Skip to main content

Webhook & Settings

The Webhook & Settings tab in XeroLite contains all configuration options for webhook security, order management, and IP access control. This is where you configure how XeroLite receives and processes alerts.

Overview​

The Webhook & Settings tab contains three main sections:

  1. Webhook URL - Your webhook endpoint for receiving TradingView alerts
  2. Settings - Order management configuration
  3. IP Whitelist - Security configuration for allowed IP addresses

Accessing Webhook & Settings​

  1. Log in to XeroLite
  2. Click on the "Webhook & Settings" tab (last tab with link icon)
  3. All configuration options are displayed in this tab

1. Webhook URL​

The Webhook URL is the endpoint that TradingView uses to send alerts to XeroLite.

Viewing Your Webhook URL​

Your webhook URL is displayed in the format:

https://<your-ip-address>/api/order/place-order?x-api-key=<your-api-key>

Copying Your Webhook URL​

  1. Click the "Copy" button next to the webhook URL
  2. The URL is copied to your clipboard
  3. Paste it into TradingView alert configuration

Regenerating API Key​

If you need to regenerate your API key for security:

  1. Click the "Regenerate" button
  2. Confirm in the modal dialog
  3. Important: After regenerating, you must:
    • Update the webhook URL in ALL your TradingView alerts
    • The old API key will no longer work
    • This action cannot be undone

⚠️ Warning: Regenerating your API key will invalidate all existing TradingView alerts using the old URL. You must update all alerts with the new URL.

Security Best Practices​

  • ✅ Keep API Key Secure: Never share your API key publicly
  • ✅ Regenerate Periodically: Consider regenerating every 3-6 months
  • ✅ Use HTTPS: Ensure your XeroLite server uses HTTPS for secure communication
  • ✅ Monitor Access: Regularly check Incoming Alerts for unauthorized access attempts

For more details, see the Webhook URL section above or Webhook URL for a dedicated guide.

2. Settings​

Cancel Pending Orders​

This setting controls automatic cancellation of pending orders when a new order with the same alert name is received.

What It Does​

When enabled:

  • Before placing a new order, XeroLite automatically cancels any existing pending orders that have the same alert name
  • This prevents duplicate orders and keeps your order list clean
  • Only the most recent pending order remains active

When disabled:

  • New orders are placed without cancelling existing pending orders
  • Multiple pending orders with the same alert name can exist simultaneously

When to Enable​

Enable this setting when:

  • ✅ You want to prevent duplicate orders
  • ✅ Your strategy sends multiple alerts with the same name
  • ✅ You want to ensure only the latest order is active
  • ✅ You're using strategies that update positions frequently

When to Disable​

Disable this setting when:

  • ❌ You want multiple pending orders with the same alert name
  • ❌ You're managing orders manually
  • ❌ Your strategy requires multiple simultaneous pending orders

How It Works​

Example Scenario:

  1. Alert "AAPL_LONG" places a LIMIT BUY order at $150.00 (pending)
  2. New alert "AAPL_LONG" arrives with LIMIT BUY at $148.00
  3. If enabled: The $150.00 order is cancelled, and the $148.00 order is placed
  4. If disabled: Both orders remain pending

Configuration​

  1. Navigate to Webhook & Settings tab
  2. Find "Cancel Pending Orders" section
  3. Toggle between "Enabled" and "Disabled"
  4. Setting is saved automatically

3. IP Whitelist​

IP whitelisting restricts access to your XeroLite webhook to specific IP addresses for security.

Default Whitelist​

By default, XeroLite includes TradingView's IP addresses in the whitelist. These are marked as "System" entries and cannot be deleted.

Adding IP Addresses​

To allow access from additional sources:

  1. Click "+ Add IP" button
  2. Enter IP Address: The IP address to whitelist
  3. Enter Label: A descriptive label (e.g., "Home", "Office", "Server")
  4. Click "Add IP"
  5. The IP address is added to the whitelist

Removing IP Addresses​

To remove a custom IP address:

  1. Click the Delete button (trash icon) next to the IP address
  2. Confirm deletion
  3. The IP address is removed from the whitelist

⚠️ Note: System IP addresses (TradingView) cannot be deleted.

Unauthorized Access​

If an alert is sent from an IP address that is not whitelisted:

  • The alert will appear in Incoming Alerts with "Unauthorized" status
  • The alert will NOT be processed
  • No order will be placed

For more details, see the IP Whitelist section above or IP Whitelisting for a dedicated guide.

Need Help?​

If you encounter issues with webhook or settings: