Kite Connect authentication errors: invalid app code and incorrect api_key or access_token

Sun, 21 Jun 2026 00:00:00 +0000

Kite Connect authentication errors fall into two layers that are often confused: the human Kite login, where “Invalid app code” means the second-factor code failed, and the Kite Connect API , where “Incorrect api_key or access_token” means a programmatic session is invalid or expired. The first is almost always a device-clock problem on the time-based login code; the second is almost always the daily 6 a.m. expiry of a Kite Connect access token, returned to your program as an HTTP 403 with a TokenException. They look similar because both involve a token and both block access, but they sit at different layers and have different fixes.

How to generate the request_token and access_token on Kite Connect

Tue, 12 May 2026 00:00:00 +0000

Every Kite Connect API session requires a fresh access_token that is valid for the current trading day. Generating an access_token involves a two-step OAuth-style flow: the user logs in through Zerodha’s browser-based consent screen to obtain a request_token, and the server then exchanges that request_token, along with a cryptographic checksum, for an access_token. This guide explains both steps using the official kiteconnect Python SDK .

How the token flow works

Kite Connect’s authentication is modelled on OAuth 2.0 with a custom checksum step. The flow has three actors: your application, the user’s browser, and Zerodha’s API server.

Access_token on WebNotes

Kite Connect authentication errors: invalid app code and incorrect api_key or access_token

How to generate the request_token and access_token on Kite Connect

How the token flow works