When a desktop webhook routine hides credentials

You create a webhook-triggered routine, open it on desktop, and see Enabled, Instructions, and “When a webhook fires” — but no gray copy card with POST URL, crsr_ sender key, or Authorization header. Deep links for those fields open empty. Recreating the routine does not help. Staff: this is a product bug on server-stored Bot routines, not a bad local setup. Thread: forum 171324 (deanrie #5, Sep 11, 2026). Happy-path create/manage: Save a Grok Bot skill and schedule a routine.

What staff confirmed

New Bots keep routines on the server (the panel note: “This Bot keeps its routines on the server”). For those routines, the desktop app currently does not fetch or show the webhook POST URL, crsr_ key, or Authorization header. Recreating the routine does not provision a visible card. The Bot cannot emit those values either, so asking it for the URL or key fails.

Staff are tracking a product fix. Until that ships, there is no supported way to recover the missing webhook credentials for this class of routine.

Temporary workarounds (wake without the webhook card)

If you need to wake the Bot from something external without those credentials:

1. Slack message trigger — ask the Bot to create a routine that runs when a message is posted in a channel you control. Keep the match narrow. Cursor account Slack integrations are separate from Slack plugins; see the event section in Save a Grok Bot skill and schedule a routine.
2. Schedule — ask the Bot for a clock-based routine instead of a webhook (time zone + next run confirmed in the routine panel).

Use Test run only with safe inputs. A test run does real work.

Manage while you wait

Open the Bot → View conversation details → Routines to pause, enable, edit instructions, or delete. Deleting a routine has no undo. If the Agent Computer is unreachable and routines still burn usage: Pause Grok Bot routines when the Agent Computer is unreachable.

Pitfalls

• Scraping local files, deep-link params, or network traffic for a hidden crsr_ key — staff say the desktop client does not surface those values, and the Bot cannot emit them.
• Recreating the webhook routine expecting credentials to appear — staff say recreate does not change this.
• Broad Slack listeners (“every new message”) while using the workaround — they burn weekly allowance and act on noise.