☰
›

Fresh request_token rejected by /session/token with HTTP 403 - Token is invalid or has expired

ROHANKUTE
ROHANKUTE in Python client
Hello Kite Connect team,

I am setting up a Personal Kite Connect API application for my own Zerodha account. I am unable to exchange a freshly generated request_token for an access_token.

The important point is that the Zerodha login succeeds and a fresh request_token is generated, but the /session/token API immediately rejects it with HTTP 403.

Application details:

- App type: Personal
- App status: Active
- Kite Connect app: Zerodha Exit Bridge
- Zerodha Client ID configured in the app matches the Zerodha account being used for login
- Redirect URL: http://127.0.0.1:8000
- Postback URL: not required for this authentication test

Environment:

- Server: AWS Lightsail Ubuntu
- Python: Python 3.12
- KiteConnect Python client: 5.2.1
- API version: v3

Authentication steps:

1. I generate the Kite login URL using the API key.
2. Zerodha login succeeds normally.
3. Zerodha redirects to the registered redirect URL with:
action=login&type=login&status=success&request_token=...
4. I extract the request_token directly from the successful redirect URL.
5. I immediately call:

kite.generate_session(request_token, api_secret)

6. The request reaches:
POST https://api.kite.trade/session/token

7. Zerodha returns HTTP 403:

Token is invalid or has expired.

I have repeated this process with multiple freshly generated request_tokens, including a fresh token used immediately after login. The same error occurs every time.

I have also verified:

- API key is correct.
- API secret belongs to the same Kite Connect application.
- API secret has no leading/trailing whitespace.
- Zerodha Client ID matches the Personal API application's Client ID.
- Kite Connect application is Active.
- Redirect URL is correctly configured.
- KiteConnect version is 5.2.1.
- The request reaches api.kite.trade successfully.

I also independently verified the checksum.

The checksum is calculated as:

SHA256(api_key + request_token + api_secret)

The manually calculated checksum exactly matches the checksum generated by the official KiteConnect 5.2.1 SDK.

Therefore the request being sent contains the correct API key, fresh request_token and checksum.

Debug output from KiteConnect shows:

POST https://api.kite.trade/session/token

HTTP 403

Response:
{"status":"error","message":"Token is invalid or has expired.","data":null,"error_type":"TokenException"}

The Python traceback ends with:

kiteconnect.exceptions.TokenException: Token is invalid or has expired.

Could you please check the API application/API key from your side and confirm why a freshly generated request_token is being rejected?

Specifically, could you please check whether there is any account-side or application-side restriction affecting session/token generation for this Personal API application?

I have intentionally not included the API secret, request_token or access_token in this public post.

I can provide the API key privately if required for you to investigate the application.

Thank you.
Tagged:
  • salim_chisty
    salim_chisty
    The error message indicates that your access token might have expired. To resolve this, you need to fetch a new access token. Please note that the exchange mandates traders log in manually at least once a day, and we do not recommend automating the login process.

    Here are the key details:
    - Access tokens are flushed daily at 7:30 AM, and new tokens are generated at 7:35 AM.
    - Ensure you generate the access token after 7:35 AM on the same trading day. The token will remain valid throughout the day unless you log out.

    For more details, you can refer to the documentation for the login flow or check a similar discussion here.​
Sign In or Register to comment.