Static IP, API Keys and the Once-a-Week Rule

How does authorised API access work under the framework?

NSE circular NSE/INVG/67858 of 5 May 2025 requires access by unique vendor and client specific API key, with OAuth authentication and two-factor verification, from a static IP address the broker has whitelisted. Open APIs are not permitted.

Each element rules out a pattern that was common before. A per-user key rules out one integration credential shared across a vendor's customers. OAuth rules out storing a customer's login. And whitelisting means network position is part of the authorisation decision, not just possession of a secret.

Why does the once-per-calendar-week limit matter so much?

Because it removes the ability to change an address reactively. A client's mapped IP addresses may be updated at most once per calendar week, so any design that assumes you can re-register when something fails at 09:20 does not hold up against the rule.

This is the single detail teams most often discover late. The instinct is to treat an IP address as configuration, something changed when infrastructure moves. Under this constraint it behaves much more like a licence: obtained in advance, changed rarely, and planned around.

The consequence is that failover has to be designed before registration rather than after an incident. Secondary addresses are permitted for redundancy, which is the intended path, and registering one while nothing is broken costs nothing.

Common setups, and whether they hold up

Whether IPv6 is accepted varies between brokers and is not settled by the circular. Confirm it directly.

What happens when a session expires?

Most Indian broker APIs expire the session daily and require an interactive login step to re-establish it. That is a deliberate control rather than a defect, and it means an automated system needs a defined answer for what happens to open positions while there is no session.

The answer that matters is whether the system can still exit. A design that can enter positions but cannot close them during a session gap accumulates risk with no way to shed it, and that is the one failure mode that should fail closed, refusing new entries the moment the exit path is unavailable.

Does the static IP requirement apply to a hosted platform?

Yes. Where a platform is hosted, its originating addresses are what the broker whitelists, and the same weekly change limit applies to them. Where the platform runs inside the broker's own estate, the addresses are already the broker's and already whitelisted.

That difference is one of the more practical reasons deployment model and compliance posture cannot be discussed separately. It is also why a broker with an established network posture will ask about egress addresses early, and should.