TradeClick Partner API

The TradeClick Partner API lets broker partners record trading volume for spread-markup accounting. Each partner authenticates with a server-side API key, syncs the accounts they want tracked, reports executions as they happen (or in bulk), and submits a monthly volume report that TradeClick reconciles against.

Base URL for every endpoint below: https://tradeclick-api.onrender.com

If your platform is MT5, two separate things are in play with very different costs. This decides which of them you need to build.

A creator attaches TradeClick_Signal_EA.ex5 to any one chart in their own terminal. It reports every open position to TradeClick every ~2 seconds, and their trades broadcast to their community from there. It authenticates with a TradeClick-issued secret, so the creator never hands over broker credentials, and it is strictly read-only — it contains no order-placing code at all. Works on any MT5 broker, needs no approval or work from you.

Both give your traders full copy trading — the EA broadcasts signals either way, only the execution leg differs. The REST route is the same model as our production Verity Markets integration. Ask us for current MetaAPI pricing if you want to compare properly.

Everywhere else, placing an order is synchronous and verified in one operation: place, re-read the position from the broker, confirm the protective stop is actually attached, and close the position if it is not. We own that outcome start to finish.

An EA polls. Between "open this" and "here is what happened" sits a poll interval, a network round trip, and a terminal that may be closed, asleep or mid-restart. That gives three failures we will not accept on a funded account:

• We cannot verify a stop is attached. The confirmation is a report from a remote terminal, not a read we performed — and if it stops reporting we cannot tell "no stop" from "no answer".
• We cannot close what we cannot see. A terminal that drops after opening but before protecting leaves a position open, unprotected and invisible to us. Nothing exists to close it.
• The safety logic would run on a machine we do not control, shipped as a compiled binary — so fixing a bug means persuading every subscriber to re-download and re-attach it.

The EA's value is sourcing signals without credentials, and it is very good at that. Execution belongs server-to-server, where whoever places the trade can also guarantee it.

Authentication is key-exchange-for-session. You exchange your long-lived API key for a short-lived session token once, then use that token on every subsequent call:

1. POST /v1/b2b/auth with {"api_key":"tc_b2b_live_..."} returns a session_token valid for 15 minutes.
2. Every other endpoint takes Authorization: Bearer <session_token>.
3. When the token expires, call /v1/b2b/auth again to get a new one.

Each partner is limited to 120 requests per 60 seconds. Exceeding it returns:

HTTP/1.1 429 Too Many Requests
{
  "code": "rate_limited"
}

POST /v1/b2b/accounts/sync additionally accepts a maximum of 100 accounts per call — batch larger books across multiple calls.

markup_usd = markup_lots × markup_pips × pip_value

Markup rates and pip values are agreed per partnership contract. Contact us for your specific rate structure — the figures applied to your account are the ones in your agreement, and TradeClick computes markup_usd from them server-side on every report.

Pip value is per instrument class, not a single flat number: an FX major, a JPY pair, a metal and an index are each worth a different amount per standard lot. That is why a book weighted toward indices or metals settles differently from a flat FX-major calculation, and why the symbol_mix field below is worth sending.

Without a symbol_mix, the FX-major rate is applied to your whole reported figure, and the response's pip_value_basis field reads fx_major_default. Passing symbol_mix on /v1/b2b/volume/report computes a blended rate per instrument instead, and pip_value_basis reads symbol_mix.

Deep-link a signed-in trader from your platform straight into a signed-in TradeClick session. A visual walkthrough of this flow (plus a live embed preview) is on the Embed Demo page.

{
  "iss": "your-slug",
  "iat": 1234567890,
  "exp": 1234567890 + 120,
  "jti": "unique-uuid-per-assertion",
  "broker_account_id": "ACC123",
  "email": "trader@example.com",
  "balance": 5000,
  "currency": "USD",
  "return_url": "https://app.broker.com/trading"
}

import time
import uuid
import jwt  # pip install pyjwt

# 🔴 SSO_SECRET is a server-side credential — it must NEVER reach browser JS, a mobile
# app bundle, or a public repository. Keep it in your backend environment only.
SSO_SECRET = "your-sso-secret"  # issued once by TradeClick; never displayed again
PARTNER_SLUG = "your-slug"

def build_sso_url(trader_email, broker_account_id, balance, currency, return_url):
    now = int(time.time())
    assertion = {
        "iss": PARTNER_SLUG,
        "iat": now,
        "exp": now + 120,               # max 120s
        "jti": str(uuid.uuid4()),       # single-use
        "broker_account_id": broker_account_id,
        "email": trader_email,
        "balance": balance,
        "currency": currency,
        "return_url": return_url,       # must be under an allowlisted origin
    }
    token = jwt.encode(assertion, SSO_SECRET, algorithm="HS256")
    return f"https://tradeclick.io/v1/b2b/sso?token={token}"

