Broker Program

Introduction

If your business platform offers cryptocurrency services, you can apply to join the BloFin Broker Program, become our partner broker, enjoy exclusive broker services, and earn rebates through trading fees generated by BloFin users.

The Broker Program includes, but is not limited to: integrated trading platforms, trading bots, copy trading platforms, trading bot providers, quantitative strategy institutions, and asset management platforms.

Click to apply
If you have any questions, feel free to contact the BloFin Business Team.

Broker Types

BloFin supports two broker types:

Broker Type	Description	Suitable For
API Broker	Users create API keys on BloFin themselves and provide them to the broker. The broker uses BloFin’s trading APIs to place orders on behalf of users, with the broker’s `brokerId` attached for attribution.	Platforms whose users are willing to manage their own BloFin API keys.
OAuth Broker (Fast API)	Users authorize the broker’s application via BloFin OAuth 2.0 with one click. API keys are automatically created for users — no password or manual API key copying required.	Platforms that want the smoothest onboarding and a safer way for users to connect their BloFin accounts.
OAuth Broker (Native) (coming soon)	Users authorize the broker’s application via BloFin OAuth 2.0, and the broker calls BloFin APIs directly with the OAuth `access_token` — no API key creation involved at all.	Platforms that want the simplest integration without managing API keys.

Note: Currently, there is no distinction between API Broker and OAuth Broker at application time, and both share the same rebate system — only the integration method differs. Separate broker types may be introduced in the future.

Broker Benefits

Commission rebates: Earn rebates on trading fees generated by your users. For rebate details, see the Broker Program page or contact the BloFin Business Team.
Broker Workbench: After logging in, brokers can access the Broker Workbench, where the Dashboard provides data statistics, commission tracking, and other broker services.
User API safety: OAuth-based automatic API key creation and third-party IP whitelists.

How to Apply

Register a BloFin account.
Apply for the Broker Program via the Broker Program page.
BloFin reviews the application.
Once approved, you will receive your unique broker_id (both API Brokers and OAuth Brokers).
OAuth Brokers only: to obtain client_id and client_secret, log in to the Broker Workbench and submit an application to create an OAuth app. Once approved, your client_id and client_secret will be issued. Keep this information safe and do not share it.

Get Rebate Guide

When placing orders through BloFin’s Open API, order attribution is implemented via the brokerId request parameter. Make sure to pass your unique broker ID in every order request, so that BloFin can associate the trading volume with your platform.

Parameter	Type	Required	Description
brokerId	String	No	Broker ID provided by BloFin. A combination of case-sensitive alphanumerics, all numbers, or all letters of up to 16 characters.

With brokerId attached to orders, brokers can receive the corresponding commission rewards and track trading data in the Broker Workbench Dashboard. Orders placed without brokerId will not be attributed to your broker account.

The brokerId parameter is supported by order placement endpoints, e.g., Place Order and Place Multiple Orders.

API Broker

Introduction

API Brokers connect to BloFin using the standard BloFin trading APIs. Users create API keys on BloFin and provide them to the broker, where they can use the broker’s UI to trade while choosing BloFin as the exchange.

Note: If you want API keys to be created for users automatically via one-click authorization, see OAuth Broker (Fast API) and Create API Key instead.

Integration Flow

User creates an API key on BloFin. When creating the key, the user must select Connect to Third-Party Applications as the API Key Usage, and choose the broker’s application in Application Name. (Your application is configured by BloFin after your broker application is approved; if it does not appear in the list, contact the BloFin Business Team.)
User binds the API key to the broker’s platform.
Broker places orders via BloFin trading APIs with brokerId attached.

Common APIs for Brokers

When calling BloFin trading APIs, always include your brokerId request parameter where supported, to ensure orders are associated with your broker account (see Get Rebate Guide).

For full API details, refer to the Futures API and Spot API:

Place Order
Place Multiple Orders
Cancel Order
Account & position endpoints

OAuth Broker (Fast API)

Introduction

OAuth login provides your users a safer and more convenient way to use your product. With BloFin OAuth 2.0, users can connect their BloFin account after one-click authorization from your application — no password or manually created API key is required.

BloFin OAuth 2.0 only supports the Authorization Code Grant, the most secure mode for server-side clients.

