Repolode
Submit
thinkst

thinkst/canarytokens

Open-source server for Canarytokens, decoy tokens that alert you when someone accesses them on your network.

Open-source alternative to:Thinkst Canary

View on GitHubWebsite
Stars
2,221
Forks
297
Open issues
6
Last commit
yesterday

What is it?

Canarytokens is a self-hostable server for deploying canary tokens: decoy artifacts such as URLs, documents, DNS names or AWS-style API keys that trigger an alert when something interacts with them. Because no legitimate process should touch these tokens, any access is a strong signal of snooping, intrusion or misuse on the network.

The project is split into a frontend process and a switchboard process. Alerts can be delivered by email through Mailgun, Mandrill, SendGrid or a generic SMTP server with STARTTLS, and webhooks are supported. The server is configured through frontend.env and switchboard.env files, and the recommended installation path is the Docker image. Alert throttling limits notifications to one per unique calling IP per minute by default, and a webhook is disabled after five consecutive failures.

AWS key token creation depends on infrastructure that now lives in a private repository, so that feature is disabled unless the relevant CANARY_AWSID settings are provided.

Key features

  • 01Deploys decoy tokens that alert when accessed or triggered
  • 02Sends alerts by email via Mailgun, Mandrill, SendGrid, or SMTP
  • 03Supports webhook alerts, with automatic disabling after repeated failures
  • 04Limits alert volume per calling IP, configurable through an environment variable
  • 05Configured with environment files and recommended to run via Docker

Use cases

  • Detecting unauthorized access to sensitive documents or internal URLs
  • Spotting attackers who scan or use leaked AWS-style credentials
  • Monitoring DNS lookups for hostnames that should never be resolved

Quick start

  1. 1

    Follow the Docker image installation guide linked in the README

Things to know

  • The license could not be identified (listed as NOASSERTION), so check the license terms before use.
  • Self-hosting requires configuring a domain, an email provider and other settings in env files.
  • AWS key token features depend on AWS infrastructure that has moved to a private repository.

In collections

Self-hosted appsSecurity scanners, audits & threat intel tools

Topics

#security#intrusion-detection#honeytoken#canary#alerting#self-hosted

FAQ

What is canarytokens?
Open-source server for Canarytokens, decoy tokens that alert you when someone accesses them on your network. Canarytokens is a self-hostable server for deploying canary tokens: decoy artifacts such as URLs, documents, DNS names or AWS-style API keys that trigger an alert when something interacts with them. Because no legitimate process should touch these tokens, any access is a strong signal of snooping, intrusion or misuse on the network.
Is canarytokens free to use? What license does it have?
canarytokens is open source under the Other license. Check the license terms before using it in commercial products.
Is canarytokens still maintained?
Actively maintained. The last commit to canarytokens was on Oct 21, 2026.
What can I use canarytokens for?
Detecting unauthorized access to sensitive documents or internal URLs Spotting attackers who scan or use leaked AWS-style credentials Monitoring DNS lookups for hostnames that should never be resolved
How do I install canarytokens?
Follow the Docker image installation guide linked in the README
Where can I get canarytokens?
The source code and installation instructions are on GitHub: https://github.com/thinkst/canarytokens

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects