Upstox API Algo Trading: Python Setup Guide for 2026

Upstox doesn’t charge for API access. Its trading API page lists trading and market data APIs at ₹0, and orders placed through the API at a flat ₹10 each until 31 December 2026. To trade from Python you create an app in Upstox’s developer console, register a static IP, get a fresh access token every day, look up instrument keys in Upstox’s instrument file, and place orders through the v3 order API with the official upstox-python-sdk. Below is each step as Upstox documents it in November 2026, plus the details that cost people a morning.

Last updated: November 2026.

What does the Upstox API cost?

upstox.com/trading-api says three things right now: trading and market data APIs are free, API orders cost a flat ₹10 per order, and that rate is “valid till 31st Dec 2026”. That date has moved before: the offer launched in August 2025 to end in December 2025, was extended to 31 March 2026, and now runs to year-end. Check again before you budget for 2027.

What the ₹10 is worth depends on how often you trade. Say a strategy takes 3 round trips a day: that’s 6 orders, ₹60 a day, about ₹1,200 over 20 trading days. At ₹20 an order, the cap on Upstox’s standard brokerage, it would be ₹2,400. GST at 18% applies on top of either. Our Upstox brokerage calculator adds STT, exchange charges and stamp duty.

Upstox Plus isn’t an API fee either. It’s an account plan with higher brokerage (up to ₹30 an order against ₹20 on Basic, per Upstox’s pricing page) that adds features API users care about: OHLC data for expired contracts, five WebSocket connections instead of two, and 30-level market depth for 50 symbols. Upstox’s announcements of the ₹10 API rate said it applies on both plans.

How to create an Upstox API app and register a static IP

Apps live at account.upstox.com/developer/apps. Create a new app with a name and a redirect URL. The redirect URL is mandatory and must match the one you send at login character for character; Upstox’s docs also warn that URLs ending in .php or similar can be blocked. You get two values back: the API key (OAuth calls it client_id) and the API secret (client_secret).

Then click Static IPs in the app listing and enter a primary IP and, if you want a backup, a secondary one (Upstox’s My Apps guide). The rules, from Upstox’s algo trading notice:

• Since 1 April 2026, order requests from any other IP are rejected: place, modify, cancel, multi-order, GTT and exit-all-positions. Holdings, positions, funds and candles aren’t restricted.
• The IPs belong to your user account, not to the app. The same pair applies whichever app issued your token.
• IPv4 and IPv6 are both accepted.
• You can change them once per calendar week, and a change invalidates your current access token, so plan to log in again right after.
• One IP, one customer. Nobody else can register it.

You can also manage them from code with GET and PUT on /user/ip. If you don’t have a fixed address yet, our static IP guide compares ISPs and cloud servers, with prices.

The access token, and why it dies at 3:30 am

Every call carries an access token, and Upstox says it “has a specific validity period that lasts until 3:30 AM the following day, regardless of the time it was generated” (Get Token docs). Generate one at 8 pm on Tuesday and it dies at 3:30 am Wednesday. Generate one at 2:30 am Wednesday and it lasts an hour.

There’s a second clock. The place order API only accepts calls between 5:30 am and midnight, and anything outside that fails with UDAPI100074. A pre-market job at 8:45 am is safe on both counts.

You can get the token four ways:

1. The OAuth redirect. Send the user to https://api.upstox.com/v2/login/authorization/dialog with response_type=code, your client_id and redirect_uri. They log in on Upstox’s own page, and Upstox redirects to your URL with a code. Your server POSTs that code, with the key, secret, redirect URI and grant_type=authorization_code, to https://api.upstox.com/v2/login/authorization/token. Each code works once, whether the exchange succeeds or not.
2. PIN and TOTP. The newer route, and the one most self-hosted scripts will want. POST your 6-digit PIN and a TOTP code to https://api.upstox.com/v2/totp-login/authorization/token, with your API key in an x-api-key header. TOTP has to be enabled on your Upstox account first, the endpoint works only for individual apps, and calling it revokes whatever token the app already had.
3. Manual. Open your app in the developer console and click Generate. Fine for a weekend experiment, tedious every morning.
4. Approve on your phone. Your app requests a token, you approve it from a notification on the Upstox app or WhatsApp, and Upstox posts the token to the notifier URL set on your app.

The token response also carries an extended_token. It lasts longer but is meant for read-only calls; send it to an order endpoint and you get UDAPI100067.

A word on route 2: with your TOTP secret and PIN on a server, that server can log in as you without your phone. That’s the point, and also the risk. Keep both out of your code and any repository.

