I am facing a persistent authentication issue with my Kite Connect Connect application.
Application details:
App type: Connect App status: Active API key length: 16 characters API secret length: 32 characters Redirect URL configured in Kite Developer Console: http://127.0.0.1:8000/api/kite/callback
I am using the official Python SDK (kiteconnect 5.2.1).
The login flow successfully redirects to my callback and provides a fresh request_token of 32 characters. However, exchanging the token consistently returns:
TokenException: Invalid `checksum`.
I have isolated the issue from my application code:
The API key and API secret used by the application exactly match the environment credentials. KiteConnect.generate_session(request_token, api_secret) is being called with the correct parameters. I inspected the SDK source and confirmed it calculates the checksum as: SHA256(api_key + request_token + api_secret) The generated checksum is 64 hexadecimal characters. I tested the exact same fresh request token received from the Kite callback directly with the official KiteConnect 5.2.1 SDK, outside my application. The direct SDK exchange also returns: TokenException: Invalid `checksum`. I also tested the /session/token endpoint directly using the same API key, request token and SHA-256 checksum. The request was rejected with the same error. The API secret has already been regenerated twice today, with no change in behavior. The redirect URL has been verified against the Developer Console and matches exactly. The application is currently Active.
Interestingly, an earlier independent request-token exchange using the same SDK/API setup returned HTTP 200 and successfully produced an access token. Fresh tokens generated through the current login flow consistently fail with Invalid checksum.
Could you please check whether there is an issue with the Kite Connect application's authentication/session-token generation or backend validation for this app?
I can provide timestamps, request-token fingerprints, SDK version, and additional diagnostic information if required. I will not send the API secret or access token publicly.
We have checked this from our end and could not identify any issue. An Invalid checksum error generally indicates that the api_key, api_secret, or request_token being used is incorrect or does not correspond to the same authentication session. We have verified the Python SDK and found no issues.
Please try generating the access token using a standalone login script instead of your application. This will help isolate whether the issue is related to the credentials or your application's authentication flow.
We recommend following the login flow as outlined in the Kite Connect API documentation. Additionally, you can refer to this webinar for a detailed walkthrough.
Please try generating the access token using a standalone login script instead of your application. This will help isolate whether the issue is related to the credentials or your application's authentication flow.
We recommend following the login flow as outlined in the Kite Connect API documentation. Additionally, you can refer to this webinar for a detailed walkthrough.