Signal Authentication and Secret Key
The two per-license credential features: Signal Authentication, a per-license switch that requires a password on every webhook alert, and the Secret Key for authenticating the EA's WebSocket connection.
Overview#
PineHook provides two independent authentication layers that you can add to a license. The Secret Key controls whether the MT5 EA is allowed to connect at all; it functions as a login password for the connection. Signal Authentication is a separate per-license switch: when it is turned on, every incoming webhook alert for that license must carry a matching password before it is executed. Both are optional. Both are configured independently per license. People sometimes confuse them because both involve passwords associated with a license, but they protect entirely different layers of the system.
Quick Reference: Secret Key vs Signal Authentication#
| Secret Key | Signal Authentication | |
|---|---|---|
| Protects | The EA's WebSocket connection to the relay | Every incoming webhook signal for the license |
| Who provides it | The EA, during initial connection | TradingView, inside each alert payload |
| Configured in | Dashboard → Licenses → license card menu → Set Secret Key | Dashboard → Licenses → license card menu → Signal Authentication |
| Required? | No, optional extra credential | No, optional per-license toggle |
| Effect when wrong | EA cannot connect; connection is rejected | Signal is blocked; the trade does not execute |
| Visible in errors | MetaTrader Experts tab | TradingView alert execution status + the Rejected panel on the Signal Logs page |
Secret Key#
What it does#
When a Secret Key is set on a license, every EA connection attempt for that license must present the key as part of the authentication handshake. If the key is absent or wrong, the connection is refused. The EA never receives signals or executes trades until it authenticates successfully.
This is useful when a license key might be shared or visible in a script. The Secret Key acts as a second credential that must also be correct before the connection is accepted.
Setting up the Secret Key#
- In the dashboard, open Licenses.
- On the license card, open the three-dot menu and click Set Secret Key.
- The plaintext key is displayed exactly once. Copy it immediately and store it securely. The platform does not retain the readable form.
Note: Generating a new key immediately invalidates the previous one for any future connection. An EA that is already connected keeps its current session; the new key is enforced only the next time it reconnects.
Configuring the EA#
In MetaTrader 5, open the EA's input parameters and paste the copied key into the Secret Key field (InpSecretKey). The EA sends this value automatically during connection. The field is optional; leaving it blank means no secret key is required for that EA.
Removing the Secret Key#
Open the three-dot menu on the license card and click Remove Secret Key. This option only appears when a secret key is set. A confirmation dialog explains that any currently connected EA will be disconnected at its next validation cycle. After removal, EAs can connect using only the license key again.
Lost key#
The platform never stores the plaintext value after generation. If you lose the key before configuring the EA, the only recovery path is to generate a new one. The old key is then invalid.
Signal Authentication#
What it does#
Signal Authentication is a per-license on/off switch with a single password. When it is turned on, every webhook alert for that license must include auth=PASSWORD in the payload, with no exceptions. This applies to all commands equally. If the parameter is missing, the signal is blocked with the reason missing_auth. If the parameter is present but the password does not match, the signal is blocked with the reason invalid_auth. In either case the signal is stopped before it reaches the EA and no trade is executed.
When the switch is turned off, no alert needs the password. If an auth parameter is present anyway, it is parsed and then ignored. The password is always scrubbed from stored signals, whether the switch is on or off.
Enabling Signal Authentication#
- In the dashboard, open Licenses.
- On the license card, open the three-dot menu and click Signal Authentication.
- Toggle the feature on.
- Enter a password (between 8 and 72 characters, case-sensitive). Enabling the feature requires setting a password.
- Save. The change takes effect immediately for subsequent webhook calls.
Note: Disabling Signal Authentication or changing the password takes effect on the next webhook received. In rare cases the change can take a moment to fully apply; if a signal still seems to use the old setting, resend it.
Password rules#
- Minimum 8 characters, maximum 72 characters.
- Case-sensitive.
- The password is never stored in readable form; only a one-way hash is kept.
- The password is never logged or persisted in the signal record. It is scrubbed from all stored data immediately after verification.
Including the password in TradingView alerts#
The password is passed as the auth parameter in the alert payload.
CSV format:
LICENSE,buy,EURUSD,sl_pips=50,tp_pips=100,auth=MyPassword123
JSON format:
{"license":"LICENSE","action":"buy","symbol":"EURUSD","sl_pips":50,"tp_pips":100,"auth":"MyPassword123"}
The auth parameter can appear anywhere in the payload; position is not significant. When Signal Authentication is enabled, every alert for that license must include auth, regardless of which command it carries. When it is disabled, no alert needs auth.
Note: The password travels inside the alert body. PineHook enforces HTTPS on all webhook endpoints, so the payload is encrypted in transit. Do not embed the password in a URL query string or any path that might be logged by third-party services.
Error Messages and Meanings#
Messages fall into two groups based on where you encounter them.
Group A: Signal Authentication blocks are returned by the platform when the webhook is processed, before any trade reaches the EA. They surface in two places: the HTTP response body returned to the TradingView alert execution call, and as a row in your dashboard at the Rejected panel on the Signal Logs page. The Rejected Signals row carries the timestamp, license, command, symbol, and the verbatim block reason. This panel is the primary self-service surface for diagnosing auth failures.
Caveat: A Rejected Signals row is only created when the platform can successfully resolve a license from the payload. If the license key in the alert is itself invalid or absent, the signal is rejected at the license-validation stage; no Rejected Signals row is created and only the TradingView alert execution response carries the error.
