---
title: "Connect PostHog"
description: "Send PostHog insight alerts and logs alerts to Firefight through a signed webhook destination."
canonical: https://firefight.app/docs/alerts/posthog
---

# Connect PostHog

Firefight has a dedicated alert source for PostHog alerts. PostHog signs each request with the source's token, and logs alerts resolve in Firefight when they resolve in PostHog.

## Set up the Firefight side

Go to **Settings → Alert Sources**, click **Add source**, give it a name like "PostHog alerts", and pick the **PostHog** provider. When you create it, Firefight opens the source's setup. It shows the ingest URL and a **Copy token** button for the source's secret token, and the same steps as this page.

## Set up the PostHog side

1. In PostHog, open the insight, click **Monitor**, then **Alerts**, and create an alert. Under **Destinations** choose **Webhook**, paste the ingest URL and click **Add notification**, then save the alert.
2. Open **Data pipelines**, open the webhook destination the alert created, paste the token into its **Signing secret** field and save.

Requests that fail the check are rejected with `401`, and the source's row in **Settings → Alert Sources** shows the rejection.

Firefight refuses a request without a valid signature or one signed more than five minutes ago.

## What Firefight reads

Each alert gets these fields, which you can match in your [routing rules](https://firefight.app/docs/alerts/routing-rules.md).

| Field | Value |
|---|---|
| `title` | The alert's name |
| `description` | Which thresholds the insight broke, or how many logs matched |
| `service` | The insight's name, or the services a logs alert watches |
| `severity_raw` | The severity levels a logs alert watches |
| `url` | The alert in PostHog |

The alert's title in Slack and on the dashboard links to its page in PostHog.

## Firing and resolving

An insight alert only says when it fires, so each notification arrives as a new alert. Resolve one by hand with **Resolve** on the **Alerts** page once it is dealt with. A logs alert says when it fires and when it resolves, and Firefight resolves the alert then.

See [Grouping & deduplication](https://firefight.app/docs/alerts/grouping-and-deduplication.md) for how repeat firings collapse into one alert.