Webhook delivery (Pro plan)

From /app/settings → Delivery → Webhook → enter your endpoint URL. Botely generates a shared secret (32 random bytes) and displays it ONCE — save it.

Test from the same screen with a 'Send test ping'. Your endpoint should return 2xx within 5 seconds.

POST with Content-Type: application/json. Headers: `X-Botely-Signature: sha256=<hex>` (HMAC of the raw body, using your shared secret), `X-Botely-Event: signal.open` or `signal.close`, `X-Botely-Delivery: <uuid>` (idempotency key).

Body example: `{ "signal_id": "sig_abc123", "strategy": "v6.4", "event": "open", "coin": "ETH", "direction": "long", "entry_price": 3420.5, "tp_price": 4172.91, "sl_price": 3078.45, "max_hold_minutes": 8640, "signal_timestamp": "2026-05-16T11:23:01Z", "delivered_timestamp": "2026-05-16T11:23:01Z" }`.

```js import crypto from 'node:crypto'; function verify(rawBody, signatureHeader, secret) { const expected = crypto.createHmac('sha256', secret).update(rawBody).digest('hex'); const provided = signatureHeader.replace(/^sha256=/, ''); return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(provided)); } ```

Compute over the RAW request body bytes, not the parsed JSON object. Use a timing-safe comparison.

If your endpoint returns non-2xx, Botely retries with exponential backoff: 1s, 5s, 30s, 5m, 30m. After 5 failed attempts the delivery is marked failed and surfaces in /app/settings → Delivery → Webhook log.

Use the `X-Botely-Delivery` UUID as an idempotency key — store seen IDs server-side and ignore duplicates.

Auto-execute trades via your own dYdX bot: receive the signal, validate signature, place the matching order. Mind the rate limits.

Forward to internal Slack / Discord: receive the signal, format it, post to your team channel.

Persist for analytics: write to a time-series DB to track delivery latency and your own slippage vs the signal's entry price.