This page is reorganized as a practical OAuth 2.0 access flow for new integrations.

Tip: Prefer using SDKs for faster integration: https://open.longbridge.com/sdk

Notes

Precautions	Reference
Prefer SDKs over raw HTTP when possible	SDK Quick Start
Enable required OpenAPI services first	How to enable OpenAPI
Understand permissions and restrictions	Permissions and restrictions
Check common error codes for troubleshooting	Error Codes

OAuth 2.0 (Default)

For new integrations, OAuth 2.0 is the default path.

API-key signature mode can remain as a fallback for legacy compatibility, but it is not the default.

Discovery endpoints

• Production: https://openapi.longbridge.com/.well-known/oauth-authorization-server
• China: https://openapi.longbridge.cn/.well-known/oauth-authorization-server

Supported grant types (from discovery):

• authorization_code
• refresh_token

OAuth 2.0 authorization flow

Register OAuth client

If there is no UI for client creation in your environment, register dynamically:

curl -X POST https://openapi.longbridge.com/oauth2/register \
  -H "Content-Type: application/json" \
  -d '{
    "client_name": "my-openapi-app",
    "redirect_uris": ["https://your-app.com/callback"],
    "grant_types": ["authorization_code", "refresh_token"],
    "response_types": ["code"]
  }'

Registration may return only client_id (public client, no client_secret). In this case, use PKCE and do not send client_secret in token requests.

Build authorization URL and get code

https://openapi.longbridge.com/oauth2/authorize
  ?response_type=code
  &client_id=YOUR_CLIENT_ID
  &redirect_uri=YOUR_REDIRECT_URI
  &scope=3
  &state=YOUR_RANDOM_STATE
  &code_challenge=YOUR_CODE_CHALLENGE
  &code_challenge_method=S256

After user consent, callback receives:

YOUR_REDIRECT_URI?code=AUTH_CODE&state=YOUR_RANDOM_STATE

Exchange code for access_token

curl -X POST https://openapi.longbridge.com/oauth2/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=authorization_code" \
  -d "client_id=YOUR_CLIENT_ID" \
  -d "redirect_uri=YOUR_REDIRECT_URI" \
  -d "code=AUTH_CODE" \
  -d "code_verifier=YOUR_CODE_VERIFIER"
# only when your client has secret:
# -d "client_secret=YOUR_CLIENT_SECRET"

Call API with Bearer token (TSLA.US example)

curl -X GET "https://openapi.longbridge.com/v1/quote/get_security_list?market=US&category=Overnight" \
  -H "Authorization: Bearer ACCESS_TOKEN"

Real response (excerpt, keeping TSLA.US row):

{
  "code": 0,
  "message": "success",
  "data": {
    "list": [
      {
        "symbol": "TSLA.US",
        "name_cn": "特斯拉",
        "name_hk": "",
        "name_en": ""
      }
    ]
  }
}

Refresh token

Use OAuth token endpoint for refresh (details in Refresh Token section below):

curl -X POST https://openapi.longbridge.com/oauth2/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=refresh_token" \
  -d "client_id=YOUR_CLIENT_ID" \
  -d "refresh_token=REFRESH_TOKEN"
# only when your client has secret:
# -d "client_secret=YOUR_CLIENT_SECRET"

Relationship with legacy docs

• This page: OAuth 2.0 main flow for new integrations.
• Refresh Token section below: refresh step details only, to avoid duplication.

---

Refresh Token (OAuth 2.0)

This page focuses only on the OAuth 2.0 refresh token step.

• If you have not completed the full flow yet, read the Authentication section above first.
• This page does not repeat client registration / authorization code steps.

Recommended refresh method (OAuth 2.0)

Use OAuth token endpoint:

• POST https://openapi.longbridge.com/oauth2/token
• or China: POST https://openapi.longbridge.cn/oauth2/token

Request parameters (application/x-www-form-urlencoded)

Name	Required	Description
grant_type	Yes	Must be refresh_token
client_id	Yes	OAuth client id
refresh_token	Yes	Previously issued refresh token
client_secret	Optional	Required only for confidential clients; omit for public clients

Refresh example

curl -X POST https://openapi.longbridge.com/oauth2/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=refresh_token" \
  -d "client_id=YOUR_CLIENT_ID" \
  -d "refresh_token=YOUR_REFRESH_TOKEN"
# only when your client has secret:
# -d "client_secret=YOUR_CLIENT_SECRET"

Response example

{
  "access_token": "...",
  "refresh_token": "...",
  "expires_in": 2592000,
  "token_type": "Bearer"
}

Compatibility note

Legacy /v1/token/refresh remains for backward compatibility. For new integrations, use OAuth 2.0 token endpoint as default.