Part 2: Unusual Flow & Volume Alerts — Spot Institutional Moves Before They're Obvious

Use cases at a glance

Understanding options flow signals

Options flow has three tiers of conviction:

1. Volume spike: Any contract sees volume above its rolling 20-day average by 3–5x. This is the weakest signal but the most frequent. Most spikes are noise (day traders, retail activity, technical rebalancing). Signal-to-noise ratio: low.
2. Sweep order: Within a 60-second window, 3 or more fills execute on the same strike/expiration/contract type with combined premium >$50,000. This indicates a buyer willing to pay up for speed—they don't want to telegraph their full size. Signal-to-noise ratio: medium.
3. Sweep + out-of-the-money + short-dated: A sweep on OTM calls or puts with <15 days to expiration is the strongest. OTM means the buyer expects a move; short-dated means urgency. These are the trades you want to know about. Signal-to-noise ratio: high.

Flow alone is not a trade signal. It's one data point. Context matters: flow into earnings week is expected and less meaningful than flow on a random Tuesday. Flow after a major gap move can be mean-reversion hedging, not conviction.

Polygon.io setup for flow data

Polygon.io provides real-time options trade data. Their API streams every options trade as it happens (with a few seconds latency), letting you detect sweeps and volume spikes.

1. Sign up at polygon.io and create an API key.
2. Subscribe to the Starter plan ($29/month) for real-time options data access.
3. Store your API key: POLYGON_API_KEY=your_key_here in secrets.env
4. Test the endpoint: GET /v3/trades/options/{optionsTicker} where optionsTicker is like O:SPY230317C450 (SPY Mar 17 $450 call).

Here's the flow monitor agent YAML config:

agents:
  flow-monitor:
    description: "Real-time unusual options flow and volume alerts"
    tools:
      - polygon-api
      - tradier-api
      - slack-webhook
    config:
      polygon_token: "${POLYGON_API_KEY}"
      tradier_token: "${TRADIER_API_TOKEN}"
      watchlist:
        - SPY
        - QQQ
        - IWM
        - AAPL
        - MSFT
        - NVDA
        - TSLA
      volume_spike_multiplier: 3
      alert_multiplier: 5
      min_contract_size: 10
      min_premium_value: 25000
      exclude_near_expiry: true
      sweep_window_seconds: 60
      sweep_fills_minimum: 3
      sweep_premium_threshold: 50000
      call_put_extreme_ratio: 1.5
    output:
      format: markdown
      channel: slack
      heartbeat: "*/15 9-16 * * 1-5"

Volume spike detection agent

The agent computes a rolling 20-day average daily volume for each contract (or aggregate ticker volume). When current intraday volume exceeds that average by a configurable multiple, it flags an alert.

Alert format: SPY 440 Call (Mar 28) — Volume: 3.2K contracts | Avg: 650 | Multiple: 4.9x | Premium: $2.1M

Sweep order detection

A sweep occurs when multiple fills happen on the same strike/expiration within 60 seconds. The agent tracks every trade hitting the API, buffers trades for 60 seconds, then checks: if 3+ trades on the same contract sum to ≥ $50,000 premium, it's flagged as a sweep.

Sweep detection pseudocode:
- For each trade in the last 60 seconds:
  - Group by (ticker, strike, expiration, type)
  - If group size >= 3 AND sum(premium) >= $50,000:
    - Alert: SWEEP DETECTED
    - Include: total premium, avg price per contract, number of fills

Call/put ratio imbalance alert

Track aggregate call vs. put volume for SPY and QQQ. This is market sentiment in real time. When the call/put ratio spikes above 1.5 (extreme bullish) or drops below 0.5 (extreme bearish), flag it. These extremes often precede mean-reversion moves within hours.

Alert: SPY Call/Put ratio: 1.8 | 20-day avg: 1.1 | Status: EXTREME BULLISH BIAS

Dark pool integration (Unusual Whales)

Unusual Whales ($50/month) aggregates dark pool flow and sweep patterns that aren't visible in the public options chain. If you subscribe, integrate their webhook: they'll post sweep orders and unusual blocks directly to your Slack, and the OpenClaw alert router can consume and filter these.

Filtering noise — avoiding false positives

Flow alerts can be noisy. Use these filters:

• Earnings week blackout: Don't flag volume spikes in earnings week. Volatility and volume are expected. Whitelist earnings week tickers or require higher multipliers (5x instead of 3x).
• Premium threshold: Require a minimum dollar amount of premium moved. A 10x volume spike on a $0.05 option is noise; a 3x spike on a $5 option is signal. Set min_premium_value: 25000 (meaning >$25K total premium to alert).
• Contract size filter: Ignore tiny retail orders. Set min_contract_size: 10 to skip contracts with <10 total fills in the sample window.
• Exclude near-expiry: 0DTE and 1DTE options have gamma-driven volume spikes that are less meaningful. Set exclude_near_expiry: true or increase the multiplier threshold for <7 DTE contracts.
• Time-weight: A 5x average across the entire day (9:30 AM to 4 PM) is less meaningful than 5x average in the last 10 minutes. Prioritize recent spikes.

HEARTBEAT schedule

The flow monitor runs every 15 minutes during market hours:

*/15 9-16 * * 1-5

This checks for new sweeps and volume spikes every 15 minutes from 9:30 AM to 4:00 PM ET. For day traders who want higher cadence, reduce the interval to every 5 minutes:

*/5 9-16 * * 1-5

Sample flow alert output

FAQ

What is a sweep order in options?

A sweep order is a large options order that's broken into smaller pieces and routed to multiple exchanges simultaneously to get filled quickly. A sign the buyer is willing to pay up for speed, suggesting conviction. Sweeps typically indicate institutional or well-funded traders who don't want to telegraph their full size. The OpenClaw flow agent flags orders where a single ticker sees a sweep pattern (multiple near-simultaneous fills on the same strike/expiration) with total premium above your configured threshold ($50,000 default).

How is unusual volume calculated?

The agent computes a rolling 20-day average daily volume for each contract (or for total ticker options volume) and flags when current intraday volume exceeds a set multiple of that average—typically 3x for a caution flag and 5x for a strong alert. Volume must be filtered for contract size (ignore very small contracts) and time-weighted (10x average in the first 5 minutes of trading is more meaningful than 5x by 2 PM). The sample output in this guide shows both multipliers in context.

Is Unusual Whales worth the cost for this?

Unusual Whales aggregates and classifies flow that would otherwise require you to subscribe to a Level 2 options data feed and write your own detection logic. At ~$50/month it's reasonable if you're actively trading options. The guide covers a DIY approach using Polygon.io's options trades endpoint which gives you raw trade-by-trade data you can analyze yourself—more work to set up but no ongoing third-party subscription beyond Polygon ($29/month).

Should I trade every flow alert I see?

No. Flow is a signal, not a setup. A volume spike on TSLA calls is interesting; TSLA volume spike + calls + price breaking above resistance + rising IV is a setup. Combine flow with technical analysis, your own thesis, and market regime. Use flow to confirm or add urgency to your existing trade ideas.