API Authentication

Learn about TradeStaq's authentication methods for API access and webhook security.

Authentication Methods

TradeStaq uses different authentication methods depending on the API type:

Bearer JWT Authentication

For programmatic access from MCP clients, CLI tools, or custom SDK integrations, TradeStaq supports standard Bearer token authentication using JWTs.

How It Works

Include your JWT in the Authorization header of every API request:

Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...

Obtaining a JWT

JWT Properties

Example Request

curl -X GET https://www.tradestaq.com/api/user/portfolio \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIs..."

When to Use Bearer JWT

• MCP server — the MCP server stores and sends the JWT automatically after login
• Custom scripts — any HTTP client that needs to call TradeStaq APIs
• CI/CD pipelines — automated trading or monitoring workflows

For more on MCP authentication, see the MCP Authentication guide.

Webhook Authentication

URL-Based Tokens

Webhook URLs contain an embedded authentication token:

https://www.tradestaq.com/api/webhooks/trade/{webhookId}
                                          ↑
                                     This IS your token

Security Model

Webhook ID Properties

• Unique per bot - Each Signal Bot has its own webhook ID
• Non-guessable - Randomly generated, not sequential
• Revocable - Can be regenerated at any time
• Scoped - Only works for the associated bot

Protecting Your Webhook

Keep It Secret

Your webhook URL is essentially a password. Anyone with the URL can:

• Send trading signals to your bot
• Trigger trades on your exchange
• Potentially drain your account

Never share:

• In public forums
• In screenshots
• In public code repositories
• With untrusted parties

Regenerating Webhook ID

If your webhook URL is compromised:

1. Go to Signal Bots
2. Select the affected bot
3. Click Settings → Webhook
4. Click Regenerate Webhook
5. Update the URL in TradingView/scripts
6. Old URL immediately stops working

IP Restrictions (Future)

Coming Soon: Ability to whitelist IP addresses for webhook access.

Session Authentication

How Sessions Work

The dashboard uses secure session-based authentication:

┌──────────┐   Login    ┌──────────┐   Cookie    ┌──────────┐
│  User    │───────────▶│  Server  │────────────▶│  Browser │
│          │◀───────────│          │◀────────────│          │
└──────────┘   Session  └──────────┘   Requests  └──────────┘

Session Properties

Session Management

Exchange API Keys

Your Exchange Credentials

When connecting exchanges, you provide API credentials:

Encryption

Exchange credentials are protected with:

• AES-256 encryption at rest
• TLS 1.3 in transit
• Hardware Security Module for key management
• Zero-knowledge design (we can't see your keys)

Recommended API Permissions

Only enable what's needed:

Important: Never enable withdrawal permissions. TradeStaq never needs them.

IP Whitelisting

For maximum security, whitelist TradeStaq's IP addresses on your exchange:

Contact support for current IP addresses to whitelist.

Security Best Practices

For Webhooks

For Exchange Keys

For Your Account

Error Responses

Authentication Errors

Example Error Response

{
  "success": false,
  "error": "Invalid webhook ID",
  "code": "INVALID_WEBHOOK",
  "timestamp": 1704067200000
}

Troubleshooting

"Invalid Webhook ID"

Causes:

• Typo in webhook URL
• Webhook was regenerated
• Bot was deleted

Solution:

1. Verify URL in bot settings
2. Copy URL fresh from dashboard
3. Update in TradingView/scripts

"Bot Paused"

Causes:

• Manually paused bot
• Auto-paused due to errors
• Subscription downgrade

Solution:

1. Check bot status in dashboard
2. Resume if manually paused
3. Check subscription status

"Exchange Disconnected"

Causes:

• API key expired
• API key deleted on exchange
• Exchange maintenance

Solution:

1. Verify exchange status in dashboard
2. Reconnect exchange if needed
3. Check exchange status page

Next Steps

• Webhook API - Complete webhook reference
• Rate Limits - API rate limits
• Exchange API Permissions - Permission guide