Base URLs

Environment	Base URL
Authorization Page	`https://blofin.com/oauth`
OAuth & Resource API	`https://oauth.blofin.com`

Preparation before Integration

Before integrating, complete the following:

Item	Description
Client Credentials	Log in to the Broker Workbench and submit an application to create an OAuth app. Once approved, you will receive `client_id` (public identifier) and `client_secret` (confidential — store only on your backend, never expose to the frontend).
Redirect URI	Enter a valid HTTPS `redirect_uri` in the Broker Workbench when creating your OAuth app. It must exactly match the URI used in authorization requests.
IP Whitelisting	Enter your server IP address list in the Broker Workbench for access control. Requests from unlisted IPs will be blocked. Keep the list up to date when your server IPs change.
Permission Scopes	When creating your OAuth app in the Broker Workbench, select the user-authorized scopes (`read`, `trade`, `transfer` — second-level scopes of `create:apikey`). Currently open scopes: `create:apikey` and `user:read` (default). See Permission Scopes.

Authorization Flow

The flow involves 3 parties: your backend, the end user, and BloFin’s authorization service.

User Authorization: Redirect the user to BloFin’s authorization page. The user logs in and confirms permission for your app.
Receive Authorization Code: BloFin redirects the user back to your redirect_uri with a short-lived code (authorization code).
Exchange Code for Tokens: Your backend calls BloFin’s token endpoint with code to get an access_token (for API calls) and refresh_token (for refreshing expired tokens).
Call Resource APIs: Use the access_token to authenticate requests to BloFin’s Resource APIs.

sequenceDiagram
    autonumber
    participant U as User (Browser)
    participant B as Broker Backend
    participant A as BloFin Auth Page<br/>(blofin.com/oauth)
    participant O as BloFin OAuth API<br/>(oauth.blofin.com)

    U->>B: Click "Connect BloFin"
    B->>U: Redirect to authorization page<br/>(client_id, redirect_uri, scope, state)
    U->>A: Log in & approve authorization
    A->>U: Redirect back to redirect_uri<br/>?code=...&state=...
    U->>B: Deliver authorization code<br/>(valid 10 min, single-use)
    B->>O: POST /oauth/token<br/>(grant_type=authorization_code)
    O->>B: access_token (2h) + refresh_token (7d)
    B->>O: Call Resource APIs<br/>(Authorization: Bearer access_token)
    O->>B: JSON response
    Note over B,O: access_token expired? POST /oauth/token<br/>(grant_type=refresh_token) to get a new pair

Usage of Token

After exchanging the authorization code, you receive two types of tokens:

Token	Purpose	Validity
`access_token`	Used to call BloFin Resource APIs.	2 hours (7200 seconds)
`refresh_token`	Used to obtain a new `access_token` when the previous one expires.	7 days

When calling Resource APIs, carry the token in the request header: Authorization: Bearer {access_token}.

If the access_token expires, call the Get Refresh Token endpoint with grant_type=refresh_token to obtain a new pair of tokens. If the refresh_token is also invalid or expired, redirect the user to re-authorize.

Permission Scopes

The user:read and create:apikey scopes are currently open to all OAuth apps. The deposit:status and deposit:address scopes are available only to OAuth apps created previously (legacy apps) — see Legacy APIs.

Scope	Description	Availability	Required For
`create:apikey`	Create a Broker API key on behalf of the authorized user. The permissions of the created key are governed by its second-level scopes (see below).	Open — enabled when your OAuth app is created in the Broker Workbench	`POST /oauth/apikey/create`
`user:read`	Read desensitized basic info of the authorized user (e.g., desensitized UID, account status).	Open — default for all clients, no application needed	`GET /oauth/userinfo`
`deposit:status`	Check whether the authorized user has completed their first deposit on BloFin.	Legacy OAuth apps only	`GET /oauth/deposit/status`
`deposit:address`	Get the authorized user’s deposit address for a specified currency and chain.	Legacy OAuth apps only	`POST /oauth/deposit/address`

Second-Level Scopes of `create:apikey` (User-Authorized Scopes)

When applying to create an OAuth app in the Broker Workbench, you select the user-authorized scopes from the following three values. They define the maximum permissions of API keys created via Create API Key.

