Connect a broker · Upstox

Upstox

You create an OAuth app in your Upstox account, and it gives you a client id and secret. You approve the login once a day and the token lasts until half past three the next morning.

Time: About 15 minutes
Difficulty: Moderate
Costs: Free with an Upstox account
You end up with: An API key and an API secret

Before you start

An active Upstox account, with 2FA set up on the app you sign in with.
A redirect URI you control. http://127.0.0.1:8000 is fine while you are testing on your own machine.
Upstox has a sandbox for testing order flow. Use it before you point the platform at the real account.

Open the developer app portal

Go to account.upstox.com/developer/apps, signed in as yourself. This is inside your ordinary Upstox account; there is no separate developer signup.

Create an app

Press New app and fill in a name, a short description and the redirect URI. That URI is where Upstox sends the browser back after you approve the login, and it must match later, exactly.

1 · Any name. 2 · Where the login returns. It must match character for character. 3 · Create.

Copy the key and the secret

The app page shows an API key, which OAuth calls the client_id, and an API secret, the client_secret. Copy both.

1 · The key. 2 · Reveal and copy the secret.

Approve the login

Upstox uses plain OAuth 2.0. The platform opens the authorisation dialog at api.upstox.com/v2/login/authorization/dialog, you sign in and approve, Upstox returns a single-use code to your redirect URI, and While25 exchanges that code for an access token behind the scenes.

The access token expires at 3:30 AM IST whatever time Upstox issued it, and Upstox offers no refresh token. Expect to approve once each trading morning.

The code is short-lived; the token lasts the trading day.

Try it in the sandbox first

Upstox publishes a sandbox that accepts order calls without touching your real positions. Run your first strategy against it, watch the order book fill, then switch to the live credentials once nothing surprises you.

What you copied

API key: The OAuth client_id. Public, identifies your app.
API secret: The OAuth client_secret. Private, used server-side to swap the code for a token.
Redirect URI: Must match the registration exactly, including scheme, port and any trailing slash.

An access token belongs to your account and can place orders. Treat it like a password and let the platform hold it rather than copying it around.

When it does not work

The dialog rejects the redirect URI

The URI sent and the URI registered differ: http against https, a missing port, a trailing slash. Make them identical.

The code stopped working before I used it

An authorisation code is single use and lives about five minutes. Start the login again.

It worked all day and failed overnight

Tokens expire at 3:30 AM IST every day. Approve the login again in the morning; there is no refresh token.

I want to test without risking anything

Use the sandbox. It answers order calls without touching your positions.

Straight from Upstox

Also on Zerodha? The Zerodha guide is the same shape. For a risk-free first look at the platform, Alpaca paper takes five minutes.

What you copied

API key

The OAuth client_id. Public, identifies your app.

API secret

The OAuth client_secret. Private, used server-side to swap the code for a token.

Redirect URI

Must match the registration exactly, including scheme, port and any trailing slash.