How It Works
Understand the PineHook architecture and signal flow.
Last updated: 2026-02-10
PineHook connects TradingView alerts to your MetaTrader 5 terminal over WebSocket. When your alert triggers, the signal reaches your EA in 50–250ms on average.
Signal Flow Overview#
From alert to executed trade: webhook delivery, server validation, and WebSocket relay, all in a fraction of a second.
TradingView
Triggers a trading alert and sends it to PineHook via a webhook payload.
PineHook Server
Validates the license, parses the signal, queues it for delivery, and sends it to MT5.
MT5 EA
Receives the signal and automatically executes the trade on your terminal.
Average latency: 50–250ms
- TradingView – Triggers a trading alert and sends it to PineHook via a webhook payload. Badge: Signal Sent
- PineHook Server – Validates the license, parses the signal, queues it for delivery, and sends it to MT5. Badge: Signal Processed
- MT5 EA – Receives the signal and automatically executes the trade on your terminal. Badge: Signal Executed
Average latency: 50–250ms
PineHook uses WebSockets for signal delivery. Signals are pushed to your EA the moment they arrive, with no polling and no queued delays.
The Signal Journey#
Every signal passes through six stages, each tracked and logged.
TradingView Alert Triggers
Your alert condition is met and TradingView fires the webhook
- Alert condition detected on chart
- Webhook POST request generated
- Signal formatted as CSV or JSON
- Sent via HTTPS to PineHook
Server Receives & Validates
PineHook authenticates and validates your signal
- License key validated
- Subscription status checked
- Signal authentication verified (if enabled)
- Signal syntax parsed
Signal Queued & Logged
Signal stored in database and queued for delivery
- Stored in database
- Added to message queue
- Assigned unique signal ID
- Status: 'received' → 'sent'
WebSocket Broadcast
Signal pushed instantly to your connected EA via secure WebSocket
- Encrypted via WSS (TLS 1.2+)
- Broadcast to connected clients
- No polling delay
- Persistent connection maintained
EA Processes Signal
EA validates and executes trade
- Symbol validation on broker
- Risk management check
- Position size calculated
Trade Executed
Order submitted to MT5 and confirmed
- Order sent to broker
- Position opened with SL/TP
- Status: 'sent' → 'executed'
Click on any step to see detailed information
- TradingView Alert Triggers – Alert condition detected on chart, webhook POST request generated, signal formatted as CSV or JSON, sent via HTTPS to PineHook
- Server Receives & Validates – License key validated, subscription status checked, signal authentication verified (if enabled), signal syntax parsed
- Signal Queued & Logged – Stored in database, added to message queue, assigned unique signal ID, status transitions from 'received' to 'sent'
- WebSocket Broadcast – Encrypted via WSS (TLS 1.2+), broadcast to connected clients, no polling delay, persistent connection maintained
- EA Processes Signal – Symbol validation on broker, risk management check, position size calculated
- Trade Executed – Order sent to broker, position opened with SL/TP, status updated to 'executed'
Click any step in the visual to see detailed sub-steps.
Authentication#
Each signal must include your license key. This validates:
- Your license exists and is active.
- Your subscription is current.
- The signal can be attributed to you and queued properly.
- The signal can be recovered if your connection goes down.
Simple comma-separated format
YOUR_LICENSE_KEY,buy,EURUSD,size_lots=0.1,sl_pips=50,tp_pips=100CSV Format
Simple comma-separated format
YOUR_LICENSE_KEY,buy,EURUSD,size_lots=0.1,sl_pips=50,tp_pips=100JSON (Minified)
Compact JSON format - saves space in TradingView alerts
{"license":"YOUR_LICENSE_KEY","action":"buy","symbol":"{{ticker}}","size_lots":0.1,"sl_pips":50,"tp_pips":100}JSON (Formatted)
Formatted JSON for readability
{
"license": "YOUR_LICENSE_KEY",
"action": "buy",
"symbol": "{{ticker}}",
"size_lots": 0.1,
"sl_pips": 50,
"tp_pips": 100
}Secret Key Protection#
Secret Keys provide an additional layer of security for your license. Think of it as a password that only your EA knows; without it, you can't authenticate on MT5. Even if someone sees your License ID, they won't be able to use your PineHook account on MT5.
How Secret Keys Work:
- Generate a Secret Key for any of your license in your web user dashboard (optional but recommended).
