Overview
Shoonya only accepts authenticated API requests from IP addresses you've explicitly registered against your Client ID. Before you can complete the OAuth login flow or call any endpoint, you need to whitelist the static IP (or IPs) your requests will come from, using the API Key Generation screen inside the trading account.
Purpose
This is a one-time (or occasional, if your server IP changes) setup step — do this before writing any integration code, not while debugging a mysterious auth failure. It's also where you'll find your Client ID and Secret Code, both required inputs for the GenAcsTok checksum.
Steps
- Log in to your Shoonya trading account (web).
- Click your profile icon, then open API Key Generation.
- Confirm the Client ID shown matches the account you intend to trade through.
- Reveal (eye icon) and copy the Secret Code — this is the
secret_code input to the GenAcsTok checksum. Treat it like a password; never commit it to source control.
- Confirm the URL field reads
https://api.shoonya.com/OAuthlogin/authorize/oauth — this is the OAuth authorize endpoint your login flow redirects to.
- Enter your Primary IP Address — the static public IPv4 address your requests will originate from (your server/VPS IP, not your laptop's home/office IP unless that's genuinely static).
- Optionally set a Backup IP Address if you run a failover server.
- If you expect to exceed 10 orders/second, check "Applicable for more than 10 orders per second" — see the callout below before enabling this.
- Click Update to save.
Only IPv4 and IPv6 are supportedfor the primary/backup IP fields. Both full and compressed IPv6 formats are accepted. For example, 2001:0db8:0000:0000:0000:ff00:0042:8329 and the compressed format 2001:db8::ff00:42:8329 are valid IPv6 addresses.
Static IP requiredThe registered IP must be static. If you're running from a residential/dynamic-IP connection, requests will start failing with an auth/IP error whenever your ISP reassigns your address — host your integration on a server or VPS with a fixed IP instead.
Order-rate checkbox and Algo ID
The "Applicable for more than 10 orders per second" checkbox is not a self-service performance toggle — ~10 orders/sec is the standard per-user order-placement ceiling described on Rate Limits. To legitimately exceed it, you must first submit your strategy to the exchange and obtain a SEBI Algo ID; see SEBI Algo ID Framework for the approval process. Checking this box without a corresponding exchange-approved Algo ID does not raise your actual throughput — it only tells Shoonya to expect Algo ID-tagged traffic.
After whitelisting
Once your IP is registered, continue to Manual Login (OAuth) to run the authorize → code → checksum → access-token exchange using the Client ID and Secret Code from this screen.
Troubleshooting
| Symptom | Likely cause |
|---|
| OAuth/API calls fail immediately, even with a valid checksum | Requests are originating from an IP that isn't whitelisted — confirm the IP your server actually egresses on (it may differ from the IP you think it has, especially behind NAT/a load balancer) matches what's registered here. |
| Worked yesterday, failing today with no code changes | Your "static" IP was reassigned by your ISP/cloud provider. Re-check and update the Primary IP Address field. |
| Works from your laptop, fails from your server | You whitelisted your laptop's IP during testing instead of your production server's IP — update the field to the server's egress IP before deploying. |
Notes
See For Vendors / Partners if you're integrating on behalf of multiple end users rather than trading a single account — vendor platforms generally handle IP whitelisting differently than a standalone OAuth user.
Overview
Shoonya only accepts authenticated API requests from IP addresses you've explicitly registered against your Client ID. Before you can complete the OAuth login flow or call any endpoint, you need to whitelist the static IP (or IPs) your requests will come from, using the API Key Generation screen inside the trading account.
Purpose
This is a one-time (or occasional, if your server IP changes) setup step — do this before writing any integration code, not while debugging a mysterious auth failure. It's also where you'll find your
Client IDandSecret Code, both required inputs for the GenAcsTok checksum.Steps
secret_codeinput to the GenAcsTok checksum. Treat it like a password; never commit it to source control.https://api.shoonya.com/OAuthlogin/authorize/oauth— this is the OAuth authorize endpoint your login flow redirects to.IP address format
Only IPv4 and IPv6 are supportedfor the primary/backup IP fields. Both full and compressed IPv6 formats are accepted. For example,
2001:0db8:0000:0000:0000:ff00:0042:8329and the compressed format2001:db8::ff00:42:8329are valid IPv6 addresses.Order-rate checkbox and Algo ID
The "Applicable for more than 10 orders per second" checkbox is not a self-service performance toggle — ~10 orders/sec is the standard per-user order-placement ceiling described on Rate Limits. To legitimately exceed it, you must first submit your strategy to the exchange and obtain a SEBI Algo ID; see SEBI Algo ID Framework for the approval process. Checking this box without a corresponding exchange-approved Algo ID does not raise your actual throughput — it only tells Shoonya to expect Algo ID-tagged traffic.
After whitelisting
Once your IP is registered, continue to Manual Login (OAuth) to run the authorize → code → checksum → access-token exchange using the Client ID and Secret Code from this screen.
Troubleshooting
Notes
See For Vendors / Partners if you're integrating on behalf of multiple end users rather than trading a single account — vendor platforms generally handle IP whitelisting differently than a standalone OAuth user.