not_configured).
• Unsigned, wrongly signed or too old: refused with 401.
• The same delivery again within 24 hours: answered duplicate and not posted twice.
• An event Missived doesn't turn into a card: answered 200 with { "ok": true, "ignored": true }, so the service doesn't retry it.

Cards are posted by the webhook's bot, with its name and an APP badge.

GitLab

Works with GitLab.com and self-managed GitLab.

1. In the project (or group): Settings → Webhooks → Add new webhook. URL: the /gitlab URL.
2. GitLab 19.1 and later: choose Generate signing token, copy it (it starts with whsec_ and is shown once) and paste it in Missived as the Signing token. Retries of one delivery are recognised and posted once.
3. Older GitLab has no signing token. Make up a long random value, put it in GitLab's Secret token field, and paste the same value in Missived as the Secret token (older GitLab). This is weaker; switch to a signing token when you upgrade. With both set, the signing token wins.
4. Tick the triggers you want, save, and use Test → Push events.

Posts: pushes (up to five commits, with a compare link); branches and tags created or deleted; merge requests opened, merged, closed, reopened or approved; issues opened, closed or reopened; comments on issues, merge requests and commits; pipelines that passed, failed or were cancelled; deployments that succeeded or failed; new releases; wiki pages created or updated.

Never posted: confidential issues, and internal or confidential comments, even if those triggers are ticked. Everything else is ignored. On a self-managed instance served over plain http://, cards keep their text but drop their links.

Sentry

1. In Sentry: Settings → Developer Settings → Custom Integrations → Create New Integration → Internal Integration. Webhook URL: the /sentry URL.
2. Turn on Alert Rule Action. Under Webhooks, tick issue (and comment and error if you want them). Give it Read on Issue & Event. Save.
3. Copy its Client Secret (under Credentials) and paste it into Missived.
4. Add "Send a notification via ⟨your integration⟩" to an issue or metric alert rule.

Sentry expects an answer within a second, so Missived answers { "ok": true, "queued": true } as soon as the signature checks out, and posts a moment later.

Posts: a "Sentry is connected" card when the integration is installed; issues that are new, resolved, assigned, archived or regressed (with level, project and assignee); alert-rule notifications; metric alerts (critical, warning, resolved); new errors; new comments. Anything else is ignored.

Linear

1. In Linear: Settings → API → Webhooks → New webhook (workspace admins). URL: the /linear URL.
2. Pick the teams and the data change events: Issues, Comments, Projects, Project updates, Documents, Cycles. Create it.
3. Copy the signing secret from the webhook's page and paste it into Missived.

Linear's signed timestamp must be within a minute of Missived's clock, as Linear recommends.

Posts: issues created, moved to another state (completed and cancelled say so), assigned or unassigned; new comments; projects created or moved to another status; project updates, with their health; documents and cycles created.

Ignored: other changes, such as title edits, labels and sort order, so a busy team's channel stays readable.

Stripe

This is for your own Stripe account. It has nothing to do with paying for Missived.

1. In Stripe: Workbench → Webhooks → Add destination → Webhook endpoint, with snapshot events.
2. Choose these events: checkout.session.completed, payment_intent.succeeded, payment_intent.payment_failed, charge.refunded, charge.dispute.created, invoice.paid, invoice.payment_failed, customer.subscription.created, customer.subscription.deleted, payout.paid, payout.failed.
3. Endpoint URL: the /stripe URL.
4. Reveal secret and paste the whsec_… value into Missived. Test mode and live mode have different secrets. Never paste an API key (sk_…); Missived refuses one.

Signatures may be up to five minutes old. When you roll the secret in Stripe, it signs with both for a while: paste the new one then.

Posts: new orders and subscription checkouts, payments received or failed, refunds, disputes (with the respond-by date), invoices paid or failed, subscriptions started or cancelled, payouts sent or failed. Each card shows the amount in the charge's currency, the customer's name (or their email when there's no name) and a link to the Stripe dashboard. Test-mode events say "test mode". Card details never appear.

Ignored: every other event type.

PagerDuty

1. In PagerDuty: Integrations → Generic Webhooks (v3) → New Webhook. Webhook URL: the /pagerduty URL.
2. Scope it to a service or team and pick the incident events. Add the webhook.
3. PagerDuty shows the signing secret once: paste it into Missived.
4. Send Test Event posts a "PagerDuty is connected" card.

During a secret change PagerDuty sends several signatures; any one that matches is accepted.

Posts: incidents triggered, acknowledged, unacknowledged, escalated, reassigned, resolved, reopened or with a changed priority; notes added; status updates; responders added. Cards show the service, urgency, priority and, when an incident is triggered, reassigned or escalated, who it's assigned to.

Ignored: everything else, such as tasks, workflows and services.

Manage secrets over the API

A token with the webhooks:write scope can paste or forget a service's secret, as Connect a service does:

curl -X PUT https://api.missived.com/v1/orgs/<orgId>/incoming-webhooks/<id>/providers/stripe \
  -H "Authorization: Bearer $MISSIVED_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"signingSecret": "whsec_…"}'

• signingSecret is the service's secret; for GitLab, legacyToken is the older secret token. An empty string or null clears that one.
• DELETE …/providers/{provider} forgets every secret for that service.
• The answer is the webhook, whose providers list shows which services have a secret (last four characters only).

See setIncomingWebhookProviderSecret and Manage webhooks over the API for who may do this.

What data moves

• Missived sends nothing to these services. They send their events to the URL, and Missived turns the events it shows into cards.
• Missived stores the card (as a message in the channel, like any other) and the service's signing secret, encrypted. A short delivery log records each request's event name and outcome, never its content.
• Cards show only what's listed above. Stripe cards never show card details; GitLab's confidential issues and comments are never posted.

Limits

The incoming webhook limits apply: 5 requests per 2 seconds and 30 a minute per webhook, bodies up to 1 MiB, and 30 failed signatures in 10 minutes from one address get that address 429. A webhook that stays over its limit for an hour pauses itself and its creator gets an email.

Troubleshooting

Open the webhook's Recent deliveries on the Integrations page: it lists the last 50 requests as posted, ignored, duplicate, refused (with the reason) or rate limited.

• Refused, "No … signing secret set": paste the service's secret under Connect a service.
• Refused, signature check failed: the secret in Missived isn't the one the service is using. For Stripe, check test mode against live mode; after rotating a secret in the service, paste the new one.
• Refused, signed timestamp outside the window (Linear): a delayed or replayed delivery. Linear retries on its own.
• Ignored: the event isn't one Missived posts. Check the lists above.