What is a Discord Webhook? How to Create and Use It Securely
A webhook is the quickest way to send messages to a channel without setting up a bot. We explain types, creation steps, message limits, and why you should treat the URL like a password.
This article was translated automatically from the Turkish original. Read the Turkish original
In this article
In Short
A webhook is an address that allows you to send messages to a Discord channel without a bot account. Anyone who knows the secret key inside the URL can write messages to that channel; therefore, treat your webhook URL like a password. Creating a webhook requires the Manage Webhooks permission.
If a GitHub notification, RSS feed, or a script you wrote is going to send a message to a Discord channel, you usually don't need to set up a bot. This article is based on the Webhook section in the Discord developer documentation.
Types of webhooks
- Incoming webhook: sends messages to a channel using a generated key. This is what people usually mean by "webhook" in everyday use.
- Channel Follower: the internal webhook Discord uses when you follow an announcement channel.
- Application webhook: used alongside interactions and is relevant to bot developers.
According to the documentation, using a webhook does not require a bot account or authentication.
How to create a webhook?
- Open the integrations section in your channel settings. This action requires the Manage Webhooks permission.
- Add a new webhook. The name must be between 1 and 80 characters long; the words "clyde" and "discord" cannot be used in the name.
- Copy the webhook URL and paste it into the application you want to send messages from.
What can it send?
A message can contain a maximum of 2000 characters of text and up to 10 embeds. A webhook cannot read the channel; it only has access to the messages it sends itself. Therefore, a bot is needed for anything that responds to commands, welcomes members, or handles moderation.
Security: the URL is a key
The documentation states that the webhook key is carried within the URL, and delete and edit requests made with this key do not require additional authentication. This means anyone who gets hold of the URL can send messages to the channel, modify the webhook, or delete it. Practical rules:
- Do not paste the URL into a public repository, screenshot, or chat.
- If you suspect it has been leaked, delete the webhook and create a new one; the old URL will become invalid.
- Only grant the Manage Webhooks permission to trusted staff members. Check out the role and permission system guide for permission distribution.
Webhook or bot?
A webhook is enough for one-way notifications. Two-way tasks like commands, buttons, auto-roles, or moderation require a bot. If you are going to use a ready-made bot, review which permissions you should grant to the bot in advance.
You can send one-way messages with a webhook; if you want automatic notifications from external sources, RSS notifications and YouTube notifications work without setting up webhooks. To visually prepare the message to be sent, you can try the embed builder.
Frequently asked questions
Can messages be deleted and edited using a webhook?
The documentation defines the ability of a webhook to retrieve messages it sent itself. It cannot read anyone else's messages; therefore, it is not used for moderation purposes.
What should I do if a webhook URL leaks?
Delete the webhook, create a new one, and update the new URL wherever you were using it.
Can I name the webhook "Discord"?
No. According to the documentation, the name cannot contain "clyde" or "discord".
Last updated: October 31, 2026. Webhook types, permission names, name and message limits are sourced from the Webhook section of the Discord developer documentation.
