---
title: "Connect Honeycomb"
description: "Send Honeycomb trigger alerts to Firefight through a Webhook recipient."
canonical: https://firefight.app/docs/alerts/honeycomb
---

# Connect Honeycomb

Firefight has a dedicated alert source for Honeycomb triggers. Honeycomb sends the token as the recipient's shared secret, and an alert resolves in Firefight when its trigger is back to OK.

## Set up the Firefight side

Go to **Settings → Alert Sources**, click **Add source**, give it a name like "Honeycomb production", and pick the **Honeycomb** provider. When you create it, Firefight opens the source's setup. It shows the ingest URL and a **Copy token** button for the source's secret token, and the same steps as this page.

## Set up the Honeycomb side

1. In Honeycomb, open **Team Settings → Integrations** and add a recipient under **Trigger, SLOs, and Anomaly Detection Recipients**. Choose **Webhook** as the provider.
2. Paste the ingest URL as the **Webhook URL** and the token as the **Shared Secret**. Leave the payload as it is and click **Add**.
3. Add the recipient to each trigger that should alert.

Requests that fail the check are rejected with `401`, and the source's row in **Settings → Alert Sources** shows the rejection.

:::note
This source reads trigger notifications. SLO burn alerts and anomaly detection send a different body, which Firefight refuses as unrecognized.
:::

## What Firefight reads

Each alert gets these fields, which you can match in your [routing rules](https://firefight.app/docs/alerts/routing-rules.md).

| Field | Value |
|---|---|
| `title` | The trigger's name |
| `description` | The trigger's result and its description |
| `url` | The query result in Honeycomb |

The alert's title in Slack and on the dashboard links to its page in Honeycomb.

## Firing and resolving

A trigger fires an alert when Honeycomb says it is triggered, and repeat notifications count on it. When the trigger is back to OK, the alert resolves.

See [Grouping & deduplication](https://firefight.app/docs/alerts/grouping-and-deduplication.md) for how repeat firings collapse into one alert.