Token Watch
Choosing your alert channels
Updated August 21, 2026
An expiry alert is only useful where your team already looks. Token Watch delivers on two tracks: email, which is its own channel and works on every plan, and — on the Team plan — one additional channel of your choosing. Both are driven by the same daily run and the same expiring threshold.
Email: the base channel
Email stands on its own. It is configured separately from everything below, it is available on every plan including Free, and it does not consume your additional-channel slot. You give it the addresses to notify and it sends a daily report of every expired and expiring credential.
On the Free plan the report goes to a single recipient — your admin address. Paid plans let you add as many recipients as you need.
Where you have the choice, send it to a team alias rather than one person — an expiry alert shouldn't sit unread in someone's inbox while they're on holiday. See the email setup guide.
The additional channel: pick one
On top of email, the Team plan lets you activate one of the four channels below. They are mutually exclusive — turning one on turns the current one off, so you can't run Slack and Teams together, or Azure DevOps alongside a custom webhook. Switching is a settings change, not a migration.
| Channel | What arrives | Best for |
|---|---|---|
| Slack | A message in a channel, via a Slack incoming webhook. | Teams that live in Slack. |
| Microsoft Teams | An Adaptive Card in a channel, via a Power Automate workflow. | Teams on Microsoft 365. |
| Azure DevOps | One work item per expiring credential, closed automatically after rotation. | Rotations that need a ticket. |
| Custom webhook | Signed JSON to your own HTTPS endpoint — route it wherever you like. | Anything else: SIEM, queue, PagerDuty, your own logic. |
Which one to pick
Since you get exactly one, choose it by asking what should happen when nobody reads the email:
- Chat (Slack or Teams) puts the alert in front of people who won't open a report. It's a nudge, not a system of record — pick whichever one your team actually lives in.
- Azure DevOps is the choice when a rotation needs tracking. A work item survives being ignored; a chat message doesn't. It's created once per credential and closed automatically once the credential is rotated.
- The custom webhook is the choice when you need control — signed JSON to your own endpoint, for routing into a SIEM, a queue, PagerDuty, ServiceNow, or your own logic. It's also the escape hatch: if you need alerts in more than one place, have your own receiver fan them out.
Set one up
Each channel has a step-by-step guide with screenshots: email, Slack, Microsoft Teams, Azure DevOps, custom webhook. They're all configured on the Monitoring page in the app, and each one usually takes a few minutes to set up.