{
  "ok": true,
  "sso_secret": "sso_5f3a9c2e1b7d4a8f9c0e2b1a...",
  "message": "Store this secret now — it will not be shown again."
}

Frame TradeClick's strategy marketplace directly inside your platform. See it live, with a copyable snippet, on the Embed Demo page.

{
  "ok": true,
  "broker": {
    "name": "Example Markets",
    "slug": "example-markets"
  },
  "embed_enabled": true,
  "allowed_pages": ["marketplace", "strategy", "creator", "help"],
  "allowed_origins": ["https://app.example-markets.com"]
}

<iframe
  src="https://tradeclick.io/embed?broker=YOUR_SLUG&page=marketplace"
  width="100%"
  height="600"
  loading="lazy"
  title="TradeClick"
></iframe>

Available pages: marketplace (strategy grid), strategy (one strategy — add &slug=), creator (one creator profile — add &username=), help (a compact FAQ, no auth). Only pages listed in your allowed_pages will render for you.

TradeClick can POST to your own endpoint whenever a copy trade fires on your side of the integration. This is informational — for your dashboard and reconciliation — not an order feed, and it carries no ordering guarantee between deliveries.

trade.open, trade.close, trade.modify, trade.partial_close, trade.filled — plus test.ping, sent from the TradeClick admin's "Send Test Webhook" button so you can verify your endpoint before going live.

A trade.open can describe a trade that ultimately fills nobody — margin, market hours and risk limits all reject after the signal is accepted. Reconcile executed volume against trade.filled.

trade.filled covers every execution path — TradingView signals, account-level copy trading and strategy copy alike — and you receive only the fills belonging to your own traders.

Existing integrations are unaffected. Every event is subscribed per partner and checked on each delivery, so a live integration keeps exactly the traffic it has today. New partners are subscribed to trade.filled from the start; if you are already integrated and want it, ask your TradeClick contact to add it — worth knowing before you do, it is materially more traffic than trade.open, since it is one delivery per subscriber fill rather than one per signal.

The X-TradeClick-Signature header has the format:

t=<unix_timestamp>,v1=<hex_hmac_sha256>

The MAC is computed over the string "<timestamp>.<raw_request_body>", keyed with your webhook signing secret (issued once by the TradeClick admin, alongside your API key).

import hashlib
import hmac
import time

from flask import Flask, request, abort

app = Flask(__name__)

# Issued once by the TradeClick admin alongside your API key — server-side only.
WEBHOOK_SECRET = "your-webhook-signing-secret"
MAX_TIMESTAMP_SKEW_S = 300  # ~5 minutes


def verify_signature(raw_body: bytes, signature_header: str) -> bool:
    try:
        parts = dict(p.split("=", 1) for p in signature_header.split(","))
        timestamp = parts["t"]
        signature = parts["v1"]
    except (KeyError, ValueError):
        return False

    # Reject anything too old — replay protection.
    if abs(time.time() - int(timestamp)) > MAX_TIMESTAMP_SKEW_S:
        return False

    # MAC is over "." — the RAW bytes, never re-serialized JSON.
    signed_payload = f"{timestamp}.".encode() + raw_body
    expected = hmac.new(
        WEBHOOK_SECRET.encode(), signed_payload, hashlib.sha256
    ).hexdigest()

    # Constant-time comparison — never a plain ==.
    return hmac.compare_digest(expected, signature)


@app.route("/tradeclick/webhook", methods=["POST"])
def tradeclick_webhook():
    raw_body = request.get_data()  # RAW bytes, before Flask parses JSON
    signature_header = request.headers.get("X-TradeClick-Signature", "")

    if not verify_signature(raw_body, signature_header):
        abort(401)

    event_type = request.headers.get("X-TradeClick-Event")
    delivery_id = request.headers.get("X-TradeClick-Delivery")
    payload = request.get_json()

    # Return 2xx immediately and process asynchronously — TradeClick does not
    # wait for your processing to finish.
    enqueue_for_processing(delivery_id, event_type, payload)
    return "", 200

const crypto = require("crypto");
const express = require("express");

const app = express();

