Skip to content
Nyria

Guide / Checked Nov 2026

How do I keep a trading webhook URL secure?

Treat the webhook URL like an API key. The 64-character token at its end is the endpoint's only authentication. There is no signature header and no IP allowlist. Anyone who has it can send alerts to that one strategy. Keep it out of chats, screenshots, repositories and shared configs. If it leaks, select Rotate token on the strategy's Integration tab. The old URL stops working immediately, so paste the new one into every alert source that used it.

Start free

Official documentation

Keep the URL private

  1. 1

    Copy it with the button

    On the strategy's Integration tab, select Show URL and use the copy button. One URL per strategy, each with its own token.

  2. 2

    Paste it only where it posts

    The TradingView alert's Webhook URL field, your own sender, or an MCP client. Never a share link, a chat or a screenshot.

  3. 3

    Keep it out of code

    Read the token from an environment variable, as Cursor's mcp.json does with ${env:NYRIA_MCP_TOKEN}. Don't commit it.

  4. 4

    Prefer the header where you can

    The REST API and MCP take the token as Authorization: Bearer YOUR_TOKEN. The REST API never takes it in the URL.

  5. 5

    Rotate on any doubt

    Select Rotate token and confirm. The old URL and the old MCP connection stop at once. Update every alert source that used them.

  6. 6

    Know what a token reaches

    A token reaches one strategy only. Nyria can place and cancel orders, but it can't move money.

Header forms to copy

REST, token in the header

curl https://api.nyria.io/v1/positions \
  -H "Authorization: Bearer YOUR_TOKEN"

Cursor mcp.json, token from the environment

{
  "mcpServers": {
    "nyria": {
      "url": "https://api.nyria.io/mcp",
      "headers": {
        "Authorization": "Bearer ${env:NYRIA_MCP_TOKEN}"
      }
    }
  }
}

What a token can do

  • It sends alerts to one strategy and reads that strategy's bots, orders and positions.
  • It can't connect a broker or change the strategy.
  • Nyria itself can place and cancel orders, never withdraw or move money.
  • Account numbers show the last 4 digits only.
  • Every alert it sends is on the strategy's Logs tab, so a stray send is visible.

What a leak looks like

  • Alerts on the Logs tab you didn't send.
  • A 404 in TradingView's alert log after a rotation means an alert still has the old URL.
  • The public share URL at app.nyria.io/share is not the webhook. Webhook alerts post to trades.nyria.io/webhooks/{token}.

Questions

Is there a passphrase or secret field for a Nyria webhook?
No. The token in the URL is the only authentication. There is no signature header and no IP allowlist, so keep the URL private.
My TradingView webhook URL leaked. What do I do?
Select Rotate token on the strategy's Integration tab. The old URL stops working at once. Paste the new URL into every TradingView alert that used it.
What can someone do with a leaked URL?
They can send alerts to that one strategy, and your bots will place those orders. Nyria can't withdraw or move money. Rotate the token at once.
Does Nyria store my broker password?
No. Brokers connect by OAuth or an API key, and tokens and keys are encrypted at rest with AES-256-GCM.
What does it cost?
Paper is free. Live trading from $15 a month.
All questions

Next

Guides

What is a webhook in trading?

A URL a program posts to. A TradingView example, what the message needs and why the URL is secret.

TradingView webhook IP addresses

The four addresses TradingView lists for webhooks, the port and timeout limits, and when an allowlist matters.

How do I connect Cursor to Nyria through MCP?

An mcp.json entry with the endpoint and your strategy's token as a Bearer header.

How do I test a trading webhook with curl?

One curl POST on Nyria Paper. Read the reply, then the Logs tab.

How do I send trade alerts from my own code with a REST API?

POST /v1/alerts with a Bearer token. The reply carries an order_id you can poll.

Try a paper bot first

No card required. Paper is free. Live trading from $15 a month.

Start free