Access token becomes invalid (403) without explicit logout. Does re-generating access_token for same

vaishali_yadav

I'm seeing intermittent 403 errors on a long-running process using the Kite Connect API, even though no explicit logout was called and the token should still be within its daily validity window (tokens are supposed to be valid until roughly 6am the next day).

My current understanding, based on what I've read:

1. The Kite web/app session and the Kite Connect API session are distinct. An access_token obtained through the API login flow is tied to that flow, not to the browser session, so logging into the web app on its own should not invalidate an active API token.

2. What does invalidate an access_token: daily expiry, generating a new access_token for the same api_key (which drops the previous one), and an explicit logout call.

My hypothesis is that something else in my setup, a scheduled restart, a second process, or a health check script, is re-running the login flow and generating a new access_token for the same api_key. This invalidates the token my main process is holding, resulting in a 403 that looks like it's coming from nowhere.

Can someone confirm:

- Does generating a new access_token for the same api_key immediately invalidate the previous token, independent of daily expiry or explicit logout?
- Does logging into the Kite web/app session have any effect on an active API session's access_token, or are the two completely independent?

I've started logging the token generation timestamp on every auth to correlate against failure times. Happy to share timestamps if that helps debug further.

vaishali_yadav

Comments are appreciated!

nagavenij

Generating a new access token for the same API key may invalidate the previously generated access token. The access token otherwise remains valid until its daily expiry or until it is explicitly invalidated through the logout flow. If another process, scheduled job, or login flow generates a new access token using the same API key, the token being used by the existing process may become invalid and potentially result in a 403 error.
You may refer to this similar discussion.

The Kite Web/App login session and the Kite Connect API session are independent. Logging into Kite Web/App does not invalidate an active Kite Connect access token. You may refer to this forum discussion.