Upstox instrument keys and where to download them

Upstox identifies every instrument with an instrument_key, and the format changes by segment:

• NSE stocks use the ISIN: NSE_EQ|INE062A01020 is SBIN.
• NSE indices use the index name: NSE_INDEX|Nifty 50.
• NSE futures and options use the exchange token: NSE_FO|64397.

The keys come from Upstox’s beginning-of-day files. For NSE alone it’s https://assets.upstox.com/market-quote/instruments/exchange/NSE.json.gz; swap in complete.json.gz for every exchange. When I downloaded the NSE file in November 2026 it was about 2 MB compressed and held roughly 80,000 rows. Upstox has announced it will retire the CSV versions, so parse the JSON.

Before you write the parser:

• Store instrument_key, not exchange_token. Upstox’s instruments page warns that the exchange can reuse a token for a different contract after expiry.
• expiry is epoch milliseconds, set to 23:59:59 IST on the expiry date. Convert it in the Asia/Kolkata timezone.
• tick_size is in paise. A value of 5.0 means ₹0.05.
• Order quantity for F&O is in units. NIFTY’s lot size is 65 (as of 2026; NSE revises lot sizes periodically), so one lot is quantity=65.

For one-off lookups there’s also a Search Instruments API, which saves loading the file.

Placing an order: use the v3 API

Upstox has announced it is phasing out the v2 place, modify and cancel order APIs in favour of v3, and the v3 place order call goes to its own host: https://api-hft.upstox.com/v3/order/place. The official SDK, upstox-python-sdk (2.30.0 is the latest on PyPI, released September 2026; the import name is upstox_client), sends v3 order calls to that host by itself.

pip install upstox-python-sdk pyotp requests

import os
import pyotp
import requests
import upstox_client

# 1. Today's token from PIN + TOTP
r = requests.post(
    "https://api.upstox.com/v2/totp-login/authorization/token",
    headers={"accept": "application/json", "x-api-key": os.environ["UPSTOX_API_KEY"]},
    json={"pin": os.environ["UPSTOX_PIN"],
          "totp": pyotp.TOTP(os.environ["UPSTOX_TOTP_KEY"]).now()},
    timeout=15,
)
r.raise_for_status()
token = r.json()["access_token"]

# 2. One limit order through the v3 API
cfg = upstox_client.Configuration()
cfg.access_token = token
orders = upstox_client.OrderApiV3(upstox_client.ApiClient(cfg))

body = upstox_client.PlaceOrderV3Request(
    instrument_token="NSE_EQ|INE062A01020",  # SBIN
    quantity=1,
    product="I",            # I = intraday, D = delivery
    validity="DAY",
    order_type="LIMIT",
    price=500.0,
    trigger_price=0.0,
    disclosed_quantity=0,
    transaction_type="BUY",
    is_amo=False,
    slice=False,
    tag="first-test",
)
result = orders.place_order(body)
print(result.data.order_ids)

Why some of it looks the way it does:

• order_ids is a list because with slice=True, Upstox splits an order bigger than the exchange’s freeze quantity into several orders and returns all their IDs.
• Market orders need protection, because the exchange restricts API market orders. The v3 request has a market_protection field: leave it at the default of -1 for Upstox’s automatic protection, or pass 1 to 25 for a percentage band. Upstox’s example: at a price of 100 with 3%, the order can only fill between 97 and 103. Pass 0 and Upstox rejects the order. I’d start with limit orders anyway, priced away from the market for a first test.
• The X-Algo-Name header is optional unless you run an exchange-approved algo, in which case you pass the name configured in your app settings: orders.place_order(body, algo_name="...").
• Failures raise ApiException (import it from upstox_client.rest). The UDAPI code is in the exception body.

Before you point this at real money, use Upstox’s sandbox. It needs a separate sandbox app and token, accepts orders without funds, runs round the clock, and applies the same validation as live. In the SDK it’s upstox_client.Configuration(sandbox=True).

