Upstox

Upstox Login API

The Login API from Upstox — 4 operation(s) for login.

GitHub OpenAPI

Operations 4

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

POST /v3/login/auth/token/request/{client_id} Start an access token request for an indie app · Init token API #
Ask an LLM
“How do I kick off token generation as an individual developer without a redirect flow?”
“Can I turn off OTP verification when requesting a token for my own app?”
Tell an agent
Start a token request for app {client_id}.
Initiate an indie-user token for {client_id} with secret {client_secret}.
POST /v2/login/authorization/token Exchange an authorization code for an access token · Get token API #
Ask an LLM
“How do I exchange the auth code from the redirect for an access token?”
“Can I regenerate the extended access token when exchanging a code?”
Tell an agent
Exchange code {code} for an access token using app {client_id}, secret {client_secret}, redirect {redirect_uri}, grant {grant_type}.
Get a token from code {code} for {client_id} and set refresh_extended_token to {refresh_extended_token}.
GET /v2/login/authorization/dialog Open the login dialog for user authorization · Authorize API #
Ask an LLM
“Where do I send a user to log in and authorize my trading app?”
“How do I start the OAuth login flow with a state value?”
Tell an agent
Build the login dialog URL for {client_id} redirecting to {redirect_uri}.
Send the user to authorize {client_id} with state {state}, returning to {redirect_uri}.
DELETE /v2/logout Log out and end the session · Logout #
Ask an LLM
“How do I invalidate my current access token?”
“Can I log out of the trading session from my app?”
Tell an agent destructive · confirm first
Log me out of Upstox.
End my current session and revoke this access token.

Documentation

📖
Documentation
https://upstox.com/developer/api-documentation/open-api
📖
APIReference
https://upstox.com/developer/api-documentation/api-overview
📖
GettingStarted
https://upstox.com/developer/api-documentation/installing-sdk
📖
Authentication
https://upstox.com/developer/api-documentation/authentication

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/upstox/refs/heads/main/openapi/upstox-login-api-openapi.yml

Other Resources

🔗
Postman
https://gist.github.com/Rahulzz/a0da2ad28a7dcc81e887f24cfdbc80a8
🔗
Webhooks
https://upstox.com/developer/api-documentation/webhook

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/upstox:upstox-login-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

