Overview
Shoonya only accepts authenticated API requests from IP addresses you've explicitly registered against your Client ID. Before you can complete the OAuth login flow or call any endpoint, you need to whitelist the static IP (or IPs) your requests will come from, using the API Key Generation screen inside the trading account.
Purpose
This is a one-time (or occasional, if your server IP changes) setup step — do this before writing any integration code, not while debugging a mysterious auth failure. It's also where you'll find your Client ID and Secret Code, both required inputs for the GenAcsTok checksum.
Steps
- Log in to your Shoonya trading account (web).
- Click your profile icon, then open API Key Generation.
- Confirm the Client ID shown matches the account you intend to trade through.
- Reveal (eye icon) and copy the Secret Code — this is the
secret_code input to the GenAcsTok checksum. Treat it like a password; never commit it to source control.
- Confirm the URL field shows the OAuth authorize endpoint for your IP type —
https://api.shoonya.com/OAuthlogin/authorize/oauth if you registered an IPv4 address, or https://trade.shoonya.com/OAuthlogin/authorize/oauth if you registered an IPv6 address. See IP address format below.
- Enter your Primary IP Address — the static public IPv4 or IPv6 address your requests will originate from (your server/VPS IP, not your laptop's home/office IP unless that's genuinely static).
- Optionally set a Backup IP Address if you run a failover server.
- If you expect to exceed 10 orders/second, check "Applicable for more than 10 orders per second" — see the callout below before enabling this.
- Click Update to save.
Both IPv4 and IPv6 are supported for the primary/backup IP fields. Both full and compressed IPv6 formats are accepted. For example, 2001:0db8:0000:0000:0000:ff00:0042:8329 and the compressed format 2001:db8::ff00:42:8329 are valid IPv6 addresses.
The domain you use for the OAuth authorize URL depends on the IP version your requests originate from:
| IP version | Domain | Authorize URL |
|---|
| IPv4 | api.shoonya.com | https://api.shoonya.com/OAuthlogin/authorize/oauth |
| IPv6 | trade.shoonya.com | https://trade.shoonya.com/OAuthlogin/authorize/oauth |
IPv4 is enabled on the api.shoonya.com domain. If your server connects over IPv6, change the domain in the redirect/authorize URL to trade.shoonya.com.
Static IP requiredThe registered IP must be static. If you're running from a residential/dynamic-IP connection, requests will start failing with an auth/IP error whenever your ISP reassigns your address — host your integration on a server or VPS with a fixed IP instead.
Order-rate checkbox and Algo ID
The "Applicable for more than 10 orders per second" checkbox is not a self-service performance toggle — ~10 orders/sec is the standard per-user order-placement ceiling described on Rate Limits. To legitimately exceed it, you must first submit your strategy to the exchange and obtain a SEBI Algo ID; see SEBI Algo ID Framework for the approval process. Checking this box without a corresponding exchange-approved Algo ID does not raise your actual throughput — it only tells Shoonya to expect Algo ID-tagged traffic.
After whitelisting
Once your IP is registered, continue to Manual Authentication (OAuth) to run the authorize → code → checksum → access-token exchange using the Client ID and Secret Code from this screen.
Troubleshooting
| Symptom | Likely cause |
|---|
| OAuth/API calls fail immediately, even with a valid checksum | Requests are originating from an IP that isn't whitelisted — confirm the IP your server actually egresses on (it may differ from the IP you think it has, especially behind NAT/a load balancer) matches what's registered here. |
| Worked yesterday, failing today with no code changes | Your "static" IP was reassigned by your ISP/cloud provider. Re-check and update the Primary IP Address field. |
| Works from your laptop, fails from your server | You whitelisted your laptop's IP during testing instead of your production server's IP — update the field to the server's egress IP before deploying. |
| IPv6 server fails on the authorize/login step | The authorize URL is still using api.shoonya.com — IPv6 connections must use trade.shoonya.com instead. |
Notes
See For Vendors / Partners if you're integrating on behalf of multiple end users rather than trading a single account — vendor platforms generally handle IP whitelisting differently than a standalone OAuth user.
Overview
Shoonya only accepts authenticated API requests from IP addresses you've explicitly registered against your Client ID. Before you can complete the OAuth login flow or call any endpoint, you need to whitelist the static IP (or IPs) your requests will come from, using the API Key Generation screen inside the trading account.
Purpose
This is a one-time (or occasional, if your server IP changes) setup step — do this before writing any integration code, not while debugging a mysterious auth failure. It's also where you'll find your
Client IDandSecret Code, both required inputs for the GenAcsTok checksum.Steps
secret_codeinput to the GenAcsTok checksum. Treat it like a password; never commit it to source control.https://api.shoonya.com/OAuthlogin/authorize/oauthif you registered an IPv4 address, orhttps://trade.shoonya.com/OAuthlogin/authorize/oauthif you registered an IPv6 address. See IP address format below.IP address format
Both IPv4 and IPv6 are supported for the primary/backup IP fields. Both full and compressed IPv6 formats are accepted. For example,
2001:0db8:0000:0000:0000:ff00:0042:8329and the compressed format2001:db8::ff00:42:8329are valid IPv6 addresses.The domain you use for the OAuth authorize URL depends on the IP version your requests originate from:
api.shoonya.comhttps://api.shoonya.com/OAuthlogin/authorize/oauthtrade.shoonya.comhttps://trade.shoonya.com/OAuthlogin/authorize/oauthIPv4 is enabled on the
api.shoonya.comdomain. If your server connects over IPv6, change the domain in the redirect/authorize URL totrade.shoonya.com.Order-rate checkbox and Algo ID
The "Applicable for more than 10 orders per second" checkbox is not a self-service performance toggle — ~10 orders/sec is the standard per-user order-placement ceiling described on Rate Limits. To legitimately exceed it, you must first submit your strategy to the exchange and obtain a SEBI Algo ID; see SEBI Algo ID Framework for the approval process. Checking this box without a corresponding exchange-approved Algo ID does not raise your actual throughput — it only tells Shoonya to expect Algo ID-tagged traffic.
After whitelisting
Once your IP is registered, continue to Manual Authentication (OAuth) to run the authorize → code → checksum → access-token exchange using the Client ID and Secret Code from this screen.
Troubleshooting
api.shoonya.com— IPv6 connections must usetrade.shoonya.cominstead.Notes
See For Vendors / Partners if you're integrating on behalf of multiple end users rather than trading a single account — vendor platforms generally handle IP whitelisting differently than a standalone OAuth user.