Webhook to cTrader — send your own alerts as signals

Risk warning: Trading CFDs and other leveraged products is complex and carries a high risk of losing money rapidly because of leverage. Industry data indicates that 70–80% of retail trading accounts lose money on these products. Risk disclosure · Past performance.

This route is built for developers who already have a system that produces trade decisions — a scanner, a Python bot, an internal alerting service — and want a reviewable signal without hosting anything themselves. Anything that can make an HTTP POST becomes the signal source; PipSync handles authentication, payload validation and risk settings, and can push signed execution events back to your own endpoint.

1. 1

   Create your PipSync account and subscribe to a plan

   Sign up at app.pipsync.io (the $0 Free plan needs no card but only parses signals), then subscribe to a plan that includes webhook integration (payment method required). It is enough to generate the webhook URL and check Recent alerts from curl.

2. 2

   cTrader for Telegram and Discord signals

   For Telegram and Discord signals, open Trading Accounts → Add account and choose cTrader and authorize through your cTrader ID. cTrader accounts are gateway-connected, so for now indices, gold and crypto are not auto-traded on them: their risk cannot be measured there.

3. 3

   Create a webhook source and copy your URL

   Go to Settings → Advanced → TradingView Alerts and click Generate webhook URL. PipSync generates a unique URL containing a secret token and shows it only once — that URL is the credential your system will use, so store it like any other secret: with TradingView auto-trade on, anyone who has the URL can trigger trades. Regenerate it on the same screen if you suspect a leak.

4. 4

   Send your first JSON POST

   From your own code or curl, POST a JSON body to the URL. Five fields are required: instrument, direction ("buy" or "sell"), entry, sl and tp1, with sl and tp1 above 0. Other fields such as lots are ignored. The entry price is a reference, and the signal waits for your approval.

5. 5

   Execution events (Telegram and Discord signals)

   If your system needs confirmations, register your own endpoint under Settings → Webhooks. For signals executed from Telegram or Discord, PipSync POSTs signed events such as trade.opened and trade.closed to it — verify the X-PipSync-Signature header before trusting any payload.

6. 6

   Verify with Recent alerts

   Fire a sample payload from curl and check Recent alerts under Settings → Advanced → TradingView Alerts: it shows each call with its status and, if rejected, the exact error.

Typical setup time: about 12 minutes.

No. cTrader has no inbound HTTP endpoint a third-party system could call. The official integration path is Spotware's Open API, which expects you to build and host an authorized application: OAuth flows, persistent connections, symbol metadata, order lifecycle handling. The alternative — a cBot written in C# inside cTrader Automate — only runs while a terminal is open.

PipSync is a hosted endpoint for your signals. Your code makes a plain HTTP POST; PipSync validates it and saves a signal. You write no cBot and run no infrastructure of your own.

A small, flat JSON object. Five fields are required — instrument, direction, entry, sl and tp1 — and everything else is ignored. Because your own system produces the payload, parsing is deterministic: there is no free-text interpretation involved, unlike Telegram routes where an AI parser reads human-written messages.

The one detail that trips developers up is symbol naming. Brokers can use their own naming or suffixes for the same market, and there is no mapping setting for webhooks: PipSync upper-cases the instrument and keeps only letters and digits. A test POST shows you the parsed payload under Recent alerts — the fastest check — and if your broker spells it differently, message us in the support chat.

• direction (required): buy or sell (long and short also work); there is no close action
• instrument (required): the symbol, for example EURUSD
• entry (required): the signal's reference price, above 0
• sl / tp1 (required): stop-loss and take-profit price levels, above 0
• everything else, including lots: ignored

Through outbound webhooks. Register your endpoint under Settings → Webhooks and PipSync POSTs a signed JSON payload for events like signal.received, trade.opened, trade.closed, trade.tp_hit and trade.sl_hit. Delivery is attempted up to 5 times with exponential backoff, so a brief outage on your side does not lose events.

Every delivery carries an X-PipSync-Signature header in the form t=<unix-ts>,v1=<hex-hmac-sha256>. Verify the HMAC with your webhook secret using a constant-time comparison, and reject payloads whose timestamp is more than 5 minutes old to prevent replay attacks.

For pull-based access there is also a REST read API — GET /v1/signals and GET /v1/trades with pagination, RFC 7807 error responses and an OpenAPI 3.1 spec at /api/v1/openapi.json for generating typed clients. API keys for it are available on the Enterprise plan; the inbound webhook source and outbound event webhooks do not require it.

Inbound webhook delivery is rate-limited. For most alert systems that is ample headroom — if your system can emit faster than allowed, batch or debounce on your side rather than retrying blindly.

Security is layered. The webhook URL contains a secret token, so possession of the URL is the credential — treat it like a password: with TradingView auto-trade on, anyone who has it can trigger trades, so regenerate it if you suspect a leak. Separately, a webhook from your own system is never traded automatically: reviewing each signal on the Signals page keeps a human confirmation step between a buggy upstream system and your account.

A webhook from your own system — a bot, a script or another tool — is never traded automatically: it always becomes a signal for your approval. Only alerts that TradingView itself sends, from its published sender addresses, can auto-trade, and only after you opt in.

Auto-trade is opt-in and off by default. It needs the Advanced plan: you set it up under Settings → Advanced → TradingView Alerts with an explicit consent (Set up auto-trading), then link your accounts and switch auto-trade on under Accounts & auto-trade. cTrader accounts are gateway-connected, so for now indices, gold and crypto are not auto-traded on them (their risk cannot be measured there). Telegram and Discord signals execute on cTrader via Spotware's official Open API.

Keep the webhook URL secret: with auto-trade on, anyone who has it can trigger trades. Regenerate it if you suspect a leak.

You can absolutely integrate with Spotware's Open API directly — it is well documented. What you take on is the operational side: registering and maintaining an authorized application, OAuth token handling, connection management and reconnects, broker symbol metadata, order lifecycle states and error handling, plus hosting all of it somewhere that never sleeps. That is real engineering work.

Sending a webhook to PipSync is one HTTP request, but a webhook from your own system only produces a signal for your approval; it is never traded automatically. For executed cTrader trades, use Telegram or Discord signals.