upstox-login-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: OpenAPI definition Login API
  version: v0
servers:
- url: https://api-v2.upstox.com
tags:
- name: Login
paths:
  /v3/login/auth/token/request/{client_id}:
    post:
      tags:
      - Login
      summary: Init token API
      description: This API provides the initialize the generate token and it's expiry for an indie user
      operationId: initTokenRequestForIndieUser
      parameters:
      - name: client_id
        in: path
        required: true
        schema:
          type: string
          minLength: 1
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/IndieUserTokenRequest'
        required: true
      responses:
        '405':
          description: Method Not Allowed
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ApiGatewayErrorResponse'
        '400':
          description: UDAPI1017 - API Key is required <br/>UDAPI1024 - App Secret is required <br/>
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiGatewayErrorResponse'
        '500':
          description: Internal Server Error
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ApiGatewayErrorResponse'
        '403':
          description: Forbidden
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ApiGatewayErrorResponse'
        '423':
          description: Locked
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ApiGatewayErrorResponse'
        '422':
          description: Unprocessable Entity
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ApiGatewayErrorResponse'
        '429':
          description: Too Many Requests
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ApiGatewayErrorResponse'
        '200':
          description: Successful
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TokenResponse'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiGatewayErrorResponse'
  /v2/login/authorization/token:
    post:
      tags:
      - Login
      summary: Get token API
      description: This API provides the functionality to obtain opaque token from authorization_code exchange and also provides the user’s profile in the same response.
      operationId: token
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/TokenRequest'
        required: true
      responses:
        '405':
          description: Method Not Allowed
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ApiGatewayErrorResponse'
        '400':
          description: UDAPI1017 - API Key is required <br/>UDAPI1018 - Redirect URI is required <br/>UDAPI1022 - Code is required <br/>UDAPI1023 - Grant type is required <br/>UDAPI1024 - App Secret is required <br/>
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiGatewayErrorResponse'
        '500':
          description: Internal Server Error
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ApiGatewayErrorResponse'
        '403':
          description: Forbidden
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ApiGatewayErrorResponse'
        '423':
          description: Locked
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ApiGatewayErrorResponse'
        '422':
          description: Unprocessable Entity
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ApiGatewayErrorResponse'
        '429':
          description: Too Many Requests
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ApiGatewayErrorResponse'
        '200':
          description: Successful
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TokenResponse'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiGatewayErrorResponse'
  /v2/login/authorization/dialog:
    get:
      tags:
      - Login
      summary: Authorize API
      description: This provides details on the login endpoint.
      operationId: authorize
      parameters:
      - name: client_id
        in: query
        required: true
        schema:
          type: string
          minLength: 1
      - name: redirect_uri
        in: query
        required: true
        schema:
          type: string
          minLength: 1
      - name: state
        in: query
        required: false
        schema:
          type: string
      - name: scope
        in: query
        required: false
        schema:
          type: string
      responses:
        '405':
          description: Method Not Allowed
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ApiGatewayErrorResponse'
        '400':
          description: UDAPI1018 - Redirect URI is required
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiGatewayErrorResponse'
        '500':
          description: Internal Server Error
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ApiGatewayErrorResponse'
        '403':
          description: Forbidden
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ApiGatewayErrorResponse'
        '423':
          description: Locked
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ApiGatewayErrorResponse'
        '422':
          description: Unprocessable Entity
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ApiGatewayErrorResponse'
        '429':
          description: Too Many Requests
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ApiGatewayErrorResponse'
        '302':
          description: Successful Operation
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiGatewayErrorResponse'
  /v2/logout:
    delete:
      tags:
      - Login
      summary: Logout
      operationId: logout
      responses:
        '405':
          description: Method Not Allowed
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ApiGatewayErrorResponse'
        '400':
          description: Bad Request
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ApiGatewayErrorResponse'
        '500':
          description: Internal Server Error
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ApiGatewayErrorResponse'
        '403':
          description: Forbidden
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ApiGatewayErrorResponse'
        '423':
          description: Locked
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ApiGatewayErrorResponse'
        '422':
          description: Unprocessable Entity
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ApiGatewayErrorResponse'
        '429':
          description: Too Many Requests
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ApiGatewayErrorResponse'
        '200':
          description: Successful
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LogoutResponse'
        '401':
          description: Authorization Failure
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthClientException'
      security:
      - OAUTH2: []
components:
  schemas:
    Problem:
      type: object
      properties:
        errorCode:
          type: string
          deprecated: true
          description: Unique code for the error state
        message:
          type: string
          description: Verbose message for the error state
        propertyPath:
          type: string
          deprecated: true
          description: Path to property failing validation
        invalidValue:
          deprecated: true
          description: Invalid value for the property failing validation
        error_code:
          type: string
        property_path:
          type: string
        invalid_value: {}
    TokenRequest:
      type: object
      properties:
        code:
          type: string
          minLength: 1
        client_id:
          type: string
          description: OAuth API key that is a public identifier for app
          minLength: 1
        client_secret:
          type: string
          description: OAuth client secret that is a private secret known only to app and authorization server
          minLength: 1
        redirect_uri:
          type: string
          description: Authorization server will redirect the user back to the application via redirect url
          minLength: 1
        grant_type:
