Integrations · Discord

Discord bridgeInbound: signed JSON webhook. Outbound: approval embeds.

What this is

Receives Discord-shaped messages and drops them into the operator inbox.

What to do

POST to POST /api/integrations/discord. Each accepted POST creates an InboxItem with channel/user/message metadata and queues a TRIAGE_INBOX job.

What happens next

Open /inbox to see the new item, then /jobs to watch triage run.

Inbound

Active

Accepting unsigned posts (fine for local dev). Set the signing secret below to require HMAC.

Outbound

Optional

Add a webhook URL or bot token below to receive approval notifications.

Try it now

# (no signing — DISCORD_WEBHOOK_SECRET is not set, so this works for local dev)
curl -X POST https://hermes-agent.vercel.app/api/integrations/discord \
  -H "Content-Type: application/json" \
  -d '{"user":"vlk","channel":"general","content":"audit https://example.com"}'

On success the response includes inboxItemId; the item appears in /inbox and a TRIAGE_INBOX job is queued for the worker.

Recent inbound

Nothing yet. Run the test command above and refresh.

Developer detailsShow env vars + signing

Environment variables

DISCORD_WEBHOOK_SECREToptionalWhen set, inbound POSTs must include a constant-time HMAC-SHA256 of the raw body in `X-Foundry-Discord-Signature: sha256=<hex>`. Without it, the route accepts unsigned posts (local-dev only).

DISCORD_WEBHOOK_URLoptionalOutbound approval notifications. Set this to a Discord channel webhook URL — every approval decision is posted as an embed.

DISCORD_BOT_TOKENoptionalAlternative outbound path: bot token + DISCORD_CHANNEL_ID. Posts to the bot REST API.

DISCORD_CHANNEL_IDoptionalRequired when using DISCORD_BOT_TOKEN.

Secrets are read from process.env only. They are never logged or shown anywhere in the UI.