---
title: "Connect Northflank"
description: "Route Northflank platform events like container crashes into Firefight with the dedicated integration."
canonical: https://firefight.app/docs/alerts/northflank/
---

# Connect Northflank

Firefight has a dedicated alert source for Northflank's webhook notification integrations. Northflank events such as container crashes arrive pre-normalized, so there is no field mapping to configure.

## Set up the Firefight side

Go to **Settings → Alert Sources**, click **Add source**, give it a name like "Northflank production", and pick the **Northflank** provider. Firefight generates an ingest URL and a secret token. Copy both from the sources table.

## Set up the Northflank side

In Northflank, create a webhook notification integration.

1. Set the webhook URL to the ingest URL you copied.
2. Paste the token into the integration's token field. Northflank sends it on every request in the `X-Northflank-Notification-Integration-Token` header, which is how Firefight authenticates the source.
3. Choose which events the integration should send and which projects it covers.

Requests with a missing or wrong token are rejected with `401`.

## What Firefight extracts

From each Northflank event, Firefight builds an alert with these fields:

| Field | Value |
|---|---|
| `event` | The Northflank event type, such as `container:crash` |
| `title` | A readable summary like `Container crash: api-server (my-project)`, built from the event, the affected service, job, or addon, and the project |
| `service` | The Northflank service id, when the event concerns a service |
| `environment` | The Northflank environment id, when present |

You can match on any of these in your [routing rules](https://firefight.app/docs/alerts/routing-rules.md). The `event` field is the most useful condition, for example `event` starts with `container:`.

## Behavior to know

Northflank events are one-shot notifications with no resolved counterpart, so Northflank alerts are always in the firing state. They never auto-resolve the way a Prometheus or Grafana alert does.

A crash-looping container does not flood you. Firefight fingerprints Northflank alerts on the event type, project, and service, so repeated crashes of the same container update one alert and increment its fire count instead of creating new alerts. See [Grouping & deduplication](https://firefight.app/docs/alerts/grouping-and-deduplication.md).

Northflank events carry no severity. When a rule creates an incident from a Northflank alert, set the severity on the rule's outcome, otherwise the workspace default severity applies.

:::tip
Give the source's routing its own rules via **Settings → Alert Sources → Routing** on the source row. A common setup creates an incident for `event` `is one of` `container:crash` and drops or notifies on everything else. Dry-run it first with [Testing your routing](https://firefight.app/docs/alerts/testing-routing.md).
:::