Second-Level Scope	Description
`read`	Read-only access for the created API key.
`trade`	Trading permission for the created API key.
`transfer`	Transfer permission for the created API key.

Authorization API

Get Authorization Code

Redirect the user to BloFin’s authorization page to obtain an authorization code.

HTTP Request

GET https://blofin.com/oauth

Request Parameters

Parameter	Type	Required	Description
response_type	String	Yes	Fixed value: `code` (identifies Authorization Code Grant).
client_id	String	Yes	Your unique client ID from BloFin.
redirect_uri	String	Yes	HTTPS URI filed with BloFin, URL-encoded (e.g., `https%3A%2F%2Fyour-app.com%2Foauth%2Fcallback`).
scope	String	No	Space-separated permission scopes (e.g., `user:read create:apikey`). Omitting uses only default scopes (e.g., `user:read`). Deposit scopes are available to legacy apps only.
state	String	No	Random string (16–32 characters) for CSRF prevention. BloFin returns it as-is in the redirect. Recommended for security.

Request Example:

https://blofin.com/oauth?response_type=code&client_id=your_client_id&redirect_uri=https%3A%2F%2Fyour-app.com%2Foauth%2Fcallback&scope=create:apikey&state=xyz789

Success Response

BloFin redirects to your redirect_uri with query parameters:

Parameter	Description
code	Authorization code (valid for 10 minutes, usable only once).
state	Exact value you passed in the request.

Response Example:

https://your-app.com/oauth/callback?code=abc123def456&state=xyz789

Failure Response

BloFin redirects to your redirect_uri with error parameters:

Parameter	Description
error	Error code (e.g., `invalid_client` = wrong `client_id`).
error_description	Human-readable error (URL-encoded).
state	Exact value you passed in the request.

Failure Response Example:

https://your-app.com/oauth/callback?error=invalid_client&error_description=Invalid%20client%20ID&state=xyz789

Get Refresh Token

Exchange an authorization code for tokens, or refresh an expired access_token.

HTTP Request

POST https://oauth.blofin.com/oauth/token

Request Headers

Header	Value
Content-Type	`application/x-www-form-urlencoded;charset=UTF-8` (critical — BloFin rejects JSON request bodies for this endpoint).

Form Parameters

Two modes — choose one based on your use case:

Mode 1: Get Token (Code → Token)

Parameter	Type	Required	Description
grant_type	String	Yes	Fixed as `authorization_code`.
client_id	String	Yes	Your BloFin client ID.
client_secret	String	Yes	Your BloFin client secret.
code	String	Yes	Authorization code from Get Authorization Code.
redirect_uri	String	Yes	Same as the one used in the authorization request.

Mode 2: Refresh Token

Parameter	Type	Required	Description
grant_type	String	Yes	Fixed as `refresh_token`.
client_id	String	Yes	Your BloFin client ID.
client_secret	String	Yes	Your BloFin client secret.
refresh_token	String	Yes	Valid `refresh_token` from a previous success response.

Response Example:

{
  "access_token": "eyJhbGciOiJIUzUxMiJ9...",
  "token_type": "Bearer",
  "expires_in": 7200,
  "refresh_token": "eyJhbGciOiJIUzUxMiJ9...",
  "scope": "user:read create:apikey"
}

Response Parameters

Parameter	Description
access_token	Used to call Resource APIs.
token_type	Fixed: `Bearer` (required in the `Authorization` header).
expires_in	Validity of `access_token` in seconds (7200 = 2 hours).
refresh_token	Used to refresh `access_token` (valid for 7 days).
scope	Actual permissions granted (matches your request).

Failure Response Example:

{
  "error": "invalid_grant",
  "error_description": "Invalid or expired authorization code"
}

OAuth Error Codes

Error Code	Description
invalid_client	Wrong `client_id` or `client_secret`.
invalid_grant	Expired/invalid `code` or `refresh_token`.
invalid_request	Missing required parameters (e.g., no `grant_type`).

Resource APIs

Resource APIs require a valid access_token for authentication and return structured JSON responses.

General Rules

Rule	Description
Authorization Header	Mandatory. Format: `Authorization: Bearer {access_token}`.
Content-Type	For POST requests, use `Content-Type: application/json` (BloFin rejects other formats).
User-Agent	Optional but recommended. Include your app name/version (e.g., `YourApp/1.0`) to help BloFin troubleshoot issues.

