App Registration
Before the third-party platform (hereinafter referred to as "the App") can use Tiger's API, the platform must first complete the registration of company and App information.
After the information is approved (usually within 48 hours), the relevant credentials will be sent via email to the address provided during the application (which must be an official company email address).
The credentials include: client_id, client_secret, scopes, audiences, and a public key (used to verify the signature of Tiger's Access Token to prevent malicious tampering of requests).
The third-party platform must keep the
client_secretsecure and must not disclose it to any user or third party. If a leak is discovered, please contact us immediately for replacement.
The following information must be provided when registering an App.
| Name | Type | Description | Example |
|---|---|---|---|
| Company Name | string | Includes the company's common name, Chinese name, English name, etc. (fill in at least one name). | Take Tiger as an example, the followings need to be provided: Tiger Securities; US TIGER SECURITIES, INC. |
| Company Info | string | Describes the third-party platform's basic information, including business scope, user scale, transaction scale, common transaction types, transaction frequency, etc. | |
| Homepage URL | string, a URL | The full URL to the company's homepage. | |
| Contact Info | dict | The name, phone number and email address of the person in charge of communication with Tiger's API team on behalf of the App. | |
| App Code Name | string | Name of the App, consisting of only lowercase Latin characters, numbers, dots, and hyphens (-). | |
| App Name | string | Name of the App to be presented to the End-User. If desired, representation of this Name in different languages and scripts can be represented. | |
| App Description | string | Description of the App to be presented to the End-User. If desired, representation of this Name in different languages and scripts can be represented. Only required if the App plans to use the Authorization Code flow, or expects Tiger to display App info to the End-User elsewhere. | |
| App Logo | Image, or URL of Image | Logo of the App to be presented to the End-User. Only required if the App plans to use the Authorization Code flow, or expects Tiger to display App info to the End-User elsewhere. | |
| Redirect URIs | list[string] | Array of Redirection URI values used by the App. One of these registered Redirection URI values MUST exactly match the redirect_uri parameter value used in each Authorization Request, with the matching performed as described in Section 6.2.1 of RFC3986 (Simple String Comparison). | |
| Notify URI | string | URI used to receive notifications about authentication events, order events, etc. | |
| Redirect URI | string | URI used to handle oauth2 code | |
| Grant Types | list[string] | Array containing a list of the OAuth 2.0 grant_type that the App is declaring that it will restrict itself to using. Include authorization_code if the App plans to use the Authorization Code flow.Include refresh_token if the App plans to refresh the Access Token obtained from Authorization Code flow.Include client_credentials if the App plans to use the Client Credentials flow. | |
| Response Types | list[string] | Array containing a list of the OAuth 2.0 response_type values that the App is declaring that it will restrict itself to using. Include code if the App plans to use the Authorization Code flow.Otherwise keep empty. | |
| Auth Method | string | The authentication method that the App will use at certain endpoints. See Authentication Method for details. Secret Basic, Secret Post |
Authorization and Binding
Users from third-party platforms who have not yet opened a Tiger account:
Register for a Tiger account via a URL containing the client_id and the third-party platform user ID (external_id). After registration is completed, the account will be automatically linked to the third-party platform account. The process is as follows:
Users can navigate to the landing page by clicking a URL that includes the third-party client_id and the user's ID (external_id) on the third-party platform. If the user chooses to open an account, they will be redirected to the account opening link. Users who successfully register through this link will be automatically bound in Tiger's Channel Center and will receive channel-exclusive account opening rewards on the landing page.
If there is no landing page, the user is redirected directly to the account opening URL.
After the user completes registration, the external_client_id and external_id parameters will be recorded in the user's personal information. At this point, the third-party platform will receive an account creation event notification at the notify URL. This notification includes the user's third-party platform ID, and the third-party platform can then record that this user has registered with Tiger.
After the user completes account opening, the third-party platform will receive a user account opening event notification at the notify URL. This notification also includes the user's third-party platform ID. At this point, the third-party platform can record that this user has opened an account with Tiger and store the user's fund account number (accountId, which is required for subsequent API calls).
Users of third-party platforms who have already opened a Tiger account:
Users authorize through the login page, and the login page URL must include external_client_id and external_id.
The first login requires the user to agree to the API terms; without consent, the next step cannot proceed.
After consenting to authorization, the third-party relationship will be automatically bound.