Skip to main content
Connect Odin to Shortcut to keep security findings in sync with your team’s Shortcut workspace.
Shortcut works a little differently from Odin’s other trackers: there’s no manual Push to Shortcut button on a single finding. Stories are created through auto-ticketing or a bulk Sync now instead.

​
Connecting

Shortcut has no OAuth, so connecting uses a workspace API token instead of a redirect flow.
1

Open Integrations

Go to Management > Integrations in the sidebar.
2

Generate an API token

In Shortcut, go to Settings > API Tokens and create a token.
3

Paste the token into Odin

Click Connect next to Shortcut and paste the token. Odin validates it against Shortcut before saving it.
4

Select a workflow

Choose the Shortcut workflow where Odin should create stories, and optionally a team to own them. The integration activates once a workflow is selected.

​
Auto-ticketing

Auto-ticketing creates Shortcut stories automatically when new findings are reported, without any manual action from your team. From the integration settings panel:
  • Auto-create tickets: toggle on to enable. When disabled, stories are only created via Sync now.
  • Minimum severity: only findings at or above this severity trigger automatic story creation. Defaults to Medium.
Set the minimum severity to High or Critical if you want to keep your Shortcut workflow focused on the most urgent findings.

​
Customising synced stories

With a workflow selected, the Issue customization panel on the Shortcut card shapes the stories Odin opens. On top of the shared default assignee and labels, Shortcut adds:
  • Initial state: the workflow state new stories open in, grouped by Unstarted, Started, and Done. Leave it unset to use the workflow’s default.
Shortcut doesn’t support priority mapping: stories don’t carry a priority field.

​
Status sync

A finding’s status and its linked story’s workflow state stay in sync, in both directions.
Fixed & Retested and Acknowledged both move a story to the workflow’s Done state, so there’s no way to tell them apart from Shortcut alone. Moving a story back to a Done state always maps to Open for Retest in Odin, not Acknowledged. Only Borg can set Fixed & Retested, and an inbound change is ignored once a finding already has it.
Odin matches by state name first (In Review, In Progress), then falls back to the state’s type (Unstarted, Started, Done) for a customised workflow.

​
Enabling status sync from Shortcut

Shortcut has no webhook API of its own, so status changes only flow from Shortcut back into Odin once you set up an outgoing webhook by hand:
1

Copy the webhook URL

On the Shortcut card in Management > Integrations, copy the webhook URL shown under Status sync.
2

Create an outgoing webhook in Shortcut

In Shortcut, go to Settings > Integrations > Outgoing Webhook, paste the URL, and set a signing secret.
3

Paste the signing secret into Odin

Paste the same secret back into the Shortcut card and save. Odin uses it to verify that inbound requests really came from Shortcut.
Until the secret is saved, moving a story in Shortcut has no effect on the linked finding. Outbound status pushes from Odin to Shortcut aren’t affected.

​
Notes

  • Stories are created in the workflow (and team, if selected) you chose during setup. Change either at any time from the Integrations page.
  • Multiple issue trackers can be active at the same time. When you connect a second one (for example Shortcut and Linear together), Odin keeps new findings and status changes in sync across all active trackers.