HDFC SKY API Rate Limits, Session Validity, and Token Management Explained

Building an application with the HDFC SKY Open APIs involves more than connecting to the available services. You also need to understand how authentication works, how long an API session remains valid, and how to manage API usage efficiently. These concepts help keep your application secure, stable, and responsive.

This guide explains HDFC SKY API rate limits, session validity, and token refresh in simple language, making it easier for beginners to understand the complete authentication workflow.

Why Are Session Management and API Limits Important?

Before integrating the HDFC SKY APIs, it is useful to understand why session management and API limits matter.

Session management ensures that only authenticated users and authorised applications can access protected services. API usage guidelines help maintain platform performance by preventing unnecessary or excessive requests. Together, these mechanisms support secure and reliable communication between your application and the HDFC SKY platform.

Understanding Session Validity

The authentication process creates a secure session between your application and the HDFC SKY platform. Understanding how this session works helps you manage API requests more effectively.

1. Access Token
   After the user successfully completes authentication, HDFC SKY generates an Access Token. Your application includes this token in the HTTP Authorisation header whenever it sends an authorised API request.
2. Active Session
   The Access Token remains valid for the authenticated session defined by HDFC SKY. While the session remains active, your application can continue accessing the APIs that the user has authorised.
3. Session Expiry
   When the authenticated session expires or the Access Token becomes invalid, your application must complete the supported authentication process again to obtain a new Access Token before making additional authorised API requests.

How Should You Manage Access Tokens?

A well-managed authentication process helps your application operate smoothly.

Follow these practices while working with Access Tokens:

• Store the Access Token securely during the active session.
• Include the Access Token in the Authorisation header for authorised API requests.
• Generate a new Access Token whenever the current token expires or becomes invalid.
• Never expose authentication credentials in publicly accessible code.

These practices help protect user accounts while ensuring uninterrupted communication with the HDFC SKY platform.

Also Read: HDFC SKY Open API: A Complete Guide to Building Smarter Investment and Trading Applications

How Does Token Refresh Work?

After understanding session validity, it is important to know what happens when an Access Token is no longer valid.

HDFC SKY uses an Access Token to authenticate authorised API requests. If the Access Token expires or becomes invalid, the application cannot continue accessing protected services with the existing token.

To continue making authorised API requests, the application should complete the supported authentication process again and generate a new Access Token. This approach ensures that each authenticated session remains secure and that only authorised users can access the platform.

Follow these practices when managing Access Tokens:

• Store the Access Token securely during the active session.
• Include the Access Token in the Authorisation header for every authorised API request.
• Generate a new Access Token by repeating the documented authentication workflow whenever the existing Access Token becomes invalid or the authenticated session ends.
• Never expose authentication credentials in client-side code or public repositories.

These practices help maintain secure and reliable communication with the HDFC SKY platform.

Understanding API Rate Limits

Every API platform manages the number of requests that applications can send within a given period. This process is known as API rate limiting.

API rate limits help:

• Maintain platform stability.
• Prevent excessive server load.
• Ensure fair usage across applications.
• Deliver consistent performance for all users.

Applications should follow the limits specified for each API to avoid request throttling or temporary restrictions.

Understanding WebSocket Limits

For applications that require continuous market updates, HDFC SKY provides WebSocket connectivity.

1. Subscribe to Multiple Instruments
   A single WebSocket connection supports subscriptions for up to 300 instruments. This allows applications to receive live market updates for multiple securities through a single connection.
2. Multiple WebSocket Connections
   Each API key supports up to three simultaneous WebSocket connections. This enables applications to organise different market data streams without opening unnecessary connections.
3. Efficient Real-Time Streaming
   The WebSocket API delivers live market data with low latency while reducing repeated HTTP requests. Market data includes information such as Open, High, Low, Close (OHLC), Last Traded Price (LTP), and market depth, where available.

Why Use WebSockets Instead of Repeated REST API Requests?

Choosing the appropriate communication method can improve both application performance and efficiency.

WebSockets offer several advantages:

• Receive continuous live market updates.
• Reduce the need for repeated REST API requests.
• Lower network overhead.
• Improve application responsiveness during market hours.

For applications that display live prices or market movements, WebSockets provide a more efficient solution than repeatedly requesting the same information through REST APIs.

Things to Keep in Mind

Before deploying your application, keep the following points in mind.

• Complete user authentication before accessing protected APIs.
• Include a valid Access Token in every authorised API request.
• Register the correct Redirect URL during application setup.
• Configure the required Static IP Address where applicable.
• Use WebSocket connections for continuous market updates instead of repeatedly requesting live data through REST APIs.
• Follow the latest API usage guidelines published in the HDFC SKY Developer Portal.

These practices help create secure, reliable, and efficient API integrations.

Conclusion

Understanding API rate limits, session validity, and token refresh is essential when building applications with the HDFC SKY Open APIs. By following the documented authentication process, generating a new Access Token whenever required, and using WebSockets efficiently for live market updates, developers can build secure, reliable, and high-performing applications that integrate smoothly with the HDFC SKY platform.