Persistent "Invalid checksum" Error After API Secret Regeneration

thejasvvl
Issue Summary:
Getting consistent "Invalid checksum" error when converting request token to access token, even after regenerating API secret and using fresh request tokens.

App Details:
- API Key: k6uu6hybqx5qmwbb
- App Name: SSScreener ML System
- App Status: Active
- Subscription: Valid (expires Oct 15, 2025)

What I've Tried:

1. Regenerated API Secret multiple times in developer console
2. Used fresh request tokens immediately after generation
3. Verified checksum calculation using multiple MD5 calculators
4. Tested different request formats (form-data, JSON, headers)
5. Cleared browser cache and used incognito mode
6. Waited for propagation (several hours between attempts)

Technical Details:

Request Format:
POST https://api.kite.trade/session/token
Content-Type: application/x-www-form-urlencoded
X-Kite-Version: 3

Body:
api_key=k6uu6hybqx5qmwbb
request_token=[fresh_token_from_login]
checksum=[calculated_md5_hash]

Checksum Calculation:
String: api_key + request_token + api_secret
MD5 Hash: Verified correct using online calculators

Current Error:
{
"status": "error",
"message": "Invalid `checksum`.",
"data": null,
"error_type": "TokenException"
}

Timeline:
- Yesterday: System working perfectly with existing access token
- Today morning: Access token expired (normal daily expiration)
- Current: Unable to generate new access token despite multiple attempts

Questions:
1. Is there a known propagation delay for regenerated API secrets?
2. Could there be a server-side caching issue preventing new secret recognition?
3. Any additional steps required after API secret regeneration?

System was working fine until normal token expiration occurred. Any guidance would be appreciated!
  • nagavenij
    You may refer to this discussion. Please ensure that the API key is not displayed for security reasons.
  • salim_chisty
    Access tokens are flushed every day at 7:30 AM, and a new one is generated every day at 7:35 AM. So, make sure you generate an access token post 7:35 AM on the same trading day and it can be used throughout the day, unless logout. You may refer to the similar discussion here.

    Please ensure you follow the login flow as outlined in the Kite Connect API documentation, and refer to this webinar walkthrough for a better understanding.
  • sram
    I followed the suggested standalone login-script test.

    The standalone Python script using Kite Connect SDK 5.2.1 also fails during generate_session().

    API key length: 16
    API secret length: 32
    Request token length: 32
    Request token has no whitespace
    API key and API secret match the active app
    API secret was regenerated
    Fresh request token is used immediately

    The standalone SDK call returns:

    TokenException: Invalid checksum

    The direct /session/token request also returns HTTP 403:

    {"status":"error","error_type":"TokenException","message":"Invalid checksum."}

    Please check whether there is an issue with the newly created Kite Connect app/session authentication on the server side.

    Thanks,
    Siva
Sign In or Register to comment.