Persistent HTTP 403 Invalid checksum during Kite Connect authentication

sbabu29

Hello Zerodha Kite Connect Team,

I am facing a persistent authentication issue with my active Kite Connect app.

I have followed the official Kite Connect V3 authentication flow.

Details:

1. My Kite Connect app is active.
2. I successfully complete Zerodha login and authorization.
3. I generate a fresh request_token.
4. The request_token length is 32 characters.
5. I generated the SHA-256 checksum using:
api_key + request_token + api_secret
6. There are no leading or trailing spaces in the API key, API secret, or request token.
7. I am using the official Python KiteConnect package version 5.2.1.

I tested the authentication in two different ways.

TEST 1:
Official Python KiteConnect SDK

Result:
TokenException: Invalid `checksum`

TEST 2:
Direct POST request to:
https://api.kite.trade/session/token

Result:
HTTP 403
Zerodha message: Invalid `checksum`
Error type: TokenException

Therefore, both the official Python SDK and the direct API request are returning the same Invalid checksum error.

Could you please check whether there is any issue with my Kite Connect app/API-key configuration or authentication on the server side?

I can provide non-sensitive diagnostic details if required.

I am not posting my API secret, request token, or access token publicly.

Thank you.

sbabu29

UPDATE:

I have now created a completely new Active Kite Connect app specifically to isolate this issue.

The new app was successfully created and authorized with a fresh Zerodha login and a fresh request_token.

I then tested the new app using:

1. Official KiteConnect Python SDK
2. Independent direct HTTPS POST to /session/token
3. Standalone diagnostic script

Both tests return:

HTTP 403
Invalid checksum

The local checks also confirm:
- request_token length: 32
- API key has no leading/trailing spaces
- API secret has no leading/trailing spaces
- request_token has no leading/trailing spaces
- SHA-256 checksum length: 64

The same problem therefore occurs with BOTH my old Connect app and a newly created Connect app.

Could you please check from Zerodha's side whether there is any account-side, application-side, or backend issue affecting session-token generation for my account/apps?

No API secret, request_token or access_token is being shared publicly.

Thank you.