Webhooks: live events from your accounts and copiers

Live events on your own server

Instead of asking again and again, let TPcopier tell you: a signed POST to your address the moment something happens on your cloud MT4/MT5 accounts and copiers - within about five seconds, as our cloud server reports - and for every message a binary channel sends.

# switch it on: your address, and a secret only you and TPcopier know
curl -X PATCH -H "Authorization: Bearer $TPC_KEY" -H "Content-Type: application/json" \
     -d '{"webhook_enabled":"1","webhook_url":"https://your-site.com/tpcopier-hook","webhook_secret":"a-long-random-secret"}' \
     https://tpcopier.com/api/v1/settings

The events

{"app":"tpcopier","event":"position.opened","ts":"2026-10-12T09:41:07+00:00","tenant_id":42,"account_id":118,
 "position":{"ticket":51234567,"symbol":"XAUUSD","side":"buy","volume":0.1,"open_price":2318.45,"current_price":2318.6,
             "sl":2310.0,"tp":2335.0,"profit":1.5,"open_time":"2026-10-12T09:41:03+00:00"}}

Check that it is TPcopier

Each request carries X-AlgoDev-Timestamp (Unix seconds) and X-AlgoDev-Signature: the hex HMAC-SHA256 of the timestamp, a dot and the raw body, keyed with your secret. Refuse a wrong signature, and a timestamp more than five minutes old.

# Python
import hashlib, hmac, time
def is_tpcopier(secret: str, ts: str, body: bytes, sig: str) -> bool:
    want = hmac.new(secret.encode(), ts.encode() + b"." + body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(want, sig) and abs(time.time() - int(ts)) < 300

// Node.js
const crypto = require('crypto');
function isTpcopier(secret, ts, rawBody, sig) {
  const want = crypto.createHmac('sha256', secret).update(ts + '.').update(rawBody).digest('hex');
  return want.length === sig.length && crypto.timingSafeEqual(Buffer.from(want), Buffer.from(sig)) &&
         Math.abs(Date.now() / 1000 - Number(ts)) < 300;
}

Answer with any 2xx within 8 seconds. One that fails is tried twice more (after 1 and 2 seconds); events are never held back for a slow server - read GET /api/v1/hosting or GET /api/v1/hosting/copier/events to catch up.

Further reading: RFC 2104, the HMAC standard behind signed webhooks.

Endpoints in this guide

Base address https://tpcopier.com. Send your key with every request - Authorization: Bearer tpc_... - up to 120 requests a minute. Open an endpoint for its fields, its answers and an example.

curl -H "Authorization: Bearer $TPC_KEY" \
     "https://tpcopier.com/api/v1/settings"

{}

curl -X PATCH -H "Authorization: Bearer $TPC_KEY" -H "Content-Type: application/json" \
     -d '{}' \
     "https://tpcopier.com/api/v1/settings"