Webhook to Bybit — automate crypto orders from your own code

Risk warning: Trading CFDs and other leveraged products is complex and carries a high risk of losing money rapidly because of leverage. Industry data indicates that 70–80% of retail trading accounts lose money on these products. Risk disclosure · Past performance.

This route is source-agnostic: any system that can make an HTTPS POST — a Python script, a backtesting bot, a serverless function or a no-code automation — can drive Bybit through the same JSON contract. PipSync runs the execution layer in the cloud with server-side risk controls, reduce-only closes and signed outbound webhooks for feedback, so you keep your own strategy logic while offloading order routing, retries and account safety.

1. 1

   Create your PipSync account and start the trial

   Sign up at app.pipsync.io and start the 14-day free trial (payment method required), so you can build and test the integration before the first charge.

2. 2

   Create a trade-only Bybit API key

   In Bybit, generate an API key scoped to trading on your Unified Trading Account with withdrawals disabled. Paste the key and secret into PipSync; they are stored server-side and never returned to your code.

3. 3

   Add a custom webhook source

   In PipSync, create a custom JSON webhook source. PipSync issues a unique URL whose secret token is the credential — keep it private and rotate it from the dashboard if it ever leaks.

4. 4

   Configure server-side risk rules

   Set fixed-lot or percent-risk sizing, SL/TP mapping, symbol filters and max open trades. These run before any order reaches Bybit, so the same limits apply even when your machine is off.

5. 5

   POST your first JSON payload

   From your script or automation, send a flat JSON body with action, symbol and optional price, sl, tp, lots and comment to the webhook URL. Match Bybit's exact symbol name; use action "close" to flatten an open position.

6. 6

   Verify in Test Mode, then go live

   Enable Test Mode to confirm PipSync interprets your payloads correctly without executing, then disable it and run a small live order to confirm end-to-end fills before scaling up.

Typical setup time: about 11 minutes.

The payload is a single flat JSON object — no nesting — that maps directly to a Bybit derivatives order. The core field is action ("buy", "sell" or "close"), followed by symbol, which must match Bybit's exact contract name. Optional fields let you control price and risk precisely.

Prices are absolute values, and a 0 means "omit" — set price to 0 for a market order, or sl and tp to 0 to leave them off. The lots field overrides your configured sizing for that one trade, so omit it when you want PipSync's server-side sizing to run instead.

• action: "buy", "sell", or "close" (close flattens the open position on that symbol)
• symbol: the exact Bybit contract name (e.g. a USDT perpetual)
• price: absolute entry price, or 0 for a market order
• sl / tp: absolute stop-loss and take-profit prices, or 0 to omit
• lots: optional size that overrides configured sizing; omit to use server-side sizing
• comment: optional free-text label carried with the order

A trade-only API key lets PipSync place and manage orders on your Unified Trading Account without ever being able to move funds off the exchange. You create the key in Bybit with withdrawals disabled, so even if the credential were exposed it could not initiate a transfer.

Your own code never has to embed Bybit keys either — you POST to a PipSync webhook URL whose secret token is the only credential your scripts hold. PipSync stores the exchange key server-side, separating your strategy code from your account access.

Sending action "close" in your payload flattens the open position on that symbol. PipSync submits the close as a reduce-only order, so it can only shrink or flatten an existing position and will not accidentally open a new one in the opposite direction.

This matters on the Unified Trading Account, where unified margin and perpetuals make exposure easy to flip. Reduce-only closes give you a deterministic way to exit from your code without second-guessing whether a fill reversed your position.

PipSync gives you three feedback channels so your system always knows what happened. Signed outbound webhooks fire on trade.opened, trade.closed, tp_hit and sl_hit events, each carrying an HMAC-SHA256 signature in the X-PipSync-Signature header and retried up to five times with backoff. A REST read API (GET /v1/signals and GET /v1/trades, documented via OpenAPI 3.1) lets you poll state on demand, and the dashboard shows every parsed signal and order on all plans.

Inbound webhooks are rate-limited per minute, scaling by plan from the entry tier up to custom limits on Enterprise. If you exceed the limit you get a 429 with a Retry-After header — back off with jitter and your bursts will settle cleanly. The read API is part of the Enterprise plan.

Yes. PipSync's Bybit route is fully cloud-based and runs 24/7, which matches crypto markets that never close. There is no VPS, no plugin and no terminal to keep open — once your webhook source and trade-only key are configured, execution continues whether your laptop is on or off.

Because the route is source-agnostic, the same setup works for a cron-driven script, a hosted bot or an event-driven function. Your job is to POST valid JSON; PipSync handles authentication, order routing, retries and the server-side risk checks.