          type: string
          description: Type of grant used to get an access token
          minLength: 1
        refresh_extended_token:
          type: boolean
          description: Whether to refresh (regenerate) the extended access token. Defaults to false when absent. Set to true to refresh; false or omit to reuse an existing extended token when available.
      required:
      - client_id
      - client_secret
      - code
      - grant_type
      - redirect_uri
    IndieUserTokenRequest:
      type: object
      properties:
        client_id:
          type: string
          description: OAuth API key that is a public identifier for app
        client_secret:
          type: string
          description: OAuth client secret that is a private secret known only to app and authorization server
        otp_verification_disabled:
          type: boolean
          description: To enable/disable otp auth flow
    LogoutResponse:
      type: object
      properties:
        status:
          type: string
          enum:
          - success
          - error
          - partial_success
        data:
          type: boolean
          description: Logout status
    TokenResponse:
      type: object
      properties:
        email:
          type: string
          description: E-mail address of the user
          example: client@email.com
          readOnly: true
        exchanges:
          type: array
          description: Lists the exchanges to which the user has access
          example: NSE
          items:
            type: string
            enum:
            - NSE
            - NFO
            - CDS
            - BSE
            - BFO
            - BCD
            - MCX
            - NSCOM
          readOnly: true
        products:
          type: array
          description: Lists the products types to which the user has access
          example: D
          items:
            type: string
            enum:
            - I
            - D
            - CO
            - OCO
            - MTF
          readOnly: true
        broker:
          type: string
          description: The broker ID
          example: UPSTOX
          readOnly: true
        user_id:
          type: string
          description: Uniquely identifies the user
          example: 202251
          readOnly: true
        user_name:
          type: string
          description: Name of the user
          example: client
          readOnly: true
        order_types:
          type: array
          description: Order types enabled for the user
          example: LIMIT
          items:
            type: string
            enum:
            - MARKET
            - LIMIT
            - SL
            - SL-M
          readOnly: true
        user_type:
          type: string
          description: "\t\nIdentifies the user's registered role at the broker. This will be individual for all retail users"
          example: individual
          readOnly: true
        poa:
          type: boolean
          description: "\t\nTo depict if the user has given power of attorney for transactions"
          example: true
          readOnly: true
        ddpi:
          type: boolean
          description: "\t\nIndicates if DDPI is enabled for trading"
          example: true
          readOnly: true
        is_active:
          type: boolean
          description: "\t\nWhether the status of account is active or not"
          example: true
          readOnly: true
        access_token:
          type: string
          description: The authentication token that is to used with every subsequent API requests
          readOnly: true
        extended_token:
          type: string
          description: An extended authentication token with a prolonged validity period, intended for specific API requests. Ensure you use this token only with the designated set of APIs.
          readOnly: true
        expires_in:
          type: integer
          format: int32
          description: The number of seconds until the access token expires
          readOnly: true
        token_type:
          type: string
          description: The type of token
          readOnly: true
        refresh_token:
          type: string
          description: The refresh token that can be used to refresh the access token
          readOnly: true
        refresh_token_expires_in:
          type: integer
          format: int32
          description: The number of seconds until the refresh token expires
          readOnly: true
    OAuthClientException:
      type: object
      properties:
        cause:
          type: object
          properties:
            stackTrace:
              type: array
              items:
                type: object
                properties:
                  classLoaderName:
                    type: string
                  moduleName:
                    type: string
                  moduleVersion:
                    type: string
                  methodName:
                    type: string
                  fileName:
                    type: string
                  lineNumber:
                    type: integer
                    format: int32
                  className:
                    type: string
                  nativeMethod:
                    type: boolean
            message:
              type: string
            localizedMessage:
              type: string
        stackTrace:
          type: array
          items:
            type: object
            properties:
              classLoaderName:
                type: string
              moduleName:
                type: string
              moduleVersion:
                type: string
              methodName:
                type: string
              fileName:
                type: string
              lineNumber:
                type: integer
                format: int32
              className:
                type: string
              nativeMethod:
                type: boolean
        message:
          type: string
        suppressed:
          type: array
          items:
            type: object
            properties:
              stackTrace:
                type: array
                items:
                  type: object
                  properties:
                    classLoaderName:
                      type: string
                    moduleName:
                      type: string
                    moduleVersion:
                      type: string
                    methodName:
                      type: string
                    fileName:
                      type: string
                    lineNumber:
                      type: integer
                      format: int32
                    className:
                      type: string
                    nativeMethod:
                      type: boolean
              message:
                type: string
              localizedMessage:
                type: string
        localizedMessage:
          type: string
    ApiGatewayErrorResponse:
      type: object
      properties:
        status:
          type: string
          enum:
          - success
          - error
          - partial_success
        errors:
          type: array
          items:
            $ref: '#/components/schemas/Problem'
  securitySchemes:
    OAUTH2:
      type: oauth2
      scheme: BEARER
      flows:
        authorizationCode:
          authorizationUrl: https://api-v2.upstox.com/v2/login/authorization/dialog
          tokenUrl: https://api-v2.upstox.com/v2/login/authorization/token
          scopes:
            read: Read access
            write: Write access
x-provenance:
  method: harvested
  publisher: Upstox
  source: https://api-v2.upstox.com/api-docs
  note: split by refine-openapis from the provider's own published document, verified by fetch (openapi/_original/*.fetch.json);
    stamped by stamp-openapi-provenance.py (roadmap#793)