- Enter the key in your EA settings when connecting it to a chart.
- Keep the key secure and never include it in webhook messages. Treat it like a password.
- EA authenticates using License ID + Secret Key combination.
Protection Comparison:
- Without Secret Key: Anyone who knows your License ID can connect their own EA and MT account to your PineHook license, effectively stealing your subscription to run their own strategy.
- With Secret Key: Only an EA configured with the correct Secret Key can connect to your license. No one else can use your subscription.
Recommended for Live Trading
Always use Secret Keys in live trading environments. They add negligible complexity but significantly improve security.
Signal Authentication#
Signal Authentication is a per-license on/off switch. When it is enabled, every signal sent to PineHook for that license must include the correct password in the auth= parameter, or it is rejected. This prevents unauthorized signals from executing on your account, even if someone discovers your license ID.
How Signal Authentication Works:
- Enable Signal Authentication for a license in your web dashboard (from the license card menu).
- Set a password. It applies to every signal for the license; there is no per-command selection.
- Add the
auth=parameter with the password to your TradingView webhook messages. - PineHook validates the password before processing the signal. Signals without the correct password are blocked.
Example with Signal Authentication:
Simple comma-separated format
YOUR_LICENSE_KEY,buy,EURUSD,size_lots=0.1,sl_pips=50,tp_pips=100,auth=MyPassword123CSV Format
Simple comma-separated format
YOUR_LICENSE_KEY,buy,EURUSD,size_lots=0.1,sl_pips=50,tp_pips=100,auth=MyPassword123JSON (Minified)
Compact JSON format - saves space in TradingView alerts
{"license":"YOUR_LICENSE_KEY","action":"buy","symbol":"EURUSD","sl_pips":50,"tp_pips":100,"auth":"MyPassword123"}JSON (Formatted)
Formatted JSON for readability
{
"license": "YOUR_LICENSE_KEY",
"action": "buy",
"symbol": "EURUSD",
"sl_pips": 50,
"tp_pips": 100,
"auth": "MyPassword123"
}Protection Comparison:
- Without Signal Auth: Anyone who discovers your license ID can send signals to your account.
- With Signal Auth: Only signals with the correct password are executed, protecting against unauthorized webhook access.
Defense in Depth
Signal Authentication works alongside Secret Keys for maximum protection. Secret Keys protect EA connection, while Signal Auth protects webhook signals. Use both for comprehensive security.
Real-Time WebSocket Delivery#
Unlike traditional polling methods used by a variety of signal services, WebSocket provides:
- Instant delivery - Signals pushed immediately when they arrive.
- Low latency - Direct two-way connection to your terminal.
- Efficient - One persistent connection instead of repeated requests.
- Reliable - Automatic reconnection if connection drops.
Triple-Layer Duplicate Prevention#
Connection lag, execution latency, and sync issues between the EA, MetaTrader, and the signal server are common causes of duplicate executions in signal relay services. In trading, a duplicate is a real error: wrong position counts, unnecessary broker fees, and a strategy that no longer behaves as designed.
This triple-layer deduplication system ensures every signal executes exactly once, across network drops, EA restarts, server failovers, and broker disconnections.
EA Memory Buffer
Signal IDs tracked in memory with file-backed recovery
- ✓Instant deduplication
- ✓File-backed recovery
- ✓Reverse-chronological search
Server Acknowledgment
Bidirectional execution confirmation
- ✓Signal lifecycle tracking
- ✓Prevents re-queuing
Position Verification
Signal fingerprint embedded at broker level
- ✓Independent of PineHook
- ✓Partial-close tracking
- ✓Survives full restarts
PineHook uses triple-layer protection to prevent duplicate trade executions, even after EA restarts or reconnections:
- EA Memory Buffer (< 1ms) – Signal IDs tracked in memory with file-backed recovery. Reverse-chronological search for instant deduplication.
- Server Acknowledgment (< 10ms) – Bidirectional execution confirmation. Signal lifecycle tracking prevents re-queuing.
- Position Verification (< 5ms) – Signal fingerprint embedded at the broker level, independent of PineHook systems. Separate partial-close tracking that survives full restarts.
This protection holds across EA crashes and reconnections.
Missed Signals#
If your EA disconnects, signals are queued and can be recovered when it reconnects. When adding the EA to your chart, choose between two recovery methods:
notify_only- Server tells EA about missed signals but doesn't execute them (safest).closures_only- Auto-execute close signals only (recommended).
