An API built for traders who code.

Quickstart

Store your key, call /v1/me to verify auth, then start reading signals or trades. Five minutes from zero to first API response.

curl https://app.pipsync.io/api/v1/me \
  -H "Authorization: Bearer $PIPSYNC_KEY"

Every response is wrapped in { "data": … }. Paginated endpoints additionally return a "meta" object with total, page, totalPages, and hasMore.

Authentication

All API requests require a bearer token in the Authorization header. Keys are per-environment (live / sandbox), per-scope, and time-limited only if you choose to set an expiry.

Obtaining an API key

API access requires the Enterprise plan. Once on Enterprise:

1. Navigate to Settings → API Keys in your workspace.
2. Click Create key, choose a name (e.g. prod-signal-reader), and select the scopes you need.
3. Copy the key — it is shown only once. Store it in a secret manager (AWS Secrets Manager, Vault, Doppler, etc.).
4. To rotate: create a replacement key, cut traffic over, revoke the old key. There is no downtime if you overlap by one deployment cycle.

Key scopes

Key security

Additional hardening available on Enterprise: IP allowlist (restrict which CIDR ranges may use a key) and IP blocklist. Both configured per-key from the same settings page.

Rate limits

Limits are per API key per rolling 60-second window. Webhooks are separately rate-limited on their inbound delivery surface.

Response headers

Every API response includes rate-limit headers so your integration can stay within bounds without trial and error:

Exponential backoff

Implement jittered exponential backoff whenever you receive a 429. This pattern prevents thundering-herd issues if your fleet is calling in parallel:

async function fetchWithRetry(url, key, maxRetries = 4) {
  for (let attempt = 0; attempt <= maxRetries; attempt++) {
    const res = await fetch(url, {
      headers: { Authorization: `Bearer ${key}` },
    });
    if (res.status !== 429) return res.json();

    const retryAfter = parseInt(res.headers.get("Retry-After") ?? "1", 10);
    const backoff = retryAfter * 1000 * Math.pow(2, attempt) + Math.random() * 200;
    await new Promise(r => setTimeout(r, backoff));
  }
  throw new Error("Rate limit retries exhausted");
}

Error codes

All errors use RFC 7807 Problem Details (application/problem+json):

{
  "type": "https://app.pipsync.io/errors/unauthorized",
  "title": "Unauthorized",
  "status": 401,
  "detail": "Missing or invalid API key"
}

GET /v1/me

Returns the profile of the workspace owner associated with the API key.

curl https://app.pipsync.io/api/v1/me \
  -H "Authorization: Bearer $PIPSYNC_KEY"

GET /v1/signals

Returns parsed trading signals for the workspace. Signals are the normalized output of the parser — ready for downstream processing.

Query parameters

curl "https://app.pipsync.io/api/v1/signals?limit=10" \
  -H "Authorization: Bearer $PIPSYNC_KEY"

GET /v1/trades

Returns trade records (opened, closed, partially-closed positions) for the workspace. Paginated; newest trades first.

Query parameters

curl "https://app.pipsync.io/api/v1/trades?limit=25" \
  -H "Authorization: Bearer $PIPSYNC_KEY"

GET /v1/reports

Enumerate generated trade reports and download links. Use /v1/reports/trades to get the detailed line-item CSV/PDF export.

Realtime stream

For browser dashboards and live monitoring, subscribe to /api/trading/stream with EventSource. This is the shipped SSE fallback when WebSocket upgrades are unavailable; keep signed webhooks for server-to-server automation.

Webhooks

Subscribe to push events from Settings → Webhooks. PipSync POSTs a signed JSON payload to your endpoint every time an event occurs. Delivery is attempted up to 5 times with exponential backoff.

Verifying signatures

Every webhook delivery includes an X-PipSync-Signature header formatted as t=<unix-ts>,v1=<hex-hmac-sha256>. Verify before trusting the payload:

import crypto from "crypto";

export function verifyWebhook(rawBody: string, header: string, secret: string): boolean {
  const parts = Object.fromEntries(
    header.split(",").map((part) => part.split("=")),
  );
  const signed = parts.t + "." + rawBody;
  const expected = crypto
    .createHmac("sha256", secret)
    .update(signed)
    .digest("hex");
  // Constant-time comparison to prevent timing attacks
  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(parts.v1 ?? ""),
  );
}

OpenAPI clients

The shipped contract is the OpenAPI 3.1 spec at /api/v1/openapi.json. Generate a typed client in your runtime — or use the interactive playground for ad-hoc requests.