// Issued once by the TradeClick admin alongside your API key — server-side only.
const WEBHOOK_SECRET = "your-webhook-signing-secret";
const MAX_TIMESTAMP_SKEW_S = 300; // ~5 minutes

function verifySignature(rawBody, signatureHeader) {
  const parts = Object.fromEntries(
    (signatureHeader || "").split(",").map((p) => p.split("="))
  );
  const { t: timestamp, v1: signature } = parts;
  if (!timestamp || !signature) return false;

  // Reject anything too old — replay protection.
  const nowS = Math.floor(Date.now() / 1000);
  if (Math.abs(nowS - Number(timestamp)) > MAX_TIMESTAMP_SKEW_S) return false;

  // MAC is over "." — the RAW bytes, never re-serialized JSON.
  const signedPayload = Buffer.concat([
    Buffer.from(`${timestamp}.`),
    rawBody,
  ]);
  const expected = crypto
    .createHmac("sha256", WEBHOOK_SECRET)
    .update(signedPayload)
    .digest("hex");

  // Constant-time comparison — never a plain ===.
  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signature));
}

// express.raw() keeps the body as a Buffer of the exact bytes we sent —
// express.json() would re-parse it first and the raw bytes needed for the
// signature check would already be gone.
app.post(
  "/tradeclick/webhook",
  express.raw({ type: "application/json" }),
  (req, res) => {
    const signatureHeader = req.headers["x-tradeclick-signature"];
    if (!verifySignature(req.body, signatureHeader)) {
      return res.sendStatus(401);
    }

    const eventType = req.headers["x-tradeclick-event"];
    const deliveryId = req.headers["x-tradeclick-delivery"];
    const payload = JSON.parse(req.body);

    // Return 2xx immediately and process asynchronously — TradeClick does
    // not wait for your processing to finish.
    enqueueForProcessing(deliveryId, eventType, payload);
    res.sendStatus(200);
  }
);

{
  "event": "trade.open",
  "timestamp": "2026-08-08T14:12:03Z",
  "strategy": "ttc_sniper",
  "symbol": "EURUSD",
  "side": "buy",
  "lots": 0.50,
  "entry_price": 1.08423,
  "sl": 1.08123,
  "tp": 1.09023,
  "signal_id": "sig_9f7a2c4e8b1d6f3a",
  "subscriber_count": 42,
  "successful_copies": 39
}

{
  "event": "trade.filled",
  "timestamp": "2026-08-08T14:12:07Z",
  "strategy": "ttc_sniper",
  "broker": "verity",
  "ticket": "102083",
  "symbol": "EUR/USD",
  "broker_symbol": "EURUSD",
  "side": "buy",
  "lots": 0.01,
  "fill_price": 1.08431,
  "requested_entry": 1.08423,
  "sl": 1.08123,
  "tp": 1.09023,
  "signal_id": "sig_9f7a2c4e8b1d6f3a",
  "account_id": "58e2f24e-77a2-4248-a615-52452b1eca47"
}

ticket is the broker-side position identifier, so it reconciles directly against your own records. symbol is the TradeClick pair; broker_symbol is the instrument as your platform named it (e.g. EURUSD.pro) — match on that. strategy may be copy:<creator> for account-level copy trading, which has no marketplace strategy of its own. grid_no_stop: true appears on grid fills that intentionally carry no stop loss.

A delivery is retried up to 5 times with backoff 30s → 2m → 10m → 30m → 2h, then marked dead. Any 2xx response is treated as acknowledged. A non-2xx response, a timeout (10s), or a connection error all trigger a retry.

• HTTPS only.
• Your endpoint must resolve to a public address — loopback, private, and link-local addresses are rejected.
• Redirects are not followed. Point the URL directly at your final endpoint.

X-TradeClick-Delivery is stable across retries of the same delivery — de-duplicate your processing on it. Delivery is at-least-once, not exactly-once, so the same delivery id can legitimately arrive more than once.

You can set your own endpoint, choose which events you receive, and generate your own signing secret — from the Partner Portal or these endpoints. All three are authenticated by your session token, exactly like the rest of Section 4.