Signal expiry:
Missed signals expire after 15 minutes by default, adjustable to 5, 15, 30, or 60 minutes in your EA settings. If your EA is offline for longer and then reconnects, you'll be notified of stale signals but they won't execute. This prevents outdated entries after market conditions change.
Trade Execution Flow#
When PineHook receives a signal, several validation steps run before the trade executes. This ensures every condition in your signal is respected.
Parse Command
validationExtract command and parameters from signal
- Parse CSV or JSON format
- Extract action (buy/sell/close/modify/etc)
- Extract symbol and parameters
- Validate syntax structure
Check Duplicate
validationVerify signal hasn't been processed already
- Check EA memory buffer
- Query database for signal ID
- Check position comments for signal ID
- Reject if duplicate found
Validate Symbol
validationConfirm symbol exists on broker
- Check if symbol exists with your broker
- Verify symbol is tradeable
- Confirm trading session is active
- Reject if symbol invalid
Risk Manager Check
calculationOptionalVerify daily loss limits not exceeded
- Calculate today's P&L
- Check against daily drawdown limit (if you've set one)
- Verify max daily loss not reached (if you've set one)
Calculate Position Size
calculationOptionalDetermine lot size based on risk
- Parse risk parameter (fixed lots or %)
- Calculate based on account balance
- Apply minimum/maximum lot constraints
Verify Spread
calculationOptionalEnsure spread within acceptable range
- Get current bid/ask spread
- Compare to your maxspread_pips or maxspread_pct parameter (if you've set one)
- Reject if spread too wide
- Prevents slippage on volatile markets
Submit Order
executionSend order to MT5 broker
- Create trading order request
- Set magic number, if specified in the signal
- Set entry/exit price (market/limit)
- Apply stop loss and take profit
- Submit to broker's trade server
Apply Trailing Stop
executionOptionalConfigure trailing stop loss
- Check if trailing stop enabled and configured
- Monitor if trailing stop activation trigger is activated
- Set trailing stop type based on preferences (ATR, percentage, pips)
- Monitor price movement in real-time
- Auto-adjust SL dynamically as price moves
Log Trade Event
loggingRecord trade details for analytics
- Log action, symbol, volume
- Record entry price, SL, TP
- Track signal ID and timestamp
- Store for performance analytics and reporting (web user dashboard)
Click on any step to see detailed sub-steps
The EA processes signals through 9 steps grouped into 4 phases: Validation, Calculation, Execution, and Logging. Steps 4, 5, 6, and 8 are optional.
- Parse Command (validation) – Extract command and parameters from CSV/JSON signal
- Check Duplicate (validation) – Verify signal hasn't been processed using EA memory buffer, database, and position comments
- Validate Symbol (validation) – Confirm symbol exists on broker and is tradeable
- Risk Manager Check (calculation) – Verify daily loss limits not exceeded
- Calculate Position Size (calculation, optional) – Determine lot size based on risk % or fixed lots
- Verify Spread (calculation, optional) – Ensure spread within maxspread_pips/maxspread_pct parameter to prevent slippage
- Submit Order (execution) – Send order to MT5 broker with entry/exit price and SL/TP
- Apply Trailing Stop (execution, optional) – Configure trailing stop loss that auto-adjusts as price moves
- Log Trade Event (logging) – Record trade details for performance analytics on web dashboard
Click any step in the visual to see detailed sub-steps and explanations.
Execution failures (insufficient margin, invalid symbol, spread too wide) are logged with error details.
Downtime Resilience#
PineHook runs on multiple servers with automatic failover. If a server becomes unreachable, your EA reconnects to a healthy node in seconds with no data loss. Even during load-balancing events, in-flight signals are preserved and delivered according to your configured recovery settings.
EA Disconnects
Your EA loses connection to PineHook
Webhook Fails
TradingView fails to deliver webhook
Recovery Mode: Configure how your EA handles missed signals on reconnection (notify_only or closures_only)
EA Disconnects — Fully Recoverable
Your EA loses connection to PineHook
- 0s: Connection lost
- 3s: Auto-reconnect & restore
- Missed signals resent
Webhook Fails — Not Recoverable
TradingView fails to deliver webhook
- 0s: Webhook error at TradingView
- 0s: Signal never reaches server
- 1min: Check TradingView alert logs
Recovery Mode: Configure how your EA handles missed signals on reconnection (notify_only or closures_only).
