TradingView Webhooks and JSON: A Practical Guide

How TradingView webhook alerts send HTTP POST requests, how valid JSON changes the content type, and how to design a robust receiver.

Send valid JSON when you want JSON

TradingView sends the alert message in an HTTP POST. Its current documentation states that a valid JSON alert body is sent with application/json; otherwise it is sent as text/plain. That means malformed JSON can silently change how your backend sees the request.

{
  "event_id": "{{ticker}}-{{time}}-long",
  "symbol": "{{ticker}}",
  "action": "buy",
  "price": "{{close}}",
  "strategy": "breakout_v1",
  "token": "REPLACE_WITH_A_RANDOM_WEBHOOK_TOKEN"
}

Do not put broker usernames, passwords, API keys or session tokens in TradingView messages. The webhook should identify a signal; your backend should hold execution credentials.

Receiver design

async function parseWebhook(request, env) {
  if (request.method !== "POST") throw new Error("method");
  const data = await request.json();
  if (data.token !== env.WEBHOOK_TOKEN) throw new Error("auth");
  if (!data.event_id || !data.symbol || !data.action) throw new Error("schema");
  return data;
}

Validate types too. A field being present does not mean it is valid. Restrict actions to an allowlist such as buy, sell, close, and normalize symbols before they reach the broker adapter.

Return quickly

TradingView currently documents a three-second timeout for webhook requests and only accepts ports 80 and 443. A receiver should therefore authenticate, validate, enqueue or hand off the work, and return quickly. Heavy broker logic should not block the HTTP response if you can avoid it.

Security limitations

TradingView does not give you arbitrary custom HTTP headers in the alert UI, so many generic “put a secret in X-Webhook-Signature” examples do not directly apply. A high-entropy token in the JSON body is simple, but remember that bodies may appear in application logs. Treat it as a dedicated webhook secret, rotate it when needed, and never reuse a broker credential.

Debugging checklist

• Confirm the alert body is valid JSON.
• Log Content-Type, event ID and validation result.
• Check TradingView's webhook status in the alert log.
• Make sure the public endpoint uses HTTPS on port 443.
• Return a small 2xx response quickly.
• Keep a rejected-event log with a reason code.