All three brokers expose both OAuth and API-key (BYOK) flows. Pick whichever fits your account.
Dhan
OAuth (default)
Start connect
Portfolio → Connect broker → Dhan → OAuth
Authorise on Dhan
Redirected to Dhan's auth page. Log in with your Dhan credentials. Approve read-only holdings scope.
Return to aftermarkets
Redirected back. Holdings populate within ~30 seconds.
BYOK
Generate access token + client ID in Dhan's developer console. Paste both fields into the BYOK form. Validate, save, sync.
Quirks
- Dhan's holdings response sometimes lags Kite-equivalent feeds by a few minutes after the market close. Refreshes during market hours are fine; the post-close snapshot can take up to 10 minutes after 15:30 IST.
Angel One
OAuth (default)
Start connect
Portfolio → Connect broker → Angel One → OAuth
Authorise via SmartAPI
Angel's OAuth flow uses their SmartAPI authentication. Log in with Angel credentials, complete 2FA.
Return
Holdings populate.
BYOK
Angel's developer portal issues a personal API key + a TOTP secret. The TOTP rotates every 30 seconds; authentication is handled automatically once you provide the secret.
Paste API key + TOTP secret into the BYOK form. Save.
Quirks
- Angel's session tokens expire daily at 06:00 IST. You'll see a re-auth prompt on the first morning refresh.
- The OAuth flow occasionally returns a different scope than requested. If holdings are missing after first sync, hit Refresh; the second request usually completes correctly.
Upstox
OAuth (default)
Start connect
Portfolio → Connect broker → Upstox → OAuth
Authorise on Upstox
Log in with Upstox credentials. Approve scope.
Return
Holdings populate.
BYOK
Upstox developer portal issues API key + secret + access token. All three go into the BYOK form. Validate, save.
Quirks
- Upstox sometimes returns ISINs instead of trading symbols. We resolve these automatically.
- The access token (for BYOK) expires daily. Token refresh is handled automatically.
All three: what's identical
- Refresh cadence: manual Refresh button (5-min cooldown), 17:00 IST daily snapshot
- Revocation: disconnect from portfolio page or revoke at broker side
- Encrypted credential storage: all keys, secrets, and tokens are encrypted at rest
- Scope: read-only holdings access only. None of these connectors can place orders.
- Tradebook history: last 30 days by default for journal seeding
Choosing OAuth vs BYOK
- OAuth is usually better: fewer credentials to manage, easier revocation, less to break
- BYOK is useful when: you want programmatic control, you're already managing API keys for other tools, or OAuth is flaky for your specific account
If unsure, start with OAuth. You can switch later by disconnecting and reconnecting via the other flow.
Connect a broker