Does a 403 mean I should rotate the IP?

Not first. Confirm exit IP and 407. Rotating a healthy IP wastes a whitelist edit (often limited to once per week).

Broker API 403 Forbidden — Origin, Proxy and Whitelist Checks

Broker API 403 vs 401 vs IP-not-whitelisted. How to tell a missing header from a wrong exit IP, and how HTTP proxy 443 fixes origin 403s.

403 vs 401 vs IP-not-whitelisted

401 — token missing, expired, or (on some stacks) origin changed mid-session.
403 — server understood you but refused: IP, scope, order of day, or WAF.
Explicit IP-not-whitelisted text — treat as egress. See the per-broker posts.

Prove origin in one request

Log the broker error body and, in the same process, GET api.ipify.org through the proxy. If ipify is the home WAN, fix the proxy before you rewrite the strategy.

403 that is not the IP

Wrong product segment, freeze quantity, or a blocked API path will also 403. If ipify matches the whitelist and curl to a public echo works, the problem is the broker payload — not Algo-IP.

Per-broker checklists: /blog/zerodha-api-ip-not-whitelisted, /blog/dhan-api-ip-not-whitelisted, /blog/angel-one-ip-not-whitelisted.