Hello Kite Connect Team, I am setting up a Personal Kite Connect API application for my own Zerodha account, and I am unable to exchange a freshly generated request_token for an access_token. The important point is that the Zerodha login flow succeeds normally and a fresh request_token is generated, but the /session/token endpoint immediately rejects it with: HTTP 403 Token is invalid or has expired. error_type: TokenException Application details App type: Personal App status: Active Zerodha Client ID configured in the application matches the Zerodha account being used API Key and API Secret belong to the same Kite Connect application Redirect URL is correctly configured and the login redirects successfully I have intentionally not included my API key, API secret, request token, checksum or access token in this public post. Authentication flow I generate the Kite Connect login URL using my current API key. I login successfully to Zerodha and complete 2FA. Zerodha redirects to my registered Redirect URL with: action=login type=login status=success request_token=... I immediately use this freshly generated request_token. I calculate the checksum as: SHA256(api_key + request_token + api_secret) I then send: POST https://api.kite.trade/session/token with: X-Kite-Version: 3 and form-urlencoded body: api_key=... request_token=... checksum=... Important: I reproduced the problem outside n8n Initially I implemented the authentication flow in n8n, where: Zerodha Login ↓ n8n Webhook ↓ request_token ↓ SHA256 checksum ↓ POST /session/token The webhook successfully receives a fresh request_token, but the /session/token request returns: { "status": "error", "message": "Token is invalid or has expired.", "data": null, "error_type": "TokenException" } To rule out n8n as the cause, I performed an independent test directly from Windows PowerShell, without n8n. The PowerShell test: generated the checksum locally using SHA-256 used the same API key used the same API secret used a newly generated request token immediately after login sent a direct POST request to: https://api.kite.trade/session/token The direct request also returned: HTTP 403 Forbidden with: { "status": "error", "message": "Token is invalid or has expired.", "data": null, "error_type": "TokenException" } Therefore, the problem does not appear to be specific to n8n. Additional checks performed I have verified: API Key is from the active application. API Secret belongs to the same application. Zerodha Client ID configured in the application matches my Zerodha login Client ID. Application status is Active. Redirect URL is correct. Zerodha login succeeds. A fresh request_token is received after every new login. I am not intentionally reusing an old request token. Checksum is generated using: SHA256(api_key + request_token + api_secret) The required X-Kite-Version: 3 header is included. The request body is sent as application/x-www-form-urlencoded. Request Could you please check from your side whether there is any account-side or application-side restriction, session-token issue, or backend issue affecting this Personal Kite Connect application? In particular, could you please verify why a freshly generated request_token is being rejected immediately by /session/token even when the API credentials, Client ID, Redirect URL and checksum have been independently verified? I can provide the API key privately if required for investigation, but I will not post the API secret, request token or access token publicly. Thank you. sudipta kumar jana
