Upstox — How to Get Your API Access Token
Upstox's documentation describes three ways to get an access token. This guide covers
the Manual method, which Upstox's own docs describe as suited to
"one-time or occasional API usage where automation isn't required" — the simplest path
for an individual. It stops once you have your token.
Before You Start
- An Upstox trading account
- Upstox's documentation recommends TOTP (instead of SMS OTP) for a more secure login, but does not state it is mandatory
Step 1: Create an app
Go to Upstox Developer Apps and log in. Upstox's documentation states you need an
App Name and a Redirect URI (which must exactly match what you use later) to
register the app — this generates your API Key (client_id) and API
Secret (client_secret).
📸 Screenshot 1: Upstox Developer Apps — Create App form
Highlight the App Name and Redirect URI fields.
Upstox's documentation warns that redirect URLs ending in .php (or similar extensions) may be blocked, and recommends not placing "redirect" at the end of the URL.
Step 2: Open your created app
From the Developer Apps list, click into the app you just created.
📸 Screenshot 2: Developer Apps list showing your app
Highlight the app entry and its status.
Step 3: Click "Generate" to create an access token
Per Upstox's documentation: "Click Generate to create a new access token. Copy the
generated token and use it in your app."
📸 Screenshot 3: App detail page with the "Generate" button and resulting access token
Mask the actual token value before sharing — use a dummy value if illustrating this step.
What You Should Have Now
- API Key (
client_id) and API Secret (client_secret) — generated when you create the app
- Access Token — generated via the "Generate" button (Manual method)
Upstox's documentation also describes an interactive login flow (redirecting a
customer to log in with TOTP/OTP, then exchanging a single-use authorization code for
a token) and a "Semi-automated" flow using a notifier URL. Those are alternative
methods for automated apps — the Manual method above is the direct path for an
individual to obtain a token themselves.
Important Limitations
- Single-use authorization code: if you use the interactive login flow instead of Manual, Upstox's documentation states the authorization code is valid for one use only, whether or not the token exchange succeeds.
- Redirect URL restrictions: URLs ending in .php or similar extensions may be blocked; the word "redirect" should not appear at the end of the URL.
- Upstox's marketing page (upstox.com/trading-api) states trading and market-data APIs are free of cost, with rate limits of 50 requests/second for orders and data queries, and unlimited order modifications — confirm current limits on Upstox's own site, as this was not found in the authentication documentation itself.
- Access token expiry timing was not explicitly stated in the documentation pages reviewed for this guide — check Upstox's docs directly for the exact validity period.
🔒 Security warning: Keep your API Secret and access token confidential.
Never share them publicly. Never include real credentials in screenshots — use dummy
values or mask them.
Screenshot Checklist
- Create App form
- Developer Apps list showing your app
- App detail page with "Generate" button and resulting access token
Source: Upstox's official Developer API documentation (upstox.com/developer/api-documentation).
ZORVO