One webhook endpoint, any signal source
AeronPilot exposes a personal webhook URL per account route. Post a small JSON payload — action, symbol, volume, optional SL/TP — and the platform validates it, applies your protections, and executes on MetaTrader 5 or cTrader.
The payload format is deliberately simple and PineConnector-style syntax is also accepted, so migrating an existing setup usually means changing one URL.
- TradingView: paste the generated message into any alert.
- Custom code: send the JSON from Python, Node.js, Google Sheets scripts, Zapier-style tools — anything with HTTP.
- Signal services: give each strategy its own route key and track it separately.
Built for real money, not just demos
- Authentication: every request carries your license key, route key and secret; HMAC signatures are supported.
- Idempotent delivery: duplicated or replayed alerts are deduplicated, and stale orders (delivered after a connection cut) are expired instead of executed late.
- Risk firewall: lot caps, daily loss and drawdown limits, news filter, spread and slippage guards run before any order reaches your broker.
- Full diagnostics: each signal shows its parse result, every guard decision and the broker fill, with per-leg latency.
Multi-account routing
A route can target one account or several: send one signal and execute it on N accounts (copy-trading style), or keep strategies isolated per account. Symbol mapping translates your canonical symbols to each broker's naming (see why broker suffixes break alerts).
Frequently asked questions
What does the webhook payload look like?
A minimal JSON object with action (buy, sell, close), symbol, volume and your identifiers, plus optional SL/TP in ticks. A legacy comma-separated format compatible with PineConnector-style messages is also accepted.
Can I send orders from my own script or app?
Yes. Any language or tool that can make an HTTPS POST request can trade through your webhook: Python, Node.js, cURL, no-code automation tools, and so on.
How are my webhooks secured?
Each route has its own key and secret, requests can be HMAC-signed, and routes only execute on the accounts you explicitly assign. Every request is logged.
What happens if the same alert is delivered twice?
Signals carry an idempotency ID and the execution layer deduplicates by command, so a retried webhook does not open a duplicate position.