Group B: Secret Key connection failures occur during the EA's initial WebSocket handshake. They surface in the MetaTrader Experts tab as a formatted connection rejection message.
| Group | Message | Cause | What You Should Do |
|---|---|---|---|
| A | "Authentication required" | Signal Authentication is enabled and a signal arrived without the auth parameter (reason missing_auth). | Add auth=PASSWORD to the alert payload for that license. |
| A | "Invalid authentication" | The auth parameter was present but the password did not match, or the password exceeded the 72-character limit (reason invalid_auth). | Verify the password in the Signal Auth dashboard tab. Check for extra spaces, incorrect case, or truncation in TradingView's alert message editor. |
| A | "Authentication verification error" | An internal verification error occurred. This is rare and indicates a configuration problem on the account. | Contact support. The event is automatically flagged in the platform's internal monitoring for investigation. |
| B | "Secret key required for this license" | The EA connected without providing a Secret Key, but one is required for that license. | Add the Secret Key to the EA's input parameter (InpSecretKey) and reconnect. |
| B | "Invalid secret key" | The EA presented a Secret Key that did not match the stored credential. | Confirm the correct key in the dashboard. If it cannot be retrieved, generate a new one, then update the EA's input parameter. |
Where to look#
| If you see a message from... | Look in | What to check |
|---|---|---|
| Group A (signal auth block) | the Rejected panel on the Signal Logs page in the dashboard. The row shows timestamp, command, symbol, and the verbatim reason. TradingView's alert execution status also shows the same message. | Filter by the affected license. Confirm whether the auth parameter is present in the alert template. |
| Group B (secret key rejection) | The Experts tab in MetaTrader, where the connection rejection appears as a formatted message. | Confirm the InpSecretKey input in the EA matches what was generated in the dashboard. |
Plan and Tier Differences#
Both Signal Authentication and the Secret Key are available on all subscription tiers, including during the trial period. There are no tier-specific limits or gating for either feature.
| Feature | Trial | Standard | Pro | Premium |
|---|---|---|---|---|
| Signal Authentication | Available | Available | Available | Available |
| Secret Key | Available | Available | Available | Available |
When a subscription lapses, signal delivery stops entirely. Signal Authentication blocks and Secret Key rejections will not be the relevant issue in that case. The license-level EA connection may enter limited mode (close-only), which is separate from the credential features.
Known Edge Cases and Gotchas#
- Generating a new Secret Key immediately invalidates the previous one for new connections. A currently-connected EA is not actively kicked; its old key is only rejected on its next reconnect.
- The
authparameter is position-independent in both CSV and JSON formats. It does not need to be the last parameter and does not affect signal parsing order. - Signal Authentication is configured per license. If you have multiple licenses you must configure Signal Auth separately on each one.
- When Signal Authentication is enabled, EA-control alerts such as
eaonandeaoff, including emergency trading-off commands, also require theauthparameter, exactly like any other command. A common failure mode is omitting the password under pressure on an emergency alert: the alert is blocked like any other. Keepauth=PASSWORDin every alert template for the license. - TradingView's alert message editor can silently truncate or escape certain characters. If a password with special characters is not matching, test with a simple alphanumeric password to rule out TradingView-side handling as the cause.
- The
authparameter is only meaningful to the platform. If Signal Auth is disabled, including anauthparameter in the payload is harmless; the parameter is parsed and then ignored.
Frequently Asked Questions#
Q: Can I use both Signal Authentication and a Secret Key at the same time? A: Yes. They are independent. The Secret Key authenticates the EA connection. Signal Authentication adds a password check on every signal on top of that, after the connection is established.
Q: If I have Signal Auth enabled and the EA is disconnected, what happens to my signals? A: The signal reaches the platform's webhook and is checked against the auth configuration there. If the password is correct, the signal is queued for delivery when the EA reconnects. If the password is wrong or missing, the signal is blocked regardless of EA connection state.
Q: I regenerated my Secret Key. How quickly will my running EA be disconnected? A: A rotated secret takes effect for any new or reconnecting EA within seconds (at most about 60s via cache TTL). It does NOT actively disconnect an EA that already has a live connection; that session is not re-checked against the new secret. The old key is only rejected when the EA next reconnects (for example after a network drop, EA restart, or relay restart). If you need to force a compromised connection off immediately, restart the EA or disconnect it manually. The EA will then attempt to reconnect. If the old key is still configured, the reconnect will be rejected.
Q: Can I see which command triggered a Signal Auth block? A: Yes. The Rejected panel on the Signal Logs page shows the command and symbol for each blocked signal alongside the block reason. You can filter by license and time range.
Q: Does the Secret Key need to be changed periodically? A: There is no mandatory rotation schedule. You can regenerate it at any time if you believe it has been exposed. After regeneration, any EA that does not have the new key will be rejected on its next connection attempt.
Q: Does Signal Authentication apply to every command, or can I protect only some of them? A: It applies to every command. Signal Authentication is a single on/off switch for the whole license. When it is on, every webhook alert must include the password, regardless of which command it carries. There is no per-command selection.
Q: What happens if I enable Signal Auth but forget to update my TradingView alerts?
A: Every signal for that license will be blocked with "Authentication required" until the alert templates are updated to include auth=PASSWORD. There is no exception; while the switch is on, an alert without the password does not execute.
Q: Can two different licenses share the same Signal Auth password? A: Passwords are configured independently per license and are not shared. Two licenses can happen to use the same password string, but they are stored and verified independently.