What Is a Webhook?
Webhooks are the connective tissue of most retail trading automation, and one property determines everything you can build on them: a webhook sent to an endpoint that was down is simply gone.
Tag
api security
Every StaxInvesting article tagged api security · 6 posts.
6 articles
Alternatives to 3Commas
3Commas built this category and its crypto feature depth is real. If credential custody is why you are leaving, Gunbot and OctoBot are the honest recommendation — and the lesson from the key leak is that trade-only scope bounds loss without preventing it.
Idempotency in Trade Webhooks
Three of the four sources of duplicate trade signals are self-inflicted. Idempotency is not primarily an attack defence — it is protection against your own infrastructure behaving normally, in the one place where a repeated request costs money immediately.
Webhook Security: Signing, Secrets, and Replay Protection
A webhook endpoint that places orders is an unauthenticated URL that spends money. Since cryptographic verification is not available, protection has to be layered: constant-time secret checks, idempotency keys, timestamp windows, and hard server-side limits on what any payload can do.
TradingView Webhook Payload Reference
TradingView imposes no payload schema — the format is entirely yours to design. What it does control is the transport: one attempt, no retry, a three-second timeout, and no request signing. Both facts shape what a sane payload looks like.
What Broker Permissions a Trading Bot Actually Needs
Scoping a broker credential correctly bounds what an attacker can do with it. The 3Commas breaches proved it does not make one safe: accounts were drained using trade permissions alone, through the market rather than through a transfer.