Indian broker API sessions expire once a day and have to be renewed with a fresh login. This is not a platform limitation or a bug — it is how broker API access is designed to work here.
Why it works this way
An API access token is a standing permission to place orders in your account. A token that never expired would be a permanent key: useful to you, and equally useful to anyone who obtained a copy of it.
Expiring it daily caps the damage window. A leaked token stops being useful at the next reset rather than remaining live indefinitely. The cost of that safety is a login each morning, which most traders would agree is a fair trade once they have thought about the alternative.
The reason beyond security
There is a second reason. A daily interactive login means a human consented to today's trading. An automated system that could authenticate itself indefinitely would be placing orders with no recent human involvement at all, which is a harder position to defend to a regulator.
The morning window
Tokens reset in the early morning. In practice that means the renewal has to happen after the reset and before the market opens — the window traders actually use runs from around 6:00 am to the 9:15 am open.
Give yourself more room than you think
If your strategy enters early in the session, build in more margin than you think you need. Broker login pages are busiest in the ten minutes before the open, which is exactly when you least want to be queueing behind everyone else.
What an expired token looks like
The symptoms overlap with other problems, which is why it gets misdiagnosed:
- Orders rejected with an authorisation or invalid-session error.
- Positions and balance failing to load on the broker screens.
- A strategy showing as running but never taking a position.
- Everything working perfectly yesterday with nothing changed since.
Telling it apart from an IP problem
That last symptom is shared with a rotated IP address. The way to tell them apart is the error text: an IP problem usually reads as unauthorised or forbidden, while a token problem usually names the session or login explicitly.
| Clue | Points to token | Points to IP |
|---|---|---|
| Error mentions session or login | Yes | No |
| Error says unauthorised or forbidden only | Possible | Likely |
| Broke overnight with nothing changed | Very likely | Possible |
| Broke after changing network or router | No | Very likely |
| Fixed by logging in again | Confirms it | No effect |
Check the token first when it is ambiguous. It expires every single day, which makes it the higher-probability cause, and renewing it takes under a minute.
What happens to a running bot when the token expires mid-session
A question with a reassuring answer: tokens expire on a daily boundary in the early morning, not partway through the trading session. A bot running at 11am is not going to lose its session at 11:01 because of expiry.
What can happen mid-session is a broker-side disconnection for other reasons — maintenance, a fault, or a security action on your account. Those are rarer and look different: they usually affect everything at once rather than just order placement.
How to tell the difference
The practical consequence is that if orders start failing mid-session on a day that started fine, the token is unlikely to be the cause. Check the broker status and your positions before assuming anything about authentication.
Making it a habit
1
Connect Telegram alerts
Arthalab sends a morning alert when a connected broker's token has expired, with a direct link to reconnect.
2
Renew before the open
Open Broker Setup and complete the broker's login. It takes under a minute.
3
Then start your bots
A deployed bot switches itself off after each market close. Renewing the token does not restart it — that is a separate action.
Building the routine so it survives a bad morning
Everyone manages the login on a calm Tuesday. The routine has to survive the mornings when you are late, travelling, or dealing with something else.
- A fixed time, earlier than you need — treat 8:30 as the deadline, not 9:10
- Telegram alerts connected, so a missed login announces itself
- The broker login page bookmarked, not searched for
- A known answer to what you do if you cannot log in at all that day
- Scheduled auto-start for the bots, so the login is the only manual step
Deciding what a missed morning means
That fourth item is the one worth deciding in advance. If the honest answer is that you simply miss the day, that is fine — but it should be a decision you made once, calmly, rather than one you improvise at 9:12 while trying to log in on a phone.
It also feeds back into strategy choice. A strategy whose entire edge sits in a 09:20 entry is more fragile to your own mornings than one with a wider entry window, and that fragility is a real cost even though it never shows up in a backtest.
Can it be automated?
Not fully, and you should be wary of anything claiming otherwise. The login is deliberately interactive — that is the entire point of expiring the token.
A service offering to store your broker password and log in on your behalf is asking you to hand over credentials that should never leave your control. It also typically violates your broker's terms, which matters if something goes wrong and you need the broker's cooperation.
What can be automated
What can be automated is everything after the login. Arthalab's scheduler can start your bots automatically on the days they should run, so the only manual step left is the login itself.
Why this surprises people coming from other markets
Traders arriving from international platforms often expect an API key to simply work until revoked, because that is how many markets operate. The daily expiry feels like a limitation rather than a design choice.
The underlying difference is who is assumed to be responsible. Where a long-lived key is normal, the account holder carries the risk of it leaking. The daily-login model moves some of that risk back to a deliberate human action each day, which is a different trade-off rather than a worse one.
The consequence for strategy design
It also has a practical consequence worth planning around: fully unattended multi-day automation is not available to retail here, on any platform. A strategy that assumes it will run for a week without you is not a strategy you can deploy in this market.
If you miss the window
You can log in later in the day and your bots will work from that point. What you cannot do is recover an entry that was supposed to happen at 9:20 and did not.
This is worth planning for rather than reacting to. If your strategy's whole edge is a specific entry time, a missed login is a missed day — and a strategy that only works when you are reliably at your desk by 9:00 is a different proposition from one that does not.
Paper trading is unaffected by any of this, because paper orders never reach a broker. If you are evaluating a strategy rather than running it for money, the login is not in your way.
The short version
The daily login is not going away, so the useful response is building a routine that survives a bad morning.
- Tokens reset early morning; renew between roughly 6:00 am and the 9:15 open
- Treat 8:30 as your deadline rather than 9:10
- Nothing can fully automate it without storing your broker password
- Renewing the token does not start your bots — that is separate
- Connect Telegram alerts so a missed login announces itself
It also shapes strategy choice: a strategy whose whole edge sits in a single early entry is more fragile to your own mornings than one with a wider window.
Frequently asked questions
No. The expiry is on the API session itself, not on your browser, so a tab left open changes nothing.
It resets on a daily boundary in the early morning. The practical window traders use runs from around 6:00 am to the 9:15 am open.
Each self-serve connection has its own session and its own daily login, so two of them means two logins every morning. XTS does not add one, because its session is renewed server-side.
Because a permanent API token would be a permanent key to your account. Daily expiry limits how long a leaked token stays useful, and it means a human consented to today's trading. On Arthalab this applies to the self-serve brokers; XTS is the exception, as its session is renewed server-side.
After the early-morning reset and before the 9:15 am open. Traders generally do it between 6:00 am and 9:15 am. Earlier is better — login pages are busiest just before the open.
No, and it should not be able to. The login is interactive by design. Anything that automates it needs your broker password stored somewhere, which defeats the purpose of daily expiry and usually breaches your broker's terms.
No. Renewing the token and starting a bot are separate. Bots switch off after each market close and have to be started again on each day they should run, though the scheduler can do that part for you.
Broker Setup shows the connection status. If Telegram alerts are connected, a morning message goes out when a connected broker's token has expired.
Your bots will work from that point, but an entry that was due earlier has already been missed. There is no way to place it retroactively.
No. Paper orders are simulated and never reach a broker, so none of this applies.
Start with a free 3-day trial
Build a strategy, backtest it and run it on paper — no broker, no IP and no money needed to try it.
