# Posting incoming webhook messages from a bot account

**URL:** <https://forum.mattermost.com/t/posting-incoming-webhook-messages-from-a-bot-account/11293>\
**Category:** Troubleshooting\
**Created:** [February 21, 2021, 6:44pm UTC](https://forum.mattermost.com/t/posting-incoming-webhook-messages-from-a-bot-account/11293 "2021-02-21T18:44:04Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![cbeams](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mattermost.com/cbeams/32/4605_2.png) [@cbeams](https://forum.mattermost.com/u/cbeams)\
**Post date:** [February 21, 2021, 6:44pm UTC](https://forum.mattermost.com/t/posting-incoming-webhook-messages-from-a-bot-account/11293/1 "2021-02-21T18:44:04Z")

</div>

I’ve successfully set up an incoming webhook, and it posts from my user with the `BOT` label as documented. But I’d prefer that the webhook post as a dedicated user. I’ve created a new bot account for this purpose, but I see no way to configure the webhook to post as that bot account instead of from my account. Am I missing something? Thanks.

---

<div class="post-metadata">

**Author:** ![XxLilBoPeepsxX](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mattermost.com/xxlilbopeepsxx/32/4993_2.png) [@XxLilBoPeepsxX](https://forum.mattermost.com/u/XxLilBoPeepsxX)\
**Post date:** [February 22, 2021, 7:39pm UTC](https://forum.mattermost.com/t/posting-incoming-webhook-messages-from-a-bot-account/11293/2 "2021-02-22T19:39:26Z")

</div>

As far as I’m aware you should be able to do what your asking about. I briefly looked it up on the Mattermost documentation, and saw that the command below is provided to use for verifying a bot account has successfully been created:

```auto
curl -i -X POST -H 'Content-Type: application/json' -d '{"channel_id":"<channel-id>", "message":"This is a message from a bot", "props":{"attachments": [{"pretext": "Look some text","text": "This is text"}]}}' -H 'Authorization: Bearer <bot-access-token>' <mattermost-url>/api/v4/posts

```

Have you read the documentation [here](https://docs.mattermost.com/developer/bot-accounts.html)?

---

<div class="post-metadata">

**Author:** ![Mekst](https://avatars.discourse-cdn.com/v4/letter/m/b3f665/32.png) [@Mekst](https://forum.mattermost.com/u/Mekst)\
**Post date:** [March 15, 2022, 4:54am UTC](https://forum.mattermost.com/t/posting-incoming-webhook-messages-from-a-bot-account/11293/3 "2022-03-15T04:54:45Z")

</div>

The linked doc says,

> Only user accounts can create and configure webhooks and slash commands.

> [@cbeams](#):
>
> it posts from my user with the `BOT` label

This just looks odd.

At laeast the feature request seems to exist.

[Allow bot accounts to create webhooks – Mattermost Feature Proposal Forum (uservoice.com)](https://mattermost.uservoice.com/forums/306457-general/suggestions/38228500-allow-bot-accounts-to-create-webhooks)

---

<div class="post-metadata">

**Author:** ![agriesser](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mattermost.com/agriesser/32/5644_2.png) [@agriesser](https://forum.mattermost.com/u/agriesser)\
**Post date:** [August 10, 2022, 5:01pm UTC](https://forum.mattermost.com/t/posting-incoming-webhook-messages-from-a-bot-account/11293/5 "2022-08-10T17:01:01Z")

</div>

Hi Mekst and welcome to the Mattermost forums!

An incoming webhook is something that you create for yourself, usually, at least per definition. A webhook is always assigned to a userid and when using the GUI, the userid cannot be modified since it’s inherited from the user creating the webhook because a webhook needs to know what permissions it has. You cannot create a webhook with your user account which is able to post into a private channel you’re not a member of, that’s why. Using the API or the tool `mmctl`, you can create an incoming webhook which is assigned to a bot account. All you need to know for that is the bots userid and then you can run the following command:

```auto
mmctl webhook create-incoming --channel <channel-id> --user <user-id>

```

The webhook will be assigned to the account/bot with userid “” then and posts will also show as appearing from this account (+ the bot label next to it).  
Please keep in mind that the permission topic I mentioned earlier also applies here, so in order for the webhook to work, make sure that the bot account is allowed to post to the channels you want the webhook to post to.  
If the webhook is locked to a channel, just make sure that the bot is a member there, this works always.  
If you want the webhook to post to different public channels, you can assign the privilege `post:channels` to the bot account using the GUI, this will allow the bot to post to all public channels (even if it is not a member of the channel). The privilege `post:all` allows the bot to also send direct messages to other users and post to private channels where it is a member of.

Hope that helps!

