TradingView webhook automation, explained

What a TradingView webhook is

When an alert triggers, TradingView can send an HTTP POST request to a URL you provide. The body of that request is whatever you typed into the alert's Message box, after TradingView replaces placeholders such as {{close}} with real values. If the message is valid JSON, TradingView sends it with a JSON content type. Otherwise it is sent as plain text.

A few platform rules are worth knowing up front. Webhook alerts are a paid TradingView feature, and TradingView asks you to turn on two-factor authentication before it will send them. The URL must use port 80 or 443. TradingView also stops waiting for a response after a few seconds, so the receiving service should answer quickly. Check TradingView's help center for the current details, since they change them from time to time.

TradingView does not sign webhook requests. Anyone who knows the URL can call it. That makes the URL itself the secret, which shapes how you should store and share it (more on that below).

The pieces of an automated setup

1. A signal: an indicator condition or a Pine Script strategy on a chart.
2. An alert on that signal, with a webhook URL and a message.
3. A receiver: a service that validates the request, decides the order size and type, and calls the broker API.
4. A broker account with API access, such as Tradier, Tastytrade, or Coinbase.
5. A log of every request and every broker response, so you can check what actually happened.

StockAutoTrader is a receiver. It holds your broker connection, turns each alert into an order under limits you set, and writes the audit trail. You can also write your own receiver. The design questions below apply either way.

Writing the alert message

The message is a template. TradingView fills in placeholders at the moment the alert fires. The ones people use most are {{ticker}}, {{close}}, {{time}} (bar time), {{timenow}} (fire time), and for strategies {{strategy.order.action}}, {{strategy.order.contracts}}, and {{strategy.position_size}}.

Keep it valid JSON. Put quotes around text values and leave numeric placeholders unquoted. A single missing comma turns the whole message into plain text, and a careful receiver will refuse to trade on it. Paste your message into any JSON validator with sample numbers before saving the alert.

{
  "price": {{close}},
  "quantity": 10,
  "signal_id": "{{ticker}}-buy-{{timenow}}"
}

StockAutoTrader also accepts an empty message. The bot then falls back to its saved defaults and, where the broker allows it, fetches a live price. That is the simplest way to start: one alert, one URL, no JSON to get wrong.

One URL or two?

Some tools use one URL per account and expect the message to say "action": "buy" or "sell". That works well with Pine strategies, where {{strategy.order.action}} fills in the side for you. The cost is that a typo or a wrong placeholder can flip the side of a trade.

StockAutoTrader gives each bot two URLs, one for buys and one for sells, and fixes the ticker on the bot. The side comes from which URL was called, so the message cannot contradict it. The trade-off is that you create two alerts, one for entries and one for exits.

Sizing: the part that decides how much you can lose

Every order needs a quantity. There are three common ways to get one:

• Fixed quantity: always 10 shares, or 0.01 BTC. Easy to reason about, but the dollar exposure moves with the price.
• Dollar cap: spend at most $2,000 per order and divide by price. Exposure stays steady.
• Strategy-driven: pass {{strategy.order.contracts}} from Pine. Only as safe as the script.

Whatever you choose, have a hard ceiling that the alert cannot raise past without you noticing. In StockAutoTrader, each bot has a max amount, orders more than 1% over it are rejected, and no single order can exceed 10,000 units.

How StockAutoTrader picks the quantity

1. quantity from the alert, if present.
2. Otherwise the bot default buy or sell quantity.
3. Otherwise max_amount divided by price (whole shares for stocks, up to 8 decimals for crypto).
4. If no price was sent, the engine asks the broker for a quote where it can (Tradier and Coinbase).
5. The order is rejected if the result is zero, above 10,000 units, or more than 1% over the dollar cap.

Market or limit?

Market orders fill almost always but at whatever price is available, which can be far from the bar close on thin symbols or at the open. Limit orders protect the price but may not fill. A common middle ground is a limit a small percentage past the signal price: a little below for buys, a little above for sells.

StockAutoTrader expresses this as default_buy_percent and default_sell_percent. Set them on the bot or send them in the alert. For Tradier and Coinbase bots you can also have unfilled limit orders cancelled automatically when the next signal arrives, so stale orders do not pile up.

Duplicates, repaints, and missed alerts

Alerts set to "Once Per Bar" can fire several times inside one bar as the price crosses back and forth, and indicators that repaint can signal and then un-signal. For automation, "Once Per Bar Close" is usually the safer trigger, at the cost of acting a little later.

Send an idempotency key with every alert. In StockAutoTrader that is signal_id: a second request with the same ID is ignored rather than placed again. Build it from values that are unique per signal, such as ticker, side, and {{timenow}} or a strategy order ID.

Missed alerts happen too. TradingView can be delayed, a broker can be down, or an account can be out of buying power. Treat the broker as the source of truth for your position and check it, rather than assuming every alert produced a fill.

Keeping the URL safe

• Do not paste webhook URLs into screenshots, public scripts, or chat.
• Use a separate bot (and so separate URLs) per strategy, so one leak does not expose everything.
• If a URL leaks, deactivate or delete that bot. Requests to inactive bots are rejected and logged.
• Give broker API keys only the permissions trading needs. Never enable withdrawals.

Testing before real money

Run new alerts against a broker sandbox first. Tradier and Tastytrade both have one, and StockAutoTrader connects to either. You can also call a bot URL by hand to see exactly what the receiver does with a given message:

curl -X POST https://www.stockautotrader.com/api/bot/YOUR-BUY-TOKEN \
  -H "Content-Type: application/json" \
  -d '{"price": 512.30, "quantity": 1, "signal_id": "manual-test-1"}'

The response says what was placed, or why nothing was: quantity too large, broker not configured, price above your cap, and so on. The same detail lands in the audit trail for every alert TradingView sends.

A checklist before you switch to live

1. The alert message validates as JSON, or is intentionally empty.
2. Trigger is "Once Per Bar Close" unless you have a reason otherwise.
3. Every alert sends a unique signal_id.
4. The bot has a max amount you would be fine losing on one order.
5. At least a few sandbox alerts have run, and each one matches what you expected in the audit trail.
6. You know how to deactivate the bot quickly.

Automated trading can lose money. Not investment advice. A webhook runs whatever your alert says, including a bad alert. Test in a sandbox or at small size first, and watch the audit trail.