Webhook secrets checklist for TradingView bots

TradingView can POST to any URL you give it. So can everyone else who finds that URL. Treat the webhook endpoint like an admin API that happens to speak alert dialect.

Minimum bar

• Shared secret checked on every request (header or authenticated body field)
• Reject missing/invalid secret with the same boring error (no oracle)
• Request body size limit
• Per-endpoint rate limit
• TLS in front (do not freestyle plaintext on the public net)
• Structured audit log for accept/reject without logging secrets

Operational habits

• Rotate the webhook secret when people leave the chat where it was pasted
• Keep admin controls behind a different secret
• Never commit secrets; inject at runtime
• Prefer fail-closed production boot if secrets are missing

What this does not solve

A stolen laptop with a live API wallet is still catastrophic. Webhook auth stops casual internet; it does not replace exchange-side permissions, size caps, or dry-run discipline.

Packages · Contact