How TradingView alerts reach MT5 and cTrader

TradingView sends a webhook when your alert fires, and PineHook checks the license and payload before routing the command to the broker account connected to that license. From there, MT5 and cTrader use different execution routes.

How an alert reaches your account#

On MetaTrader 5, PineHook sends the command over a persistent WebSocket connection to the Expert Advisor running in your terminal. The EA checks the trade against its settings and submits the order to your broker. On cTrader, a PineHook service worker uses the account access you approved through cTrader to submit the order. Both routes keep a connection open so dispatch does not depend on periodic account polling.

From webhook to broker result#

Receiving a webhook starts the process; it does not confirm a trade. PineHook parses the command, checks the license and any required auth value, then checks for duplicates and applies any risk management rules you've enabled. An invalid or blocked alert stops before it reaches MT5 or cTrader. If PineHook can identify the license, Signal Logs in your dashboard show the specific reason it was rejected or failed.

For an eligible alert, PineHook sends the command to the execution route linked to the license. The MT5 EA or cTrader worker checks the account's trading settings before submitting the request. The broker can still reject it if the market is closed, the symbol is unavailable, or the account lacks margin. A pending order can be placed successfully without being filled yet.

TradingView's "webhook sent" entry, even with HTTP 200, does not prove the broker acted. Check the alert's status in Signal Logs, then confirm the order or position in MT5 or cTrader. If the message is too malformed for PineHook to identify your license, the error may appear only in TradingView's alert log.

Authentication#

The license key in each alert identifies its destination, so keep it private. If someone learns it while Signal Authentication is off, they can submit alerts to your account. The optional Secret Key protects the MT5 EA connection when set; Signal Authentication checks incoming webhooks when enabled.

Secret Key protection#

On an MT5 license, open Dashboard > Licenses, choose Set Secret Key from the license menu, and copy the generated key while it is shown. Enter it in the EA's Secret Key input. An EA without the matching key cannot make a new connection, even if it knows your license key. An EA already online can remain connected until it reconnects, when PineHook checks the new key. Never put the Secret Key in a TradingView alert; cTrader uses its own account authorization instead.

Signal Authentication#

In Dashboard > Licenses, choose Signal Authentication from the license menu and set a password. Add auth=YOUR_PASSWORD to every alert for that license, including close and EA-control commands. For example:

YOUR_LICENSE_KEY,buy,EURUSD,size_lots=0.01,sl_pips=50,tp_pips=100,auth=YOUR_PASSWORD,id={{timenow}}-{{close}}

YOUR_LICENSE_KEY,buy,EURUSD,size_lots=0.01,sl_pips=50,tp_pips=100,auth=YOUR_PASSWORD,id={{timenow}}-{{close}}

{
  "license": "YOUR_LICENSE_KEY",
  "action": "buy",
  "symbol": "EURUSD",
  "size_lots": 0.01,
  "sl_pips": 50,
  "tp_pips": 100,
  "auth": "YOUR_PASSWORD",
  "id": "{{timenow}}-{{close}}"
}

Replace the placeholders with your license key and a case-sensitive password of 8 to 72 characters. Signal Authentication works on both platforms: a missing or incorrect password blocks the alert before delivery, while PineHook removes the password from stored alert records. On MT5 you can use it alongside a Secret Key because they protect different connections.

Duplicate alerts and retries#

TradingView may resend an alert after a slow response. PineHook compares its raw payload with recent alerts for the same license; a byte-identical repeat within about 12 seconds is not queued again. The MT5 EA also keeps a processed-signal history for reconnects, while PineHook assigns each cTrader license to one active bridge worker at a time.

As a general rule of thumb, include id= in every command and give each intended alert a fresh value. Keep that value if you manually retry within the duplicate window. The TradingView alert setup guide shows how to add an ID in the alert dialog or Pine Script. Partial closelong or closeshort commands with close_pct or close_lots are exempt by default, so rapid scale-out steps are not lost. Adding an id= to each step opts it into duplicate checking and prevents a matching retry from closing extra volume. These checks reduce duplicates, but an interrupted delivery can still leave the broker outcome uncertain.

Missed connections#

When an execution route is unavailable, the license's recovery mode determines what happens to missed alerts. notify_only records them without automatic execution. closures_only can execute eligible close and cancel alerts when the route recovers, while missed entries remain unexecuted. The recovery window defaults to 15 minutes and can be set to 5, 15, 30, or 60 minutes; alerts older than the selected window are not replayed. If a relay fails, the MT5 EA can reconnect to another configured relay, while cTrader workers can transfer account ownership.

Before manually resending an alert, check its result in Signal Logs and the broker account. The status page publishes service incidents and separate platform measurements.

Security model#

The execution route can place trades on your account, so review its broker permissions and verify the MT5 download before using a live account.

Transport and input checks#

TradingView sends alerts to an HTTPS webhook, and the MT5 EA connects to PineHook over a secure WebSocket. Before delivery, PineHook rejects malformed CSV or JSON. For dashboard access, you can also enable two-factor authentication.

How broker access works#

PineHook does not ask for your broker password. On MT5, the EA trades from the terminal where you are already signed in. On cTrader, you approve revocable trading access on cTrader's authorization page. PineHook stores the tokens needed for that access, encrypted at rest, and the cTrader setup guide explains its scope and how to revoke it.

Verify the MT5 download#

The MT5 EA can place orders and modify positions, so check the bundle before installing it. PineHook publishes a SHA-256 checksum with each GitHub release; comparing it with the downloaded ZIP confirms that the files match the published checksum. Follow the download verification guide for the commands and the limits of that check.

For details about stored account and alert data, read the Privacy Policy.

Continue setup#

Choose MetaTrader 5 or cTrader, then use the command guide to build and test your alert.