Full Transparency
We believe in complete transparency. Track our real-time uptime, historical incidents, and maintenance windows on our public status page. Every service component is monitored and reported openly.
Data Storage & Logging#
All signal data, trade executions, and account activity are encrypted at rest. Your trading history and performance metrics are stored securely and accessible through your web dashboard.
Our full data collection, processing, and retention policies are documented in our Terms of Service and Privacy Policy. PineHook is fully compliant with the strictest data protection laws globally, including PIPEDA, Quebec Law 25, and GDPR.
Trade History
Real-time performance analytics on your dashboard
- ✓Entry and exit prices
- ✓Position sizes and volumes
- ✓Stop loss and take profit levels
- ✓Profit and loss tracking
- ✓Signal ID for each trade
Performance Analytics
Track strategy performance and trading statistics
- ✓Win rate and profit factor
- ✓Average trade duration
- ✓Drawdown evaluation
- ✓Advanced risk-adjusted metrics
- ✓Activity and symbol heatmap
Audit Logs
Compliance and billing reconciliation
- ✓All signal webhooks received
- ✓Authentication attempts
- ✓Rate limit events
- ✓Subscription status changes
- ✓Billing transaction history
Debug Logs
Troubleshoot failed signals and execution errors
- ✓Execution failures with details
- ✓Invalid symbol rejections
- ✓Spread too wide warnings
- ✓Insufficient margin errors
- ✓Connection status events
Each signal and trade is tracked with complete metadata including timestamps, execution status, and user/license associations
All trading activity is logged in four detailed categories:
1. Trade History
Real-time performance analytics on your dashboard
- Entry and exit prices
- Position sizes and volumes
- Stop loss and take profit levels
- Profit and loss tracking
- Signal ID for each trade
2. Performance Analytics
Track strategy performance and trading statistics
- Win rate and profit factor
- Average trade duration
- Drawdown evaluation
- Advanced risk-adjusted metrics
- Activity and symbol heatmap
3. Audit Logs
Compliance and billing reconciliation
- All signal webhooks received
- Authentication attempts
- Rate limit events
- Subscription status changes
- Billing transaction history
4. Debug Logs
Troubleshoot failed signals and execution errors
- Execution failures with details
- Invalid symbol rejections
- Spread too wide warnings
- Insufficient margin errors
- Connection status events
Each signal and trade is tracked with complete metadata including timestamps, execution status, and user/license associations.
Security Model#
Security and reliability are absolute requirements in trading signal delivery. A single fault can result in missed signals, incorrect trades, or real financial losses. You're trusting us with your capital, and we treat that responsibility with the seriousness it deserves.
Every part of PineHook is built and tested to the same standards we'd apply to financial infrastructure. Transport encryption, authentication, input validation, threat protection, and database encryption are all production-grade. Our engineers are in-house with deep SaaS and fintech backgrounds. These standards apply to every release.
Transport Security
Layer 1Encrypted communication channels
- All communication uses TLS 1.2+
- Webhooks are HTTPS only
- WebSocket connections use WSS (Secure WebSocket)
Authentication
Layer 2Verify user identity before processing
- License key (alphanumeric)
- Optional secret key (user-defined, securely hashed)
- Signal authentication (password-protected webhook signals when enabled)
- Optional 2FA for full dashboard and account access
Authorization
Layer 3Ensure users can only access their data
- Server verifies license ownership on every message
- EA can't execute signals for licenses it doesn't own
- Subscription status checked in real-time
Input Validation
Layer 4Reject malformed or malicious payloads
- All payloads validated before parsing
- Invalid syntax rejected
- Malformed JSON/CSV rejected
Protection
Layer 5Defense against abuse and attacks
- IP banning after multiple failed auth attempts
- Payload size limits enforced
- Rate limits enforced server-side only
Data Encryption
Layer 6Secure storage of sensitive information
- All sensitive data encrypted at rest in the database
- Passwords and secret keys stored as secure hashes
- Encrypted backups for disaster recovery
Defense-in-depth: Multiple security layers work together to protect your account and data
Click on any layer to see security features
Defense-in-depth: Multiple security layers work together to protect your account and data:
- Transport Security – Encrypted communication channels using TLS 1.2+. All webhooks use HTTPS only, and WebSocket connections use WSS (Secure WebSocket).
