Authentication
Authentication journey
FYERS API authentication connects a user-approved FYERS account to an app. The standard flow starts with user authorization and produces an access token that the app uses for authenticated API requests.
You will need a configured app, the App ID and App Secret, and a matching redirect URL before you can complete login.
Choose your authentication flow
What this flow covers
- Generate authorization code
Start the login flow and receive the code at your redirect URL.
- Validate authorization code
Exchange the code and App ID hash for an access token.
- Use the access token
Send the token on every authenticated REST or WebSocket request.
What this flow covers
- User authorizes your app
The FYERS user grants access to the third-party application.
- Token stays scoped to the app
The access token is valid only for that approved application.
- Logout affects this app only
Revoking the token does not sign the user out of FYERS web or mobile.
Static IP and permissions
Trading API requests must follow the applicable app permission and static IP rules. Use the approved static IP registered for the app and keep app permissions aligned with the intended workflow. These controls protect account access and support applicable regulatory requirements.
Know more about Retail Algo Regulations: SEBI algo trading rules
Token security
Protect the session
- Store tokens securely
Keep access tokens on the server. Do not write them into public repositories or client bundles.
- Never expose credentials
App Secret, App ID hash and tokens must stay private to your application.
- Handle expiry explicitly
Detect an expired session and send the user through authorization again.
- Use minimum permissions
Request only the app permissions required for the workflow.