Get Authorized User Info

Retrieve desensitized basic info of the authorized user.

Required permission: user:read (default for all clients — no extra application needed).

HTTP Request

GET https://oauth.blofin.com/oauth/userinfo

Request Parameters

None (all info is derived from the access_token).

Response Example:

{
  "code": 200,
  "msg": "Success",
  "data": {
    "uid": 123456789
  },
  "timestamp": 1704067200000
}

Response Parameters

Parameter	Description
code	Business success code.
msg	Human-readable status.
data.uid	Desensitized unique user ID (for your app to identify users).
timestamp	Response time (milliseconds since Unix epoch).

Failure Response Example (Insufficient Permissions):

{
  "code": 403,
  "msg": "Scope not authorized",
  "data": null,
  "timestamp": 1757581123253
}

Note: User info rarely changes. Cache this data on your backend to reduce API calls.

Create API Key

Create a Broker API key on behalf of the authorized user. This enables a “Fast API”-style experience: after OAuth authorization, an API key is created for the user automatically — no manual key creation or copying required.

Required permission: create:apikey (enabled when your OAuth app is created in the Broker Workbench).

Note: The permissions requested below must be within the user-authorized scopes (read, trade, transfer) configured for your OAuth app. See Permission Scopes.

HTTP Request

POST https://oauth.blofin.com/oauth/apikey/create

Request Headers

Header	Value
Content-Type	`application/json`
Authorization	`Bearer {access_token}`

Request Parameters

Parameter	Type	Required	Description	Constraints	Example
name	String	Yes	API key name	4–20 characters; only letters, numbers, and underscores (Regex: `^[\w]{4,20}$`)	`my_api_key_001`
permissions	Array[String]	Yes	Permission list	1–3 elements; must include `READ`; optional values: `READ`, `TRADE`, `TRANSFER`	`["READ", "TRADE"]`
passphrase	String	Yes	API key passphrase	4–20 characters; only letters, numbers, and underscores (Regex: `^[\w]{4,20}$`)	`my_pass123`
ip_addresses	String	No	IP whitelist	Maximum 1024 characters; multiple IPs separated by commas	`192.168.1.1,10.0.0.1`
type	String	Yes	API key type	Only supports `BROKER_API` (fixed param)	`BROKER_API`
broker_id	String	Yes	Broker ID	Maximum 256 characters (used when `type=BROKER_API`)	`broker_12345`

Request Example:

{
  "name": "my_api_key",
  "permissions": ["READ", "TRADE", "TRANSFER"],
  "ip_addresses": "192.168.1.1 192.168.1.2",
  "passphrase": "my_passphrase",
  "type": "BROKER_API",
  "broker_id": "broker_001"
}

Response Example:

{
  "code": 200,
  "msg": "Success",
  "data": {
    "apiKey": "AKxxxxxxxxxxxxxxxx",
    "secretKey": "SKxxxxxxxxxxxxxxxx"
  },
  "timestamp": 1234567890
}

Response Parameters

Parameter	Description
data.apiKey	The created API key.
data.secretKey	The corresponding secret key. Store securely — it is returned only once.

Failure Response Example:

{
  "code": 400,
  "msg": "Validation failed: name is null; permissions size must be between 1 and 10",
  "data": null,
  "timestamp": 1234567890
}

Broker Commission API

Coming soon. In the meantime, commission and rebate data are available in the Broker Workbench Dashboard.

Error Codes

All Resource APIs return a consistent error structure. Use the code and msg fields to handle errors in your app.

