Setting up a secret

A Spectra webhook secret is what connects an external alerting system — your own server, a screener, a script, or any HTTP-capable alert source — to a Spectra account. Each secret is scoped to a single broker connection and a daily-loss cap.

Creating a secret

Profile → Webhooks → Add. Each secret carries:

Name              →  human label, e.g. "TV BTC alerts"
Broker connection →  which broker auto-orders route to
Daily-loss cap    →  per-secret USD ceiling (mandatory)
IP allowlist      →  CIDR ranges allowed to POST
Active            →  toggle off to disable without deleting

After save, the secret value is shown once. Copy it immediately — Spectra stores only an AES-GCM-sealed copy and won't display it again. Lose it, rotate it.

Daily-loss cap

The cap is enforced at the cloud worker before any order routes to the broker. If realized + open P&L for the day breaches the cap, the secret pauses for the rest of the day and an alert fires.

You set the cap when creating the secret; change it any time. There is no way to disable it — the field is mandatory, and the minimum is $100 (small enough to be friction-free for testing, big enough to be visible if someone tries to set 0).

IP allowlist

CIDR ranges that may POST to the webhook. By default any IP can POST, but combined with HMAC verification this is rarely a real attack surface. Restrict it to your alert source's published IPs for stricter isolation.

Rotating

Webhooks → secret → Rotate. The old secret is immediately revoked; the new one is shown. Update your sender within 5 minutes — replay protection (see Replay) is timestamp-bound, so old messages won't replay anyway.