Canary Token.

A canary token is a small, embeddable tripwire — a URL, document, DNS hostname, file, executable, or cloud credential — that calls back to a control server the moment it is opened, executed, or used. Because the token has no legitimate role, every callback is, by construction, a high-confidence signal of intrusion, insider activity, or data leakage. Security teams scatter canary tokens across file shares, source code, mailboxes, and SaaS apps to obtain early warning long before a breach reaches noisy detection layers.

The best-known implementation is Thinkst's free Canarytokens service (also self-hostable), which has minted tripwire URLs and documents for over a decade and added AWS API-key tokens in 2017. A crucial design detail is the transport: many tokens fire over DNS, so a decoy document opened deep inside a segmented network still alerts when its unique subdomain is resolved — even when the host has no direct HTTP egress. Each alert carries the source IP, user-agent, and timestamp. Operationally, the artifact matters: a decoy AWS key alerts the instant an attacker runs sts get-caller-identity, though defenders should know that Thinkst-hosted keys return a caller identity containing a beacon domain — a "tell" sophisticated adversaries may spot, which is one argument for self-hosting.

Deploy tokens uniquely per location so an alert pinpoints exactly which share, repo, or mailbox was touched, and treat any callback as an incident-response trigger.

flowchart LR
  A[Defender mints token<br/>URL / doc / AWS key / DNS] --> B[Plant in file share,<br/>repo, mailbox, SaaS]
  B --> C[Attacker opens,<br/>runs, or resolves it]
  C --> D{Transport}
  D -->|HTTP| E[Callback to control server]
  D -->|DNS| F[Unique subdomain resolved<br/>works without HTTP egress]
  E --> G[Alert: source IP, UA, timestamp]
  F --> G
  G --> H[High-confidence IoC →<br/>incident response]