Can I use the same API key on multiple machines?

All machines must egress through the same whitelisted static IP. Use Algo-IP proxy credentials on each host rather than whitelisting multiple IPs unless you register primary and secondary with Zerodha.

Does api_secret expire?

The secret does not auto-expire but access_token expires daily. Regenerate access_token each trading day through OAuth, always via whitelisted proxy egress.

Zerodha API Key and Secret — Kite Connect Setup Guide (2026)

How to get Zerodha API key and secret from developers.kite.trade, OAuth login flow, static IP whitelisting and secure storage — complete Kite Connect setup for algo trading.

Where to get Zerodha API key and secret

Login to developers.kite.trade with your Zerodha credentials. Create a new app under My Apps — you receive an api_key immediately and api_secret shown once at creation. Store the secret in a password manager or environment variable; Zerodha does not display it again.

App settings you must configure

App name and description for your algo strategy
Redirect URL for OAuth login (e.g. http://127.0.0.1:8080/callback for local bots)
IP Whitelist — paste your Algo-IP dedicated static IPv4 before generating tokens
Subscribe to Kite Connect plan (verify current Zerodha pricing)

OAuth flow with api_key and api_secret

Your bot redirects the user to Kite login URL built with api_key. After 2FA, Zerodha returns a request_token to your redirect URL. Exchange request_token + api_secret server-side for access_token. Never expose api_secret in frontend JavaScript or public repos.

Why static IP matters with API key and secret

SEBI retail algo rules require API orders from a whitelisted static IP. Even with valid api_key, api_secret and access_token, orders fail with IP-not-whitelisted if egress does not match. Route all kiteconnect HTTP and KiteTicker WebSocket traffic through your Algo-IP Mumbai proxy before token generation.

Security checklist

Rotate api_secret if leaked — regenerate in developer portal
Use separate apps per strategy or client account
Store credentials in .env, not source code
Verify exit IP with api.ipify.org through proxy before market open

Full Zerodha algo stack: see our complete setup guide (/blog/zerodha-algo-trading-static-ip-setup-2026) and static IP whitelisting walkthrough (/blog/zerodha-kite-api-static-ip-whitelisting).