Authentication Flow

This guide explains the steps that turn a FYERS login into an access token for your individual app.

USE CASE

Follow the login steps that give your own script or app an access_token for your FYERS account.

Note

Due to SEBI’s retail algo trading regulations, changes to its usage may take effect on April 1, 2026. Please refer to the link for further details.

Details

The login flow is as follows:
Navigate to the Login API endpoint
After successful login, user is redirected to the redirect uri with the auth_code
POST the auth_code and appIdHash (SHA-256 of api_id + app_secret) to Validate Authcode API endpoint
Obtain the access_token use that for all the subsequent requests
Individual apps work only for the person who created them; no other FYERS client can log in with your app.
Step 1: send the user to the login URL with client_id (your app ID), redirect_uri, response_type=code and a random state. See Generate Auth Code.
redirect_uri must match the URL given when the app was created. Keep it under your control, because the auth_code sent to it is sensitive.
After login, check that the returned state equals the value you sent, then use the returned auth_code in step 2.
Step 2: POST grant_type, appIdHash and code (the auth_code) to Validate Auth Code.
appIdHash is the SHA-256 hash of app_id:app_secret. You can use this online tool for reference.
Send app_id:access_token in the HTTP Authorization header on every later request; the token expires daily at 6:30 AM.

Video learning