Connecting Discord

Discord is the team broadcast channel. Everyone in the Discord channel you connect sees every notification we send there. That's deliberate — the typical use case is a seller team that wants to collectively watch new bids, listing approvals or buyer reviews without each member needing to be signed in to Haubot.

This article walks through setting one up, the privacy considerations, and what to do if the webhook URL gets exposed.

Setup: the Discord side

You need to be able to create webhooks in the Discord server you're connecting. That requires the Manage Webhooks permission — usually owners and admins.

1. Open the Discord server you want notifications in.
2. Server Settings → Integrations → Webhooks → New Webhook.
3. Pick a channel. This is where every notification will be posted, so pick a dedicated team channel rather than #general.
4. Optionally rename the webhook (e.g., "Haubot Notifications") and set an avatar — these show up in the message author of each notification.
5. Click Copy Webhook URL. The URL looks like https://discord.com/api/webhooks/<id>/<token>. Treat this URL like a password — anyone with it can post messages to that Discord channel as the configured webhook.

Setup: the Haubot side

1. Sign in to Haubot.
2. Navigate to Dashboard → Settings → Notifications.
3. Find the Connected channels section at the top of the page. The Discord card has a Connect button.
4. Paste the webhook URL.
5. (Optional) Add a label like "Acme team #notif". This is shown later as the connection's display name (up to 64 characters). Useful if you ever connect a second Discord channel.
6. Required: tick the broadcast acknowledgement checkbox: "I understand notifications sent to this webhook may be visible to everyone in that Discord channel." The form won't submit without it.
7. Click Connect & test.

What happens when you click Connect:

• We validate the URL shape (must be discord.com or discordapp.com with the right path).
• We POST a one-shot test message to Discord: "Haubot connected ✓ — notifications you enable for this channel will appear here."
• If Discord returns OK, we save the connection and the card flips to Connected. The Discord column in the event matrix below unlocks for the events you're allowed to enable.

If Discord rejects the test, the card shows the reason. Common ones:

Privacy: what to think about before connecting

Every member of the Discord channel sees every notification. This is by Discord's design and a real concern on ours.

The connect modal requires the broadcast acknowledgement checkbox specifically because connecting a webhook from a server you don't control — say, a public community Discord, or a friend's server you have temporary access to — would expose your Haubot activity to people you didn't intend.

Discord works best when:

• You own or admin the Discord server you're connecting.
• The channel is dedicated and only your team is in it.
• You're comfortable with everyone in that channel knowing when, e.g., your auctions get bids or your listings get sold.

It's a poor choice when:

• The channel is shared with people outside your team.
• You're using the webhook for personal notifications (use Telegram instead — it's a private 1:1 chat).

What's NOT routable to Discord

Some events are server-side blocked for Discord. The matrix UI hides those cells with a lock icon. The blocked classes are:

What IS routable: marketplace activity (listing publish/reject/expire/sold, auctions, reviews), platform announcements, network activity (likes, comments, follows). The full list is in your matrix.

Within the allowed set, every event is opt-in by default on Discord — connecting Discord doesn't suddenly broadcast a flood of historic preferences to your team channel. You tick the rows you want event by event.

Choosing what to send

Most teams enable a small, focused set:

• Listings you posted (LISTING_PUBLISHED, LISTING_REJECTED, LISTING_SOLD).
• Auctions you're running (AUCTION_BID_RECEIVED for sellers, AUCTION_WON / AUCTION_LOST for bidding teams).
• Reviews on your listings (REVIEW_RECEIVED, REVIEW_RESPONSE_RECEIVED).

Avoid enabling network activity (likes, comments, follows) — these are high-volume and quickly drown out the signal you actually want.

Disconnecting

1. Dashboard → Settings → Notifications → Discord card → Disconnect.
2. Confirm.

The connection's status flips to Revoked. We stop sending. The row stays in our database for audit. There's no rate limit on disconnect — disconnect-reconnect-disconnect is fine.

If you reconnect later (with the same webhook URL or a different one), your matrix preferences for Discord are preserved when the destination matches the previous one (we match by a hash of the URL).

What to do if a webhook URL leaks

A Discord webhook URL is the auth — anyone with it can post to that Discord channel as the configured webhook. If you accidentally screen-shared it, posted it in a chat, or otherwise exposed it:

1. Delete the webhook on Discord (this is what actually invalidates the URL)

• Discord → Server Settings → Integrations → Webhooks.
• Find the webhook in question.
• Click Delete.

The URL stops working immediately. Anyone holding a copy can't use it. This is the only step that actually invalidates the URL — disconnecting on our side stops us from delivering, but doesn't stop a third party from POSTing arbitrary content.

2. Disconnect on Haubot

Disconnect the connection (Section above). Optional, but tidy — the connection will eventually flip to Failed anyway because Discord returns 404 to our deliveries once the webhook is deleted, but you may as well clean up.

3. Reconnect with a fresh webhook (optional)

If you still want notifications going to Discord, create a new webhook on Discord (different URL) and connect it on Haubot the same way you did the first time. Your matrix preferences carry over only if the new URL hashes to the same destination — for a freshly-created webhook, that's not the case, so expect to set up the matrix again from defaults.

Common questions

Do I need to enable 2FA on Discord for this to be secure? Webhooks don't authenticate via your Discord account — the URL itself is the auth. So Discord 2FA doesn't apply here. What protects you is keeping the URL secret and limiting the channel's membership.

Can I connect more than one Discord webhook? Yes. Add additional webhooks the same way. Each connection is a separate row with its own label; the matrix rows are AND'd across them — ticking LISTING_PUBLISHED for Discord goes to every connected Discord webhook.

Can I send notifications to Discord in a language other than English? Today, no. Discord messages are English-only in v1. We're tracking the gap as #discord-locale-rendering for a future release.

Can I customize what each message looks like? Not in v1. Messages are short plain-text with a 🔔 prefix and the event title. Embed-style rich messages are tracked as a future improvement.

A test send went through but real events don't appear. Check the matrix — make sure the rows you care about have the Discord cell ticked. The defaults for Discord are intentionally conservative; very few cells are pre-ticked.