Publish high-volume notifications without touching your bot's rate limit

Scenario: an ops engineer says "set up a webhook in #ci-alerts and use it for our GitHub Actions notifications." Two calls split across time: provision the webhook once and capture its token, then call webhooks_execute from then on.

The webhook token is a credential, treat it like a database password: store it in a secrets manager, never log it, rotate it if it leaks. Anyone holding the token can post anything to that channel without appearing as a bot. discord-mcp marks the token field "do not log" and redacts it from audit output, but your agent needs to do the same on the client side.

Step 1: provision the webhook once#

{
  "name": "webhooks_create",
  "arguments": {
    "channel_id": "222233334444555566",
    "name": "github-actions-notifier",
    "audit_reason": "ops: create CI alerts publisher"
  }
}

Capture the returned id and token and store them outside the agent's working memory, typically a secrets manager or sealed config file.

Step 2: post via webhooks_execute#

The token replaces bot authentication entirely: no Authorization header is sent, the token becomes part of the Discord route URL, not the JSON body.

{
  "name": "webhooks_execute",
  "arguments": {
    "webhook_id": "444455556666777788",
    "token": "REPLACE_WITH_WEBHOOK_TOKEN",
    "content": "Build #4127 failed on `main` - https://github.com/cappyeo/discord-mcp/actions/runs/4127",
    "username": "GitHub Actions",
    "wait": true
  }
}

To send a Components V2 layout through the same webhook, set both flags: 32768 (the IS_COMPONENTS_V2 bit) and with_components: true (so Discord includes the component tree in the response when wait: true).

Bot vs webhook trade-offs#

Concern	Bot user	Webhook
Rate-limit handling	Bot route/global scheduling	Webhook route scheduling, still rate-limited
Auth	`Authorization: Bot <token>` header	Token in the URL route, no bot header
Display identity	Bot's name + avatar	Per-message username and avatar override
Can react, reply, edit other messages	Yes	No
Cost to provision	One bot install per server	One `webhooks_create` per channel

Caveats#

Webhooks can only post. They can't react, reply with interactions, or edit messages other than their own, for interactive flows use the bot.
A webhook starts in its creation channel. Move a bot-owned webhook with webhooks_modify, or provision separate webhooks for concurrent targets.
Token leakage means full impersonation, with no further auth required.

webhooks_create, webhooks_execute, and the token-only mutations webhooks_modify_with_token and webhooks_delete_with_token (no bot auth required).

Next steps#

Pair this with a rich layout: build a Components V2 announcement. See the resilience layer behind rate limits: production configuration. Back to the overview.

Updated Aug 14, 2026