Teams & Webhook Alerts

Collaborate with engineering teams on shared credit pools and configure real-time webhook alerts to prevent production interruptions.

Role-Based Access Control (RBAC)

Owner

Full authority over billing, auto-recharge settings, team member roles, and organization deletion.

Admin

Can invite developers, generate scoped API keys, update alert thresholds, and configure provider fallbacks.

Developer

Can create personal API keys, benchmark models in the Arena, and route queries against the shared wallet pool.

Viewer

Read-only visibility into request telemetry traces, spend graphs, and audit logs.

Spend & Reliability Webhook Alerts

Configure automated webhooks sent to Slack, Discord, PagerDuty, or internal backend services when critical thresholds are triggered:

Low Balance Alert: Dispatches when your available universal credit balance drops below your configured USD floor (e.g. $5.00).
Daily Spend Velocity Spike: Dispatches when total token spend in a 24-hour rolling window exceeds your budget cap.

Webhook Payload & HMAC Signature Verification

All webhook notifications include cryptographic headers to verify authenticity:

POST https://your-domain.com/api/webhooks/nicrron
Content-Type: application/json
User-Agent: Nicrron-Alerts/1.0
X-Nicrron-Signature: sha256=d5a2f...
X-Nicrron-Event: alert.low_balance

{
  "id": "evt_alert_8f93a1c2",
  "event": "alert.low_balance",
  "timestamp": "2026-08-02T16:00:00.000Z",
  "user": {
    "id": "usr_4892",
    "email": "lead@company.com"
  },
  "data": {
    "currentBalance": 4.25,
    "threshold": 10.00,
    "currency": "USD",
    "message": "Organization credit balance is below $10.00 threshold."
  }
}

Verify the signature in Node.js / Next.js:

import crypto from "crypto";

export async function POST(req: Request) {
  const rawBody = await req.text();
  const signature = req.headers.get("x-nicrron-signature");

  const expectedSignature = "sha256=" + crypto
    .createHmac("sha256", process.env.NICRRON_WEBHOOK_SECRET!)
    .update(rawBody)
    .digest("hex");

  if (signature !== expectedSignature) {
    return new Response("Invalid signature", { status: 401 });
  }

  // Handle alert event...
  return new Response("OK");
}