What it does
Canarytokens is Thinkst's decoy-token project for tracking activity and actions, with documented server deployment and alert-delivery configuration.
Canarytokens creates a reason to investigate an unexpected interaction with a decoy placed in an authorized location. Its repository documents server notification settings as well as token activity. The default outside debug mode permits one alert per calling IP per minute: further activity is still recorded even when no email or webhook is sent. A webhook is disabled after five consecutive errors by default. Monitor delivery as well as the event database, and decide who verifies an alert before responding. These are configurable operator-run settings, not an antivirus scan.
Strengths
- Decoy activity signaling with configurable alert delivery
Best for
- Defenders adding scoped deception signals to an environment
Sources
- Canarytokens (Oct 26, 2026)