Overview
Every Shoonya API call runs against an authenticated session. Shoonya issues a Acesstoken after a successful login, which you attach to every subsequent request. There is no separate long-lived API key model — the token itself is your credential, and it is valid for 24 hours only from the moment it is generated.
How to authenticate
All integrations
Manual Authentication (OAuth) — see
guide
OAuth is currently the only supported login flow — there is no TOTP auto-login and no separate token-renewal endpoint. See Manual Authentication (OAuth) for the full authorize URL, redirect handling, and checksum reference.
Session lifetime
An access token is valid for 24 hours only from the time it is generated. Every fresh login must generate a new access token — tokens cannot be extended, refreshed, or reused once they expire. This is a SEBI compliance requirement for retail algo trading.
Since there's no renewal call, build your automation to re-run the full OAuth login flow for every new session rather than assuming a persistent long-running token — see Manual Authentication (OAuth) for how to automate this.
ConventionEvery endpoint in this documentation that requires auth expects the token as a Bearer header: Authorization: Bearer <Acesstoken>.
Security notes
- Never hardcode
client_id, secret_code, or the OAuth code/checksum in source control — load them from environment variables or a secrets manager.
- Treat
Acesstoken as a bearer credential with the same sensitivity as a password: don't log it, don't put it in error messages sent to third-party monitoring tools.
- If you suspect a token has leaked, call Logout immediately to invalidate the session rather than waiting for the token to expire.
Notes
OAuth-specific security considerations (state parameter, PKCE, redirect URI validation) are covered on Manual Authentication (OAuth).
Overview
Every Shoonya API call runs against an authenticated session. Shoonya issues a
Acesstokenafter a successful login, which you attach to every subsequent request. There is no separate long-lived API key model — the token itself is your credential, and it is valid for 24 hours only from the moment it is generated.How to authenticate
OAuth is currently the only supported login flow — there is no TOTP auto-login and no separate token-renewal endpoint. See Manual Authentication (OAuth) for the full authorize URL, redirect handling, and checksum reference.
Session lifetime
An access token is valid for 24 hours only from the time it is generated. Every fresh login must generate a new access token — tokens cannot be extended, refreshed, or reused once they expire. This is a SEBI compliance requirement for retail algo trading.
Since there's no renewal call, build your automation to re-run the full OAuth login flow for every new session rather than assuming a persistent long-running token — see Manual Authentication (OAuth) for how to automate this.
Authorization: Bearer <Acesstoken>.Security notes
client_id,secret_code, or the OAuthcode/checksum in source control — load them from environment variables or a secrets manager.Acesstokenas a bearer credential with the same sensitivity as a password: don't log it, don't put it in error messages sent to third-party monitoring tools.Notes
OAuth-specific security considerations (state parameter, PKCE, redirect URI validation) are covered on Manual Authentication (OAuth).