Every Indian broker API expires your session daily. That single fact decides whether a trading bot can start itself at nine in the morning or needs a human present, and it is the most common reason a system that worked yesterday does nothing today.
This covers how the token flow actually works, what your options are, and the security trade-off nobody states clearly before you make it.
Why the browser step exists
Kite Connect's session flow is deliberately interactive. You are sent to a login page, you authenticate there with your credentials and second factor, and the broker redirects back with a request token. Your program exchanges that request token, together with your API secret, for an access token valid for the session.
from kiteconnect import KiteConnect
kite = KiteConnect(api_key=API_KEY)
print(kite.login_url()) # browser me kholo, login karo
# redirect URL se request_token nikaal kar:
data = kite.generate_session(request_token, api_secret=API_SECRET)
kite.set_access_token(data['access_token'])The design is not an oversight. Keeping the credential entry on the broker's own page means your trading password and second factor never pass through your code, which is a genuinely better security position than the alternative.
The cost of that design is the one the broker comparison article named: a bot on a server cannot complete a browser login by itself, so either somebody does it each morning or you build something around it.
The token lifecycle, precisely
Three different strings and people confuse them constantly.
API key and API secret identify your application. They do not expire and they must never appear in code you share or commit.
Request token is single-use and short-lived. It comes back in the redirect after login and is only good for exchanging once.
Access token is what every subsequent call uses. It is valid for the session and expires daily — not after twenty-four hours from creation, but at the broker's daily cutoff, which is why a token generated at 3 pm does not carry you through the next morning.
The failure this produces is quiet. A bot started at 9:00 with yesterday's token does not crash; it gets an authentication error on its first request and, if that is not handled, sits there doing nothing all session while appearing to run.
def ensure_session(kite, token):
try:
kite.set_access_token(token)
kite.profile() # sabse sasta check
return True
except Exception as e:
log.error('token invalid: %s', e)
alert('Broker session expired - login needed')
return FalseCall that before the market opens, not at 9:15. Finding out at the open leaves no time to do anything about it.
The TOTP-based alternative, and how it differs
Some Indian brokers, Angel One's SmartAPI being the widely used example, take a different approach. Instead of a browser redirect, the login accepts a time-based one-time password that your program generates itself from a shared secret.
import pyotp
from SmartApi import SmartConnect
obj = SmartConnect(api_key=API_KEY)
totp = pyotp.TOTP(TOTP_SECRET).now()
data = obj.generateSession(CLIENT_ID, MPIN, totp)
auth = data['data']['jwtToken']That is the whole difference, and its consequence is large: a bot can genuinely start itself with nobody present. For anybody deploying to a server and going to work, this is a material advantage and it is why the choice of broker is partly a choice about this.
The trade-off is equally real and is stated less often. Your TOTP secret now lives on that server. Anybody who obtains it holds your second factor, which is the exact thing two-factor authentication exists to keep separate from everything else. That is not a reason to avoid it, but it is a reason to treat that machine as holding something valuable.
Handling the daily login sensibly, whichever broker you use
Ordered from least to most risk.
Do it manually, deliberately. Five minutes each morning on your phone or laptop, generating the token and storing it where the bot reads it from. Unglamorous, entirely safe, and adequate for a positional strategy that does not need to act at 9:15.
Do it manually, but make it one tap. A small script or page that completes the exchange and writes the token, so your morning routine is a single action rather than several steps. This is where most careful retail traders end up.
Use a broker whose flow is designed for it. If unattended starting genuinely matters to your strategy, choosing a broker with TOTP-based login solves the problem properly rather than working around one that was designed the other way.
Automate the browser flow. Driving a headless browser to complete a login is technically possible and it means your trading password and second factor sit in your own automation. It also tends to break whenever the login page changes, and it may sit uncomfortably with your broker's terms. Read those before building it.
The honest recommendation: if your strategy needs to act in the first minute of the session, choose a broker whose login supports that. If it does not — and most retail strategies do not — the one-tap manual route removes a whole category of risk for a cost of five minutes.
Storing secrets, which is where most people are careless
Everything above assumes your credentials are somewhere sensible, and frequently they are not.
Never in the code. An API secret committed to a repository is exposed even if the repository is private, because it stays in history after you remove it.
Environment variables or a file the repository ignores. Simple, sufficient for a single-user setup, and the minimum bar.
Restrict permissions on the file. On a server, readable only by the user the bot runs as. It is one command and it matters more than it sounds.
Store the daily access token separately from the long-lived secrets. The token rotates and is worth less; the API secret and TOTP secret do not rotate and are worth a great deal.
Rotate if anything looks wrong. Brokers let you regenerate an API secret. Do it if a machine was shared, a repository was public for any period, or a laptop was lost.
The threat here is not sophisticated. It is a secret in a screenshot, in a public repository, or on a machine somebody else uses.
All of this presumes an account with API access, which is where the keys and the session originate.
API credentials come from your broker
The login flow differs by broker, and it decides whether a bot can start itself. Account free to open
Session handling, secret storage and the morning startup sequence are covered in our Algorithmic Trading with Python course at Rs 24,900 — one payment, permanent access, free demo on WhatsApp first.
We sell no tips and no signal group, we manage nobody's money, and we promise no returns. Trading carries a real risk of loss.
Disclosure: the account-opening link on this page is under Atul Shrivastava's Zerodha Authorised Person registration (NSE AP Reg: AP2516003481; Zerodha Broking Ltd. SEBI Reg: INZ000031633) and earns a revenue share. TheFinBaba is not a SEBI-registered Investment Adviser — this content is educational, not investment advice.
Frequently Asked Questions
Why does my Kite Connect access token expire every day?
Sessions are daily by design and expire at the broker's cutoff rather than twenty-four hours after creation. A token generated in the afternoon will not carry you through the next morning, and a bot started with an expired one fails quietly rather than crashing.
Can a Kite Connect bot log in automatically without a browser?
Not through the intended flow, which is deliberately interactive so your credentials stay on the broker's page. Brokers with TOTP-based login, such as Angel One's SmartAPI, allow a program to authenticate itself, which is why the login flow is worth considering when choosing a broker.
Is it safe to store a TOTP secret on a server?
It is a real trade-off. The secret on that machine is your second factor, which is exactly what two-factor authentication exists to keep separate. Treat the server as holding something valuable - restricted file permissions, no sharing, and rotate if anything looks wrong.
Should I automate the browser login with a headless browser?
It is technically possible and comes with two problems: your password and second factor end up inside your own automation, and it breaks whenever the login page changes. It may also sit uncomfortably with your broker's terms, so read those first.
Where should I store my API key and secret?
In environment variables or a file the repository ignores, never in code, with file permissions restricted to the user the bot runs as. Keep the rotating daily token separate from the long-lived API and TOTP secrets.
Related Reading
- Generating a Kite Connect access token in Python
- Choosing a broker for algo trading in India
- Python vs Pine Script vs AmiBroker
- Angel One SmartAPI in Python - tutorial
- Running a trading bot 24x7
- Algorithmic Trading with Python - full syllabus
Disclaimer: TheFinBaba provides educational content only - this is not investment advice. Trading involves risk of loss.
