opschain admin inbound-webhooks create
Included from Basic tier
Registers an inbound webhook connection. The code (the /api/hooks/<code>
address) is immutable after create; everything else can change through the
update verb. The signing secret is write-only: supply it through
--secret-env (the name of an environment variable holding it) or
--secret-prompt (a no-echo prompt), never on the command line; it is
encrypted at rest and no read ever returns it. The secret must be at least
16 characters — it is the endpoint's whole authentication.
--service-account is required: the username every trigger firing this
connection causes executes as. Point it at a dedicated service account with
exactly the create rights the automation needs; an inbound call never
carries ambient authority.
HOOK_SECRET=$(openssl rand -hex 32) opschain admin inbound-webhooks create ghmain \
--service-account ci-bot --secret-env HOOK_SECRET
Created inbound webhook connection ghmain (POST /api/hooks/ghmain)
Configure the external system to POST to <server>/api/hooks/ghmain,
signing each delivery with the same secret — GitHub-style
(X-Hub-Signature-256) or the generic shape (X-OpsChain-Signature +
X-OpsChain-Timestamp). Then bind a trigger to the connection (see
opschain docs triggers).
Flags
| Flag | Meaning |
|---|---|
--service-account <username> | The identity every resulting trigger firing executes — and is authorization-checked — as. Required. |
--secret-env <name> | Name of an environment variable holding the HMAC signing secret (never pass the value itself on the command line). |
--secret-prompt | Prompt for the signing secret without echo (reads a line from stdin when piped). |
--display-name <name> | Human-readable connection name. |
--replay-window <seconds> | Replay window (default 300, range 30-86400): signed timestamps outside it refuse, and delivery ids dedup inside it. |
--rate-per-minute <n> | Per-connection request budget per minute (default 60, range 1-6000); requests beyond it answer 429 before any verification. |
--enabled | Whether the endpoint accepts deliveries (default true). |
--server <url> | Server base URL (default: the active context / OPSCHAIN_SERVER). |
--auth-token <token> | Admin bearer token override (default: your opschain login session, then $OPSCHAIN_ADMIN_TOKEN, then the token stored by opschain admin login). |
See also
opschain docs cli/admin-inbound-webhooks-update— rotate the secret or repoint the service account.opschain docs triggers— binding triggers to a connection.