Authorization flow - ApiFlow Documentation

Search Docs…

Tutorials

Authorization flow

Step 1 — Authorization Request (Custodial → TS)

Make a GET to the relevant index endpoint with query params and cookies:

Required query params

Param	Type	Example	Notes
noheader	bool	true	Hide TS header for full white‑label look
currencyCode	string	USD	Must match a currency configured for your account
freePlay	bool	false	Keep false
language	string	EN	2‑letter uppercase
mobile	bool	false	Optional UI hint
mode	string	dev	Keep dev for integration
token	string	UUID…	Launch token you generated; echoed in Step 2
type	string	options	Use options for Turbo/HL/SpreadX; fx for 1000x (or per TS instruction)
responseType	string	json	Request a JSON envelope
landingParam	string	VIP	(Optional) TS grouping parameter

Required cookies

Cookie	Example	Notes
PHPSESSID	abc123…	Session identifier; allows re‑entry
userId	user-123	Your user ID (must be stable per user & currency)
UserName	john.doe	A display name (unique/spoofed ok)
userCurrency	1	See multi‑currency notes below
accountLevel	0	Leave 0 unless instructed otherwise

Multi‑currency: Treat (userId, currency) as a unique entity in TS. If a user switches currency, use a distinct userId variant per currency (avoid dashes in userId).

Example cURL

Important: TS will not immediately return the iFrame URL. It first calls your /authenticate (Step 2). Only after you return status:"Ok" will TS answer Step‑1 with the Authenticated Link.

Step 2 — Authenticate Verification (TS → Custodial)

TS calls your POST /authenticate with the launch token you provided in Step‑1.

Request

POST https://<custodial>

Response (you → TS)

token — Your wallet access token. TS will send it back on every wallet action.
Persist the mapping (launchToken → session token, userId, currency) on your side.

If you don’t want to return a real email, return a unique spoof value and store it.

Step 3 — Authenticated Link (TS → Custodial)

If Step‑2 returns status:"Ok", the response to your Step‑1 request is a fully formed URL to load into your iFrame, e.g.:

https://trading.<yourbrand>.com?noheader=true&lang=EN&PHPSESSID=<...>&userID=<TS-USER-ID>&username=<UserName>

For Options games you may append &gameType=Turbo|HighLow|SpreadX to preload a game.
For 1000x, perform the same 3‑step flow against the FX base (https://trade.<yourbrand>.com) and replace the iFrame src with the new link.

iFrame Embed Example

<iframe
  id="ts-game"
  src="<AUTHENTICATED-LINK>"
  allow="clipboard-write"
  referrerpolicy="no-referrer"
  style="width:100%;height:720px;border:0;"
></iframe>

Consider sandbox only if you also include allow-same-origin allow-scripts and confirm with TS; otherwise it may block app features.

Environments & DNS

Wallet Action Endpoints