Short answer: TradingView webhook alerts need two-factor authentication, send an HTTP POST only to ports 80 and 443, cancel requests that take longer than three seconds, do not support IPv6, and should never carry credentials in the body. Design the receiver to acknowledge immediately, verify the sender and process the order asynchronously.
Hard limits to design around
Webhooks are only allowed when two-factor authentication is enabled, requests go only to ports 80 and 443, IPv6 is not supported, and a request is cancelled if your server takes more than three seconds to respond. Delivery can occasionally fail, and the alert log has a webhook status column you can check.
These limits shape the architecture: a public HTTPS endpoint, a fast acknowledgement and no long work inside the request handler.
Payload format
TradingView sends the alert message as the request body. If the message is valid JSON it is sent with an application/json content type, otherwise as text/plain. Decide on a fixed JSON schema for your alerts and validate it strictly on the receiver, rejecting anything that does not match.
Plain text is the default, so a typo in the message template can silently change the content type your receiver sees.
Security checklist
Do not put credentials in the alert body. Use an authenticated endpoint, for example a long random path or a shared secret that is checked on the server, and consider allowlisting the sending addresses TradingView publishes. Log every request, make order handling idempotent so a duplicate alert cannot open a second position, and add a kill switch on the server.
Treat every alert as untrusted input until it passes validation.