Signal Authentication and Secret Key
Two per-license credentials. The Secret Key decides whether your MT5 EA may connect, and Signal Authentication requires a password on every webhook alert.
Last updated: 2026-10-08
PineHook offers two optional passwords for each license, and they protect different things. The Secret Key decides whether an MT5 EA may connect to your license at all, while Signal Authentication makes every alert for the license carry a password before PineHook acts on it. You can use either one, or both together.
| Secret Key | Signal Authentication | |
|---|---|---|
| Protects | The EA's connection to PineHook, on MT5 | Every alert sent to the license |
| Sent by | The EA, when it connects | TradingView, inside each alert |
| Set up in | Licenses, license menu, Set Secret Key | Licenses, license menu, Signal Authentication |
| When it's wrong | The EA can't connect | The alert is blocked and nothing trades |
Signal Authentication#
Signal Authentication is a single switch for each license. While it's on, every alert for that license must include auth= with the password, whatever the command, so closes, cancels and emergency eaoff alerts need it too. While it's off, PineHook ignores any auth= value, and it removes the password from saved alerts either way.
To turn it on, open the license menu on the Licenses page, choose Signal Authentication, switch it on and set a password of 8 to 72 characters. The password is case-sensitive, PineHook stores only a one-way hash of it, and the change applies to the next alert that arrives.
LICENSE,buy,EURUSD,size_lots=0.1,sl_pips=50,tp_pips=100,auth=MyPassword123
{"license":"LICENSE","action":"buy","symbol":"EURUSD","size_lots":0.1,"sl_pips":50,"tp_pips":100,"auth":"MyPassword123"}
auth= can go anywhere among the parameters. Alerts travel to PineHook over HTTPS, which encrypts the password on the way, but keep it out of URLs and anywhere else that might be logged.
When an alert is blocked, TradingView still shows it as delivered, since PineHook answers with a normal response. Signal Logs shows the block, with Authentication required when auth= is missing and Invalid authentication when the password doesn't match. A correct password on an alert that arrives while the EA is offline is accepted, and the alert waits for the EA like any other.
Update every alert before you switch it on
Once Signal Authentication is on, every alert without the password is blocked, including the emergency alerts you might need in a hurry. Add auth= to all of the license's alert messages first, and keep it in each one.
Secret Key#
A Secret Key is a second credential for the EA's connection, which helps when your license key might be visible to others, for example inside a shared script. Once a key is set, an EA that connects without it, or with the wrong one, is refused and never receives alerts.
- On the Licenses page, open the license menu and choose Set Secret Key.
- Copy the key. PineHook shows it only once and doesn't keep a readable copy.
- In MetaTrader, paste it into the EA's Secret Key input and reconnect.
If you lose the key, generate a new one, since the old one can't be recovered. A new key stops the old one from being used for new connections within about a minute, but an EA that's already connected keeps running until it reconnects, so restart the EA if you need to cut off a compromised connection straight away. To go back to connecting with the license key alone, choose Remove Secret Key from the same menu.
When the key is missing or wrong, the MetaTrader Experts tab shows Secret key required for this license or Invalid secret key. cTrader licenses connect through your cTrader account instead, so the Secret Key doesn't apply to them.
Good to know#
- Each license has its own settings. With several licenses, set up Signal Authentication and the Secret Key on each one separately.
- Special characters can break a password in transit. If a password with symbols keeps failing, try a plain letters-and-numbers password to rule out TradingView's message editor changing it.
- Both features work on every plan, including Trial.
Alert error messages lists the authentication messages and what to do about each one.