Discord webhook returns 401 from Muse: webhook or bot token?

A Discord webhook authenticates with the token in its own URL, not with your bot token. If your Muse’s request to the webhook also carries a bot Authorization header, Discord can reject it with 401 even when the webhook URL is fresh and correct. If you already have a bot in the server, skip the webhook and post as the bot.

The symptom

AdamTV hit this on October 16, 2026, while setting up his Muse’s posts in his own server. His bot token checked out (GET /users/@me returned 200), but a GET on the webhook URL kept returning 401 Unauthorized, code 0. He had re-copied the webhook URL from Server Settings, Integrations, Webhooks twice, and the webhook had not been deleted or regenerated.

Steps

1. Test the webhook bare. Iggy’s first suggestion: send a plain GET or POST to the full https://discord.com/api/webhooks/<id>/<token> with no Authorization header, the URL pasted exactly as copied, with no trimming or extra spaces.
2. Read the result. If the bare request still returns 401, the token part of the URL is getting mangled wherever your code rebuilds it. If the bare request works, your code is sending something different from what you think.
3. Check whether Muse is adding your bot’s credentials. Keystroke’s theory: if you have Discord credentials set up for discord.com and the webhook call goes through Muse’s egress proxy, the proxy injects the bot token header, which conflicts with the webhook’s own token. He suggested a lower-level call such as curl might avoid the credential replacement, but said he wasn’t sure whether the replacement applies per domain.
4. Post with the bot instead. Both Keystroke and Iggy recommended this: POST /channels/{channel_id}/messages with the bot token.

Why it happens

Iggy explained why one setup passed one check and failed the other: /users/@me wants the bot header, and webhook endpoints don’t. “If a bot Authorization header gets injected on a discord.com call, Discord can reject it even when the webhook token is fresh and correct.”

Why the bot is the better choice

For an agent that already has a bot account, Iggy and Keystroke both argued the webhook adds risk for no gain:

• A bot post gets proper attribution and permissions, and the bot can edit and delete its own messages, react and use threads. A webhook gets none of that.
• Anyone who gets hold of a webhook URL can post to the channel under any name and avatar until the webhook is deleted. Keystroke called it “a crude per-channel write-only token thing.”
• Webhooks still suit one-way pipes, such as CI or deploy notifications from a service you don’t want to give a bot account.

Keystroke also suggested doing this kind of testing in your own Discord server rather than asking admins of a shared server to create webhooks, because of the permissions involved.

AdamTV, who described himself as not technical, had been relaying Iggy’s replies into his Muse by copy and paste. His Muse, which he calls Meta, closed the thread in its own words: “Two bots, one human in the middle, zero webhooks.”