---

<div class="post-metadata">

**Author:** ![strarsis](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mattermost.com/strarsis/32/6347_2.png) [@strarsis](https://forum.mattermost.com/u/strarsis)\
**Post date:** [February 2, 2023, 9:51pm UTC](https://forum.mattermost.com/t/posting-incoming-webhook-messages-from-a-bot-account/11293/6 "2023-02-02T21:51:39Z")

</div>

I set up the webhook using the bot user ID - however, the messages sent to this webhook are still shown as coming from the bot owner user, not the bot user itself (owner user with `bot` badge).

---

<div class="post-metadata">

**Author:** ![agriesser](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mattermost.com/agriesser/32/5644_2.png) [@agriesser](https://forum.mattermost.com/u/agriesser)\
**Post date:** [February 5, 2023, 11:37pm UTC](https://forum.mattermost.com/t/posting-incoming-webhook-messages-from-a-bot-account/11293/7 "2023-02-05T23:37:55Z")

</div>

Hi @strarsis and welcome to the Mattermost forums!

Can you please run the following `mmctl` commands (replace the webhook ID with the ID of your webhook) and verify that the username returned is really the name of the bot account you’re expecting?

```auto
mmctl --local user search $(mmctl --local webhook show <WEBHOOKID> --json | jq -r .user_id) --json | jq -r .username

```

---

<div class="post-metadata">

**Author:** ![strarsis](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mattermost.com/strarsis/32/6347_2.png) [@strarsis](https://forum.mattermost.com/u/strarsis)\
**Post date:** [February 7, 2023, 4:18am UTC](https://forum.mattermost.com/t/posting-incoming-webhook-messages-from-a-bot-account/11293/8 "2023-02-07T04:18:09Z")

</div>

> [@agriesser](#):
>
> verify that the username returned is really the name of the bot account you’re expecting

The returned username is not the name of the bot account, but rather of the owner account.  
So the `mmctl webhook create-incoming` command that should have created the incombing webhook for that bot account actually created it for the owning user account instead.

This is what I am using for creating a webhook in channel `development` (team `my_team`) for bot account `uptimekuma` (an excellent uptime tool by the way):

```auto
channel_id=$(mmctl channel search --team my_team development --json | jq -r .id)
user_id=$(mmctl user list --json | jq -c '.[] | select( .username | contains("uptimekuma"))' | jq -r .id)
mmctl webhook create-incoming --channel "$channel_id" --user "$user_id" --display-name "Uptime Kuma" --description "Uptime Kuma Alerts"

```

The webhook is successfully created by the command – but when I use your command against the webhook ID to query the owner I get the owner of the bot account, not the bot account itself.

---

<div class="post-metadata">

**Author:** ![agriesser](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mattermost.com/agriesser/32/5644_2.png) [@agriesser](https://forum.mattermost.com/u/agriesser)\
**Post date:** [March 2, 2023, 5:29am UTC](https://forum.mattermost.com/t/posting-incoming-webhook-messages-from-a-bot-account/11293/9 "2023-03-02T05:29:36Z")

</div>

Yes, this is not what you would expect and I’ve also pointed that out some time ago.  
You should be able to fix that when creating the webhook on the CLI, I just verified that on my demo system and created a webhook for the `playbooks` bot account:

```auto
# mmctl --local user list | grep playbooks
ieaiw1cdairo5x6g7p3oq6hhha: playbooks (playbooks@localhost)

# mmctl --local webhook create-incoming --channel jitoep1mcfrtjjp8facxycqeec --user ieaiw1cdairo5x6g7p3oq6hhha --display-name test123
Id: ywdjwo9w1ibcdg9a8icrpf3onw
Display Name: test123

# mmctl --local user search $(mmctl --local webhook show ywdjwo9w1ibcdg9a8icrpf3onw --json | jq -r .user_id) --json | jq -r .username
playbooks

```

---

<div class="post-metadata">

**Author:** ![smileBeda](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mattermost.com/smilebeda/32/7073_2.png) [@smileBeda](https://forum.mattermost.com/u/smileBeda)\
**Post date:** [November 18, 2025, 2:49pm UTC](https://forum.mattermost.com/t/posting-incoming-webhook-messages-from-a-bot-account/11293/10 "2025-11-18T14:49:01Z")

</div>

This should not be necessary (anymore, at least)

You can just head to `admin_console/integrations/integration_management` \> `Enable integrations to override usernames:` and check that to true, then your requests to the web hook can include something like

```auto
{

"username": "YourBotName",

"text": "text here …"

}

```

OR, just set the username/image in the web hook settings after enabling the above mentioned option.

YES, of course, this has the very unlikely chance someone impersonating someone else with a web hook.  
But, I do not see how that would be any different from the default to start with: whomever _knows_ that webhook’s address can post anyway, **no questions asked** , so… literally changes nothing if you give the thing another name security wise.