Universal Token Architecture, Webhooks & Custom Ingestion

Webhooks provide the event-driven ingestion layer connecting desktop terminals, cloud strategies, and algorithmic bots directly to the ILoveTrading journal. This document details cryptographic token authentication, payload schemas, and custom API integration protocols.

1. Security Architecture & Cryptographic Isolation

To protect user credentials, ILoveTrading enforces stateless token authentication rather than storing broker passwords. Each Universal Token acts as a private, scoped ingestion key:

Account Isolation: Each trading account profile maintains a distinct token. Executions pushed via Account A's token are strictly isolated from Account B, preventing evaluation and live broker record contamination.
Non-Interactive Authentication: Terminals and automated scripts authenticate outgoing HTTPS requests without interactive session cookies.
Instant Revocation: If a token is compromised, regenerating it instantly invalidates the prior token, immediately returning 401 Unauthorized on subsequent unauthorized transmissions.

Formula / Calculation
Security Verification = HMAC-SHA256(Payload, Universal Token)

2. Generating & Managing Universal Tokens

Tokens can be generated and managed directly from the dashboard:

Via Integrations Menu: Navigate to Integrations in the main sidebar. Click Generate Token to create your primary integration key.
Via Accounts Settings: Open Settings > Accounts. Each listed trading account displays its dedicated Universal Token with masking controls and one-click clipboard copying.
Token Regeneration: Clicking Regenerate updates the secret key in the database immediately.

Warning

[!WARNING] Regenerating a token instantly disconnects any active MetaTrader EA, cTrader cBot, or NinjaTrader Add-on using the previous key. You must update the token input in your terminal to resume synchronization.

3. Supported Ingestion Protocols

ILoveTrading supports two primary webhook formats:

Format A: TradingView Alert Syntax (PineConnector Compatible)

For traders using TradingView alerts, indicators, or PineScript strategies, send a raw comma-separated payload:

Endpoint: POST https://ilove.trading/api/webhook
Content-Type: text/plain or application/json

<YOUR_UNIVERSAL_TOKEN>,buy,EURUSD,risk=1,sl=1.0850,tp=1.0950

Parameter	Type	Required	Description
`token`	String	Yes	Your unique Universal Token.
`action`	String	Yes	`buy`, `sell`, `closelong`, `closeshort`, or `closepart`.
`symbol`	String	Yes	Instrument symbol (e.g., `EURUSD`, `NQ1!`, `BTCUSD`).
`risk`	Float	Optional	Risk percentage per trade (e.g., `1` for 1%).
`sl`	Float	Optional	Exact price level for initial Stop Loss.
`tp`	Float	Optional	Exact price level for initial Take Profit.

Format B: Programmatic REST JSON Ingestion

For custom Python bots, cURL scripts, or proprietary execution systems:

Endpoint: POST https://ilove.trading/api/webhooks/trade
Headers:
- Content-Type: application/json
- Authorization: Bearer <YOUR_UNIVERSAL_TOKEN>

{
  "ticket": "98765432",
  "symbol": "EURUSD",
  "type": "BUY",
  "lots": 2.0,
  "open_price": 1.08500,
  "close_price": 1.09250,
  "stop_loss": 1.08100,
  "take_profit": 1.09500,
  "open_time": "2026-08-27T10:15:00Z",
  "close_time": "2026-08-27T11:45:00Z",
  "commission": -7.00,
  "swap": -0.80,
  "profit": 1500.00
}

4. Best Practices & Timestamp Integrity

Tip

[!TIP] ISO 8601 UTC Timestamps: When submitting custom JSON payloads, strictly format open and close timestamps in UTC (YYYY-MM-DDTHH:mm:ssZ). Timestamps with missing timezone offsets will distort session analytics and hourly distribution metrics.

Important

[!IMPORTANT] Idempotency & Ticket Uniqueness: Ensure each trade maintains a unique ticket ID. Re-submitting an existing ticket ID will update rather than duplicate the existing trade record.

ILoveTrading Documentation