Slack Integration
Real-time alerts, budget warnings, and a kill switch for runaway agents — all from Slack.
What you get
- Budget threshold alerts (80% and 100%)
- Burst detection — loop and runaway spend alerts
- One-click kill switch to pause a session instantly
- Correlation IDs to identify which agent session triggered it
- Auto-resume after 30 minutes (no manual intervention)
- Per-key and per-org webhook support
Setup
- Create a Slack App in your workspace
- Go to Incoming Webhooks → toggle on → click Add New Webhook to Workspace → pick your alerts channel
- Copy the webhook URL and paste it in Settings → Alerts → Notification Channel
- Enable Interactivity in your Slack app settings
- Set the Request URL to:
https://costlens.dev/api/alerts/kill
Step 4-5 enables the kill switch button. Without it, you still get alerts but can't pause sessions from Slack.
Alert Types
| Alert | Trigger | Action |
|---|---|---|
| budget_warning | Spend reaches 80% of daily limit | ⏸️ Pause Session button |
| budget_exceeded | Spend exceeds daily limit | ⏸️ Pause Session button |
| burst_detected | Requests/min or $/5min exceeded | ⏸️ Pause Session button |
Kill Switch
When an alert fires, you get a message with a pause button. All kill switch requests are cryptographically verified — only legitimate Slack interactions or signed email links can trigger a pause.
CostLens Alert
Key: cl_key_abc1...
Reason: 50 requests/min exceeded. Possible loop detected.
Session: corr_agent_xyz
Clicking "Pause Session" immediately blocks all requests for that session. Auto-resumes after 30 minutes. Resume early from Settings → API Keys.
Email Kill Link
Budget alert emails include a one-click pause link. The link is signed and expires after 15 minutes for security.
Security
- Slack requests verified via HMAC-SHA256 signature (X-Slack-Signature)
- Email kill links use time-limited signed tokens (15 min expiry)
- Replay attacks rejected (5 min timestamp window for Slack)
- All pause actions logged in audit trail
Per-Key Overrides
Each API key can have its own Slack webhook. Useful for routing alerts to different channels per project or team.
Configure in Settings → Alerts → Budget per API Key → Slack override.