Could Zerodha introduce a separately scoped, read-only credential for personal Kite Connect applications?
My use case is a personal risk assistant that monitors active F&O positions, expiries, and position risk. It does not place, modify, or cancel orders.
I understand that NSE/INVG/67858 requires API sessions to be logged out before the next trading day, while NSE/COMP/68635 requires EOD logout and fresh 2FA for IBT/STWT sessions.
However, the API implementation standard appears under “API Access Standards for Clients in Trading” and discusses connectivity used for automated buying and selling. Could Zerodha Compliance clarify whether it also prohibits a completely separate credential that is technically incapable of sending an order?
A possible design would be:
> positions:read, orders:read, and trades:read only
> No write endpoints whatsoever
> Short-lived access tokens renewed using a revocable, read-only refresh credential
> Static IP/device binding, audit logs, and periodic re-consent
> Normal trading-capable sessions still terminated daily
Kite Connect documentation already states that long-standing read permission is available to certain approved platforms.
What exact regulatory clause prevents Zerodha from offering an appropriately restricted version to individual users, and is there an approval pathway for it?
This would help users monitor existing leveraged or expiring positions without creating unattended order-execution risk.
