I am facing a persistent authentication issue with my Kite Connect Connect application.
Application details:
App type: Connect App status: Active API key length: 16 characters API secret length: 32 characters Redirect URL configured in Kite Developer Console: http://127.0.0.1:8000/api/kite/callback
I am using the official Python SDK (kiteconnect 5.2.1).
The login flow successfully redirects to my callback and provides a fresh request_token of 32 characters. However, exchanging the token consistently returns:
TokenException: Invalid `checksum`.
I have isolated the issue from my application code:
The API key and API secret used by the application exactly match the environment credentials. KiteConnect.generate_session(request_token, api_secret) is being called with the correct parameters. I inspected the SDK source and confirmed it calculates the checksum as: SHA256(api_key + request_token + api_secret) The generated checksum is 64 hexadecimal characters. I tested the exact same fresh request token received from the Kite callback directly with the official KiteConnect 5.2.1 SDK, outside my application. The direct SDK exchange also returns: TokenException: Invalid `checksum`. I also tested the /session/token endpoint directly using the same API key, request token and SHA-256 checksum. The request was rejected with the same error. The API secret has already been regenerated twice today, with no change in behavior. The redirect URL has been verified against the Developer Console and matches exactly. The application is currently Active.
Interestingly, an earlier independent request-token exchange using the same SDK/API setup returned HTTP 200 and successfully produced an access token. Fresh tokens generated through the current login flow consistently fail with Invalid checksum.
Could you please check whether there is an issue with the Kite Connect application's authentication/session-token generation or backend validation for this app?
I can provide timestamps, request-token fingerprints, SDK version, and additional diagnostic information if required. I will not send the API secret or access token publicly.
