Authentication

Tiger OpenAPI supports signature authentication and OAuth2 authorization. They use the same business APIs but manage permissions differently.

Key differences

Signature authentication uses a Tiger ID and RSA key pair. An application inherits the OpenAPI permissions already enabled for that Tiger ID; its access cannot be further limited by application or use case.

OAuth2 lets the account holder choose which accounts and permissions an application can access. Market data, account queries, trade queries, and trade operations can be authorized separately. An application's access can also be revoked independently.

Support

Choosing an authentication method

• Use signature authentication for an application you operate yourself and can secure with a private key.
• Use OAuth2 when access must be limited to selected accounts or permissions.
• Use OAuth2 when the account holder must be able to authorize and revoke an application's access independently.
• Existing signature-authenticated applications do not need to migrate.

OAuth2 permission management

An application can access only the accounts and permissions authorized by the account holder. To add, remove, or change access, authorize the application again.

The account holder can revoke OAuth2 access in the Developer Center. An application must be authorized again after access expires or is revoked.

OAuth2 does not replace OpenAPI, market data, or trading permission activation. Trading requests must still specify an authorized account.

Shared limits

For both authentication methods, market data depends on the account's OpenAPI market data entitlements. Trading is also subject to account type, trading permissions, and market rules.

Security

Do not put private keys or authorization data in source code, logs, or version control. Regenerate keys or revoke access when an application is no longer used.

Setup guides

• Python: Preparation
• Java: Preparation
• CLI: Command Line Interface
• Frequently Asked Questions