What causes "Discord webhook credential must use HTTPS" in can1357/oh-my-pi?

Change the credential scheme to https://discord.com/api/webhooks/...

Discord webhook credential must use HTTPS

Error message

Discord webhook credential must use HTTPS

What it means

Discord webhook endpoints must be reached over HTTPS; the uploader rejects any credential URL whose protocol is not `https:`. This prevents leaking the webhook token (which allows posting and deleting messages) over plaintext HTTP.

Source

Thrown at packages/coding-agent/src/blob-broker/uploaders-discord.ts:36

	id: string;
	token: string;
}

interface DiscordMessage {
	id: string;
	attachmentUrl: string;
}

function parseWebhook(value: string): DiscordWebhook {
	let url: URL;
	try {
		url = new URL(value);
	} catch {
		throw new Error("Discord webhook credential is not a valid URL");
	}

	if (url.protocol !== "https:") {
		throw new Error("Discord webhook credential must use HTTPS");
	}
	const segments = url.pathname.split("/").filter(Boolean);
	const webhooksIndex = segments.indexOf("webhooks");
	const id = webhooksIndex >= 0 ? segments[webhooksIndex + 1] : undefined;
	const token = webhooksIndex >= 0 ? segments[webhooksIndex + 2] : undefined;
	if (!id || !token || !/^\d+$/.test(id)) {
		throw new Error("Discord webhook credential does not contain a webhook ID and token");
	}
	return { id, token };
}

function webhookEndpoint(webhook: DiscordWebhook, suffix?: string): URL {
	const base = `${DISCORD_API_ORIGIN}/api/v10/webhooks/${encodeURIComponent(webhook.id)}/${encodeURIComponent(webhook.token)}`;
	return new URL(suffix ? `${base}/${suffix}` : base);
}

function parseMessage(value: unknown): DiscordMessage {
	if (!value || typeof value !== "object") throw new Error("Discord returned an invalid message response");

View on GitHub (pinned to 9690622007)

Solutions

Change the credential scheme to https://discord.com/api/webhooks/...
If routing through a proxy, keep the webhook URL https and configure TLS at the proxy instead of rewriting to http
Re-copy the webhook URL from Discord, which is always https

Example fix

// before
webhookUrl = http://discord.com/api/webhooks/1234567890/token-value
// after
webhookUrl = https://discord.com/api/webhooks/1234567890/token-value

Defensive patterns

Strategy: validation

Validate before calling

const url = new URL(webhookUrl);
if (url.protocol !== 'https:') {
  throw new Error(`Discord webhook must use https://, got ${url.protocol}`);
}

Try / catch

try {
  await publishToDiscord(blob);
} catch (err) {
  if (err.message.includes('must use HTTPS')) {
    logger.error('Rewrite the webhookUrl with https:// scheme');
  } else {
    throw err;
  }
}

Prevention

Never hand-edit the webhook URL scheme
Keep TLS termination at Discord or a trusted https-speaking proxy
Validate protocol at config load time
Treat the webhook token as a secret — http would expose it

When it happens

Trigger: The `webhookUrl` credential parses as a URL but uses http:// (or ftp://, file://, etc.) — e.g. someone wrote `http://discord.com/api/webhooks/<id>/<token>` or a proxy rewrite produced an http scheme.

Common situations: Manually downgrading the scheme to work around a proxy; a template or docs snippet showing http; a local reverse-proxy setup where an http:// URL was substituted for the real Discord webhook.

Related errors

AI-assisted analysis of can1357/oh-my-pi@9690622007 (2026-08-31). Data as JSON: /api/errors/7d78990462a46049. Report an issue: GitHub.