- Authentication – Verify user identity before processing. License key (alphanumeric), optional secret key (user-defined, securely hashed), signal authentication (password-protected webhook signals when enabled), and optional 2FA for full dashboard and account access.
- Authorization – Ensure users can only access their data. Server verifies license ownership on every message. EA can't execute signals for licenses it doesn't own. Subscription status checked in real-time.
- Input Validation – Reject malformed or malicious payloads. All payloads validated before parsing, invalid syntax rejected, malformed JSON/CSV rejected.
- Protection – Defense against abuse and attacks. IP banning after multiple failed auth attempts, payload size limits enforced, and rate limits enforced server-side only.
- Data Encryption – Secure storage of sensitive information. All sensitive data encrypted at rest in the database, passwords and secret keys stored as secure hashes, and encrypted backups for disaster recovery.
Verified Binary Releases#
The PineHook Expert Advisor runs inside MetaTrader with full access to your trading account. It can place orders, read balances, and modify positions. A tampered EA would be the highest-impact attack on a signal-relay platform's users, so we publish every release across two independent infrastructures.
The binaries themselves are hosted on our public GitHub repo PineHook/TradingView-Webhook-Relay as tagged Releases, with a SHA-256 fingerprint attached as a SHA256SUMS asset on every release. The same hash is also appended to a public, append-only releases/SHA256SUMS.txt file on the main branch. An attacker can't forge a hash on pinehook.io alone because pinehook.io doesn't store it; your Downloads page fetches the hash from GitHub at page-load time.
Coming soon: in addition to SHA-256 hashes, we plan to sign every release with an offline PineHook GPG key whose fingerprint will be pinned on channels independent of both pinehook.io and GitHub. That provides cryptographic proof of origin even if our publication infrastructure is ever compromised.
Extensive Testing Framework#
Each feature and version release passes through multiple layers of rigorous testing before reaching production:
- Unit Tests: Individual components are tested in isolation to verify correct behavior
- Integration Tests: System components are tested together to ensure proper interaction
- Regression Tests: Every release is verified against previous functionality to prevent breaking changes
- End-to-End Tests: Complete signal flow is tested from TradingView webhook to final trade execution
- Manual QA: Critical paths are manually tested to catch edge cases automation might miss
Our automated test suite runs on every code change. No release is deployed until it passes 100% of tests.
Why We Built PineHook
Missed signals and real trade losses caused by other services are the reason PineHook exists. Reliability is non-negotiable. Read our full story.
Why Traders Switch to PineHook#
Signals are queued, never dropped
Duplicate prevention built in
Uptime you can verify
Analytics that go beyond logs
Built around what traders actually ask for
Speed and reliability, not one or the other
Releases that don't break things
Missed signals and real trade losses caused by other services are the reason PineHook exists. Read our full story.
- Signals are queued, never dropped
Most services drop signals the moment your EA disconnects. PineHook queues them server-side and delivers them when you reconnect. Nothing is missed. - Duplicate prevention built in
Most services have no deduplication. A duplicate trade means wrong position counts, unnecessary fees, and a strategy that no longer behaves as designed. PineHook runs three independent checks before every execution. - Uptime you can verify
Most services don't publish uptime data. You find out about outages when your trades stop executing. PineHook runs on multiple load-balanced servers and publishes real-time status publicly at pinehook.io/status. - Analytics that go beyond logs
Most services give you a basic signal log and nothing else. PineHook gives you equity curves, PnL distribution, win rates, drawdown, and per-symbol breakdowns. Enough to actually analyze your strategy. - Built around what traders actually ask for
Most services ship a fixed feature set and leave it there. PineHook is actively developed with community feedback driving what gets built next. If something is missing, we want to hear it. - Speed and reliability, not one or the other
Most services pick one. Fast delivery with fragile infrastructure, or rock-solid uptime with a limited feature set. Getting both right takes real engineering work. PineHook delivers 50–250ms average latency on infrastructure built for redundancy, failover, and signal recovery. - Releases that don't break things
Most services push updates without comprehensive testing. Every PineHook release passes a full end-to-end test pipeline before deployment. Our engineers are on staff and know the system deeply.
Missed signals and real trade losses caused by other services are the reason PineHook exists. Read our full story.
Next Steps#
Where to go next:
- Prerequisites - What you need before starting
- Installation - Set up your first signal in 5 minutes
- Commands Reference - Learn all available trading commands