Market data: v3 WebSocket only

Upstox switched off the v2 market data feed after 22 August 2025, so v3 is the only feed. Messages arrive as Protobuf, which the SDK decodes for you. From the v3 feed docs, you get 2 connections per user, and up to 5,000 instrument keys in LTPC mode, 3,000 in option Greeks mode or 2,000 in full mode if you stick to one mode (lower caps when you mix modes). Upstox Plus raises connections to 5.

streamer = upstox_client.MarketDataStreamerV3(
    upstox_client.ApiClient(cfg), ["NSE_INDEX|Nifty 50", "NSE_EQ|INE062A01020"], "ltpc")
streamer.on("message", print)
streamer.on("autoReconnectStopped", lambda *a: print("feed is down"))
streamer.connect()

That second on line matters. The SDK reconnects by itself, but by default it tries 5 times, a second apart, then emits autoReconnectStopped and goes quiet. On a “401 Unauthorized” error, the kind a rejected token gives you, it doesn’t retry at all. Without a handler, a strategy can keep running on a dead feed after a longer network blip. The feed doesn’t need your static IP.

For backtesting, the v3 historical candle API gives minute candles from January 2022 and daily candles from January 2000; our post on free NSE historical data compares it with the other sources.

Upstox API rate limits

From Upstox’s rate limit page, November 2026:

API group	Per second	Per minute	Per 30 minutes
Orders: place, modify, cancel, multi-order, GTT (combined)	10	500	2,000
Same, for exchange-registered algos	50	500	2,000
Everything else: positions, funds, candles	50	500	2,000
TOTP login	1	10	60

Upstox says going over “might result in temporary suspension of access”. The 10 a second lines up with the 10-orders-per-second threshold in the SEBI algo rules; above it, the strategy needs exchange registration.

The 30-minute bucket is the one that bites. Trail stops on 5 positions with one modification each every 10 seconds and you send 30 calls a minute, 900 per half hour, comfortably inside 2,000. Tighten that to every 2 seconds and it’s 150 a minute. You’d use up the 2,000 in about 13 minutes.

Upstox API error codes and what they mean

• UDAPI100050 (invalid token). It’s past 3:30 am, or the token was revoked because you generated a new one through the TOTP route or changed your static IP. Log in again.
• UDAPI100069, UDAPI100070. Wrong API key or secret, or the redirect_uri doesn’t match the one on the app.
• UDAPI100057 (invalid auth code). Auth codes are single-use. You probably retried with the same one.
• UDAPI100097, UDAPI100098 (TOTP route). Wrong PIN or TOTP code, often a server clock that has drifted; or TOTP isn’t enabled on the account.
• UDAPI1154. The order came from an IP that isn’t registered.
• UDAPI1158 (“Market orders are not allowed”). Use a limit order, or a market order with market_protection set.
• UDAPI100074. You called place order between midnight and 5:30 am.
• UDAPI100067. You used the extended_token on an API it doesn’t cover.
• UDAPI100011. Invalid instrument key. Check the segment prefix and the pipe.
• UDAPI10005 or HTTP 429. Rate limit. Back off.

Or don’t write the code

If what you want is a strategy running on your Upstox account rather than a Python project to maintain, a no-code platform handles the daily token, instrument keys and order calls for you. We build INDfolio, so weigh this accordingly: Upstox is one of the brokers INDfolio deploys to. You describe the strategy in plain English or build it from blocks, backtest it on NSE history with Indian costs, paper trade it on live prices, and deploy with kill switches, position limits and auto square-off.

Whose IP your orders leave from depends on each platform’s integration with the broker, so ask any platform, including us, before you connect. If you’re comparing brokers for your own code, our Angel One SmartAPI guide covers the same steps there.

Frequently asked questions

Is the Upstox API free? Yes. Upstox lists its trading and market data APIs at ₹0. Orders placed through the API cost a flat ₹10 each until 31 December 2026, plus the usual statutory charges and GST.

How long is an Upstox access token valid? Until 3:30 am the next day, whenever you generate it. Generate a fresh one each trading morning, after 3:30 am.

Can I get an Upstox access token without the browser login? Yes. Upstox now has a TOTP endpoint that takes your API key, 6-digit PIN and a TOTP code and returns a token. TOTP must be enabled on your account first.

Should I use the Upstox v2 or v3 order API? v3. Upstox has announced it is phasing out the v2 place, modify and cancel order APIs. The v3 place order endpoint is https://api-hft.upstox.com/v3/order/place, and the Python SDK’s OrderApiV3 uses it.

Where do I download Upstox instrument keys? From Upstox’s beginning-of-day JSON files, for example https://assets.upstox.com/market-quote/instruments/exchange/NSE.json.gz. Use the instrument_key field, since exchange tokens can be reused after a contract expires.

Do I need a static IP for Upstox market data? No. Upstox checks the static IP only on order calls: place, modify, cancel, multi-order, GTT and exit all positions. Market data, historical candles, positions and funds work from any IP.