App Registration

Before the third-party platform (hereinafter referred to as "the App") officially uses Tiger's API interface, the third-party platform first needs to complete the registration of company and App information. After the information has been approved (usually within 48 hours), the relevant certification information will be replied by email, and the email will be sent to the address filled in during the application (need to ensure that the email address is the official email address of the the third-party platform company). certification information includes: client_id, client_secret, scopes, audiences, public key (to verify the signature of Tiger's Access Token to prevent malicious tampering of requests).

The third-party platform needs to keep the client_secret properly and cannot disclose it to any user or third party. If leaks are found, please contact us in time for replacement.

The following information must be provided when registering an App.

Name	Type	Description	Example
Company Name	string	Includes the company's common name, Chinese name, English name, etc. (fill in at least one name).	Take Tiger as an example, the followings need to be provided: Tiger Securities; US TIGER SECURITIES, INC.
Company Info	string	Describes the three-party platform's basic information, including: the business scope, user scale, transaction scale, common transaction types, transaction frequency, etc.
Homepage URL	string, a URL	The full URL to the company's homepage.
Contact Info	dict	The name, phone number and email address of the person in charge of communication with Tiger's API team on behalf of the App.
App Code Name	string	Name of the App consists of only lower latin characters, numbers, dots and hyphen (-).
App Name	string	Name of the App to be presented to the End-User. If desired, representation of this Name in different languages and scripts can be represented.
App Description	string	Description of the App to be presented to the End-User. If desired, representation of this Name in different languages and scripts can be represented. Only required if the App plans to use the Authorization Code flow, or expects Tiger to display App info to the End-User elsewhere.
App Logo	Image, or URL of Image	Logo of the App to be presented to the End-User. Only required if the App plans to use the Authorization Code flow, or expects Tiger to display App info to the End-User elsewhere.
Redirect URIs	list[string]	Array of Redirection URI values used by the App. One of these registered Redirection URI values MUST exactly match the `redirect_uri` parameter value used in each Authorization Request, with the matching performed as described in Section 6.2.1 of RFC3986 (Simple String Comparison).
Notify URI	string	URI used to receive notifications about authentication events, order events, etc.
Grant Types	list[string]	Array containing a list of the OAuth 2.0 grant_type that the App is declaring that it will restrict itself to using. Include `authorization_code` if the App plans to use the Authorization Code flow. Include `refresh_token` if the App plans to refresh the Access Token obtained from Authorization Code flow. Include `client_credentials` if the App plans to use the Client Credentials flow.
Response Types	list[string]	Array containing a list of the OAuth 2.0 response_type values that the App is declaring that it will restrict itself to using. Include `code` if the App plans to use the Authorization Code flow. Otherwise keep empty.
Auth Method	string	The Authentication method that the App is declaring that it will use at certain Endpoints. See Authentication Method for detail. Secret Basic, Secret Post

Authorization and Binding

Users from third-party platforms who have not yet opened a Tiger account:

Register for a Tiger account via a URL containing the client_id and the third-party platform user ID (external_id). After registration is completed, the account will be automatically linked to the third-party platform account. The specific process is as follows: Users can jump to the landing page by clicking on a URL that includes the third-party client_id and the user's ID (external_id) on the third-party platform. If the user chooses to open an account, they will be redirected to the account opening link. Users who successfully register through this link will be automatically bound to Tiger's Channel Center and will receive the channel-exclusive account opening rewards on the landing page when opening an account. If there is no landing page, directly redirect to the account opening URL. After the user completes registration, the external_client_id and external_id parameters will be recorded in the user's personal information. At this time, the third-party platform will receive a notification of the account creation event for the associated user in the callback URL. This notification includes the user's third-party platform ID, and the third-party platform can then record in its system that this user has registered with Tiger. After the user completes account opening, the third-party platform will receive a notification related to the user account opening event in the callback URL. This notification also includes the user's third-party platform ID. At this time, the third-party platform can record in its system that this user has opened an account with Tiger and record the user's fund account number (accountId, which is required for subsequent API calls).

Users of third parties who have already opened Tiger accounts:

Users authorize through the login page, and the login page URL must include (external_client_id, external_id). The first login requires authorization to agree to the API's terms; without consent, the next step cannot be taken. After consenting to authorization, the relationship with the third party will be automatically bound.