Error Code	HTTP Status	Description	Handling Suggestion
400	400 Bad Request	Invalid request parameters (e.g., non-existent `coin`, mismatched `coin`/`chain`, missing fields).	Check if parameters match BloFin’s specs (e.g., `coin`/`chain` pairs, uppercase format).
401	401 Unauthorized	`access_token` is missing, invalid, or expired.	1. Verify the `access_token` in the Authorization header. 2. If expired, use `refresh_token` to get a new one. 3. If `refresh_token` is invalid, redirect the user to re-authorize.
403	403 Forbidden	`access_token` lacks the required permission for the API (e.g., calling `/oauth/deposit/address` without `deposit:address` scope).	1. Check if your `access_token` includes the required scope (via the `scope` field in the token response). 2. Re-initiate authorization with the missing scope added to the `scope` parameter.
500	500 Internal Server Error	BloFin server-side error (e.g., database issue, address generation failure).	1. Record the error details (timestamp, request ID if available). 2. Retry the request after 30 seconds (avoid rapid retries). 3. If the error persists for over 1 hour, contact `[email protected]`.
503	503 Service Unavailable	BloFin API is temporarily down (e.g., maintenance).	1. Check BloFin’s API status page for updates. 2. Retry after the maintenance window (typically 1–2 hours).

Supported Chains & Coins

The latest list of supported coin/chain pairs is maintained separately. Contact the BloFin Business Team for the current Chain & Coin list.

Legacy APIs

The following Resource APIs require the deposit:status / deposit:address scopes, which are available only to OAuth apps created previously (legacy apps). They are not available to new OAuth apps created via the Broker Workbench. General rules and error codes are the same as for other Resource APIs.

Check First Deposit Status

Check whether the authorized user has completed their first deposit on BloFin.

Required permission: deposit:status (legacy OAuth apps only — not available to OAuth apps created via the Broker Workbench).

HTTP Request

GET https://oauth.blofin.com/oauth/deposit/status

Request Parameters

None (all info is derived from the access_token).

Response Example:

{
  "code": 200,
  "msg": "Success",
  "data": {
    "uid": 12345,
    "has_first_deposit": true
  },
  "timestamp": 1704067200000
}

Response Parameters

Parameter	Description
data.uid	Desensitized user ID.
data.has_first_deposit	`true` = user completed first deposit; `false` = not completed.

Failure Response Example (Expired Token):

{
  "code": 401,
  "msg": "Access token is invalid or expired",
  "data": null,
  "timestamp": 1704067200000
}

Get Deposit Address

Get the authorized user’s deposit address for a specified currency and chain.

Required permission: deposit:address (legacy OAuth apps only — not available to OAuth apps created via the Broker Workbench).

HTTP Request

POST https://oauth.blofin.com/oauth/deposit/address

Request Parameters

Parameter	Type	Required	Description
coin	String	Yes	Currency code (uppercase, e.g., `USDT`, `BTC`). Must be in BloFin’s supported currency list.
chain	String	Yes	Chain type (e.g., `Tron (TRC20)`, `Ethereum (ERC20)`). Must match the `coin` (e.g., `BTC` does not support TRC20).

Request Example:

{
  "coin": "USDT",
  "chain": "Tron (TRC20)"
}

Response Example:

{
  "code": 200,
  "msg": "Success",
  "data": {
    "address": "TQn9Y2khEsLJW1ChVWFMSMeRDow5KcbLSE",
    "tag": "xxx",
    "chainType": "Tron (TRC20)"
  },
  "timestamp": 1704067200000
}

Response Parameters

Parameter	Description
data.address	User’s deposit address for the specified coin/chain.
data.tag	Address tag/memo (if applicable for the chain).
data.chainType	The chain in your request parameter.

Failure Response Example (Invalid Coin/Chain):

{
  "code": 400,
  "msg": "Invalid coin or chain: BTC does not support TRC20",
  "data": null,
  "timestamp": 1704067200000
}

Note: Get the latest list of supported coin/chain pairs from the BloFin Business Team. See also Supported Chains & Coins.

Broker Program

Introduction

Broker Types

Broker Benefits

How to Apply

Get Rebate Guide

API Broker

Introduction

Integration Flow

Common APIs for Brokers

OAuth Broker (Fast API)

Introduction

Base URLs

Preparation before Integration

Authorization Flow

Usage of Token

Permission Scopes

Second-Level Scopes of create:apikey (User-Authorized Scopes)

Authorization API

Get Authorization Code

Get Refresh Token

Resource APIs

General Rules

Get Authorized User Info

Create API Key

Broker Commission API

Error Codes

Supported Chains & Coins

Legacy APIs

Check First Deposit Status

Get Deposit Address

Second-Level Scopes of `create:apikey` (User-Authorized Scopes)