Yes apart from the different sub domain for live and dev respectively the endpoint of the redirect url is completely same. And the permission levels are also same for both the apps.
Also, as far as the log is concerned the issue is that we are getting the request token on our redirect url. The whole backend server functionality of fetching the access token using the request token starts post that.
Hey, can you please refer to the screen recordings for both the environments namely, Live and Testing.
LIVE - https://www.dropbox.com/s/3kclpcidyzuu051/ZerodhaLive.mov?dl=0
DEV - https://www.dropbox.com/s/9f65ybybebipvnz/ZerodhaWebTesting.mov?dl=0
Also, it's not among the issues mentioned above. The strange thing is there are other holdings too that have a finite number of shares and it is coming correct in the API.