{
  "ok": true,
  "webhook_url": "https://your-platform.com/webhooks/tradeclick",
  "webhook_enabled": true,
  "events": ["trade.filled", "trade.close"],
  "available_events": ["trade.open", "trade.close", "trade.modify",
                       "trade.partial_close", "trade.filled", "test.ping"],
  "secret_prefix": "tc_whsec_9f7a2c4e",
  "secret_set": true,
  "algorithm": "HMAC-SHA256",
  "signature_header": "X-TradeClick-Signature"
}

{
  "webhook_url": "https://your-platform.com/webhooks/tradeclick",
  "events": ["trade.filled", "trade.close"],
  "enabled": true
}

curl -X PATCH https://tradeclick-api.onrender.com/v1/b2b/webhook \
  -H "Authorization: Bearer sess_9f7a2c4e8b1d6f3a0c5e7b2d4a" \
  -H "Content-Type: application/json" \
  -d '{"webhook_url":"https://your-platform.com/webhooks/tradeclick","enabled":true}'

{
  "ok": true,
  "webhook_secret": "tc_whsec_…",
  "prefix": "tc_whsec_9f7a2c4e",
  "algorithm": "HMAC-SHA256",
  "signature_header": "X-TradeClick-Signature"
}

View, activate and deactivate copy trading for your traders from your own platform.

That step is not a formality we can skip for you. Placing orders needs live broker credentials that only the trader can supply, and TradeClick accounts are created by the person who owns them — we never mint one on a trader's behalf. The SSO flow is what turns your broker_account_id into a managed trader; until then these endpoints return 404 trader_not_linked.

{
  "ok": true,
  "broker_account_id": "8891234",
  "account_connected": true,
  "strategies": [
    {
      "slug": "ttc_sniper",
      "name": "TTC Sniper",
      "symbol": "XAUUSD",
      "status": "running",
      "started_at": "2026-08-09T09:14:02Z",
      "risk_percent": 1.0,
      "sizing_mode": "risk_pct"
    }
  ]
}

{
  "ack": true,
  "risk_percent": 1.0,
  "pair": "any"
}

{
  "ok": true,
  "slug": "ttc_sniper",
  "stopped": 1,
  "positions_closed": false
}

A full flow — authenticate, then submit a monthly volume report. Run both from your own backend; never from a browser page, since the API key must never reach an end user's device.

import requests

BASE_URL = "https://tradeclick-api.onrender.com"
API_KEY = "tc_b2b_live_5f3a9c2e1b7d4a8f9c0e2b1a"  # server-side secret — keep out of version control

# 1. Exchange the API key for a short-lived session token.
auth = requests.post(f"{BASE_URL}/v1/b2b/auth", json={"api_key": API_KEY})
auth.raise_for_status()
session_token = auth.json()["session_token"]
headers = {"Authorization": f"Bearer {session_token}"}

# 2. Submit the monthly volume report.
report = requests.post(
    f"{BASE_URL}/v1/b2b/volume/report",
    headers=headers,
    json={
        "report_month": "2026-07",
        "total_lots": 842.50,
        "copy_trading_lots": 610.00,
        "manual_lots": 232.50,
    },
)
report.raise_for_status()
print(report.json())

const BASE_URL = "https://tradeclick-api.onrender.com";
const API_KEY = "tc_b2b_live_5f3a9c2e1b7d4a8f9c0e2b1a"; // server-side secret — never ship this in a browser

async function reportVolume() {
  // 1. Exchange the API key for a short-lived session token.
  const authRes = await fetch(`${BASE_URL}/v1/b2b/auth`, {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({ api_key: API_KEY }),
  });
  if (!authRes.ok) throw new Error(`auth failed: ${authRes.status}`);
  const { session_token } = await authRes.json();

  // 2. Submit the monthly volume report.
  const reportRes = await fetch(`${BASE_URL}/v1/b2b/volume/report`, {
    method: "POST",
    headers: {
      "Content-Type": "application/json",
      Authorization: `Bearer ${session_token}`,
    },
    body: JSON.stringify({
      report_month: "2026-07",
      total_lots: 842.5,
      copy_trading_lots: 610.0,
      manual_lots: 232.5,
    }),
  });
  if (!reportRes.ok) throw new Error(`report failed: ${reportRes.status}`);
  console.log(await reportRes.json());
}

reportVolume().catch(console.error);

Errors are returned as {"code": "..."} (sometimes with a human-readable message) alongside a matching HTTP status.

Questions about integrating, a key you need rotated, or a report that looks wrong — email partners@tradeclick.io and include your broker slug where relevant.