Official Python wrapper for the Shoonya OAuth API — handles the OAuth handshake, and gives typed methods for orders, market data, positions, and the WebSocket feed.
Overview
The Python SDK (package name NorenRestApiOAuth, class NorenApi) wraps every REST endpoint covered elsewhere in this documentation — orders, market data, positions, holdings, calculators — plus the OAuth login handshake and the WebSocket feed, behind typed Python methods. Use it instead of hand-rolling requests calls against jData/jKey payloads directly.
OAuth build, not password loginThis SDK is built around the OAuth login flow — getOAuthURL → getAccessToken → injectOAuthHeader. It is a separate build from the password/TOTP-based NorenApiPy wrapper; don't mix credential styles between the two.
cred.yml — holds oauth_url, API_KEY, SECRET_KEY, client_id, UID; Access_token and Account_ID are written back to it after login.
Dependencies (from requirements.txt):
Package
Version
Purpose
NorenRestApiOAuth
—
The core API wrapper — the NorenApi class itself.
selenium
>=4.15.0
Browser automation, used for scripting the OAuth login step rather than requiring a manual browser visit each time.
webdriver-manager
>=4.0.0
Automatically downloads and manages the correct browser driver binary for Selenium.
pyotp
>=2.9.0
Generates TOTP codes programmatically for the 2FA step of an automated login.
Selenium is for the login step, not the API callsThe NorenApi class itself only needs NorenRestApiOAuth. selenium, webdriver-manager, and pyotp exist to automate the browser-based OAuth handshake (getOAuthURL → login → auth_code) end-to-end — skip them if you're completing that step manually and only need the REST wrapper.
OAuth & Session Methods
Method
Description
getOAuthURL(oauth_url, API_KEY)
Builds the login URL from cred.yml. Open it in a browser; after login, the redirect URL carries the auth_code.
Exchanges auth_code for an access token. Returns (access_token, userid, refresh_token, account_id) and writes Access_token/Account_ID back into cred.yml.
injectOAuthHeader(Access_token, UID, Account_ID)
Attaches the access token to the HTTP headers used by every subsequent call in the session.
logout()
Terminates the session. Returns {"stat": "Ok", "request_time": ...} on success.
forgot_passwordOTP(userid, pan)
Triggers OTP-based password reset for the given user.
Every method mirrors the field-level request/response contract documented on this site's individual API pages — e.g. place_order's price_type argument maps to the prctyp field on Place Order. Refer to those pages for allowed values and error responses; the SDK doesn't change the underlying validation rules.
Quick Start Example
import yaml
from api_helper import NorenApi
withopen("cred.yml") as f:
cred = yaml.safe_load(f)
api = NorenApi(host="https://api.shoonya.com/NorenWClientAPI/")
# 1. Get the OAuth login URL, open it, complete login in browser
login_url = api.getOAuthURL(cred["oauth_url"], cred["API_KEY"])
print("Login here:", login_url)
# 2. Paste the auth_code from the redirect URL
auth_code = input("Enter auth_code: ")
# 3. Exchange auth_code for an access token
acc_tok, uid, ref_tok, actid = api.getAccessToken(
auth_code, cred["SECRET_KEY"], cred["client_id"], cred["UID"]
)
# 4. Inject the token into subsequent requests
api.injectOAuthHeader(acc_tok, uid, actid)
# 5. Use any wrapped method
ret = api.get_limits()
print(ret)
Best Practices
Treat cred.yml as a secrets file — SECRET_KEY, Access_token, and Account_ID live in it once populated. Never commit it to source control.
getAccessToken rewrites Access_token/Account_ID in cred.yml on every successful login — build your credential loading to read the file fresh rather than caching it across runs.
Call injectOAuthHeader once per session immediately after obtaining the token; every wrapped method depends on it being set first.
The SDK's error model mirrors the raw API's stat/emsg convention — always check stat == "Ok" before trusting a response field, the same as with raw REST calls. See Error Handling.
For anything running unattended, pair this with Token Renewal — the SDK doesn't auto-refresh an expired access token for you.
Overview
The Python SDK (package name
NorenRestApiOAuth, classNorenApi) wraps every REST endpoint covered elsewhere in this documentation — orders, market data, positions, holdings, calculators — plus the OAuth login handshake and the WebSocket feed, behind typed Python methods. Use it instead of hand-rollingrequestscalls againstjData/jKeypayloads directly.getOAuthURL→getAccessToken→injectOAuthHeader. It is a separate build from the password/TOTP-basedNorenApiPywrapper; don't mix credential styles between the two.Installation
NorenRestApiOAuthNorenApicred.yml— holdsoauth_url,API_KEY,SECRET_KEY,client_id,UID;Access_tokenandAccount_IDare written back to it after login.Dependencies (from
requirements.txt):NorenRestApiOAuthNorenApiclass itself.selenium>=4.15.0webdriver-manager>=4.0.0pyotp>=2.9.0NorenApiclass itself only needsNorenRestApiOAuth.selenium,webdriver-manager, andpyotpexist to automate the browser-based OAuth handshake (getOAuthURL→ login →auth_code) end-to-end — skip them if you're completing that step manually and only need the REST wrapper.OAuth & Session Methods
getOAuthURL(oauth_url, API_KEY)cred.yml. Open it in a browser; after login, the redirect URL carries theauth_code.getAccessToken(auth_code, SECRET_KEY, client_id, UID)auth_codefor an access token. Returns(access_token, userid, refresh_token, account_id)and writesAccess_token/Account_IDback intocred.yml.injectOAuthHeader(Access_token, UID, Account_ID)logout(){"stat": "Ok", "request_time": ...}on success.forgot_passwordOTP(userid, pan)Available Functionality
searchscrip,get_security_info,get_quotes,get_time_price_series,get_daily_price_series,get_option_chainplace_order,modify_order,cancel_order,exit_order,position_product_conversion,get_orderbook,get_tradebook,single_order_historyget_holdings,get_positions,get_limitsspan_calculator,get_option_greekstart_websocket,subscribe,unsubscribeEvery method mirrors the field-level request/response contract documented on this site's individual API pages — e.g.
place_order'sprice_typeargument maps to theprctypfield on Place Order. Refer to those pages for allowed values and error responses; the SDK doesn't change the underlying validation rules.Quick Start Example
Best Practices
cred.ymlas a secrets file —SECRET_KEY,Access_token, andAccount_IDlive in it once populated. Never commit it to source control.getAccessTokenrewritesAccess_token/Account_IDincred.ymlon every successful login — build your credential loading to read the file fresh rather than caching it across runs.injectOAuthHeaderonce per session immediately after obtaining the token; every wrapped method depends on it being set first.stat/emsgconvention — always checkstat == "Ok"before trusting a response field, the same as with raw REST calls. See Error Handling.