Zerodha OAuth Authentication

Kite Connect OAuth login flow

From WebNotes, a public knowledge base. Last updated . Reading time ~3 min.

Kite Connect uses OAuth 2.0 for authentication. End-to-end flow:

1. App registration

Create app at kite.trade :

  • Set redirect URL.
  • Get api_key and api_secret.

2. User authorization

Redirect user to:

https://kite.zerodha.com/connect/login?v=3&api_key=<api_key>

User logs into Zerodha; on success, Zerodha redirects to your redirect_url with a request_token query parameter.

3. Exchange request token for access token

POST to /session/token with:

  • api_key
  • request_token
  • checksum (SHA-256 of api_key + request_token + api_secret)

Response includes access_token, valid for the trading day.

4. Use access token

Pass in Authorization header:

Authorization: token <api_key>:<access_token>

5. Token lifecycle

  • Access token expires at end of trading day.
  • Renew daily via OAuth flow.
  • No refresh token model.

For implementation: Sign up and get Kite API key and Kite Connect access token generation .

See also

External references

References

  1. Zerodha, Kite Connect authentication, kite.trade.
  2. IETF, OAuth 2.0 RFC 6749, datatracker.ietf.org.

Related articles

Reviewed and published by

WebNotes Editorial Team

The WebNotes Editorial Team covers Indian capital markets, payments infrastructure and retail investor procedures. Every article is fact-checked against primary sources, principally SEBI circulars and master directions, NPCI specifications and the official support documentation published by the intermediary in question. Drafts go through a second-pair-of-eyes review and a separate compliance read before publication, and revisions are tracked against the SEBI and NPCI rule changes referenced in the methodology section.

Last reviewed
Conflicts of interest
WebNotes is independent. No relationship with any broker, registrar or bank named in this article.