Authenticated Monitoring
What it's for
Some endpoints you want monitored aren't public — an internal API, an endpoint behind a Bearer token, a POST-only health check that needs a specific payload. Authenticated Monitoring lets a monitor send custom request headers and/or a request body along with its check, so it can reach exactly the same endpoint your users hit.
Plan availability
Configuring custom headers or a request body is a Starter-plan-and-above feature. Regular unauthenticated monitoring (the vast majority of use cases) is unaffected on any plan.
Your credentials are encrypted
Header values and the request body are encrypted at rest — they're never shown back to you in full after you save them (only whether a value is set), never logged, and never included in a data export. Only the header names are ever visible.
When a token expires
If a credentialed monitor starts getting rejected (401/403) instead of a real outage, Dumza treats this differently from a normal DOWN: it does NOT open a flapping incident or keep re-alerting. Instead it sends you one "credential expired" email and pauses the monitor, so a stale token doesn't hammer your endpoint or your inbox. Update the header/body with a fresh token and resume the monitor — it picks up right where it left off.