Authentication

Authentication

Groww MCP supports 3 authentication methods. Choose the one that fits your workflow.

Method 1: TOTP (Recommended)

Fully automated. No daily manual steps. The server generates fresh access tokens automatically on every startup.

How it works

1. You provide a TOTP key (JWT) and TOTP secret (base32 string)
2. On startup, the server generates a 6-digit TOTP code using the secret
3. It sends the code + key to Groww's token endpoint
4. Groww returns a fresh access token valid until 6:00 AM IST
5. The server auto-refreshes the token if it expires during the session

Setup (one-time, 2 minutes)

1. Log in to groww.in
2. Go to Profile → Settings → Trading APIs
3. Click the "Generate API key" dropdown → "Generate TOTP token"
4. You'll receive two values:

What you see	What to save as
TOTP Token — a long JWT string starting with eyJ...	GROWW_TOTP_KEY
TOTP QR Secret — a short base32 string like UG3X...	GROWW_TOTP_SECRET

5. Add to your .env:

GROWW_TOTP_KEY=eyJraWQi...your_totp_jwt_key
GROWW_TOTP_SECRET=UG3XTATB22XLH5SGGLHHV736PEOYUZSB

That's it. Never visit the website again for auth.

Technical Details

• Uses the ROTP gem for TOTP code generation
• Token endpoint: POST https://api.groww.in/v1/token/api/access
• Payload: { key: TOTP_KEY, key_type: "totp", question_id: "TOTP", answer: "6-digit-code" }
• Access token expires daily at 6:00 AM IST
• Server tracks expiry and refreshes automatically (5-minute buffer)

---

Method 2: API Key + Secret (Approval Required)

Requires daily approval on the Groww website before the server can generate tokens.

Setup

1. Go to groww.in → Settings → Trading APIs
2. Click "Generate API key" → Create a key
3. Copy the API Key and API Secret
4. Add to .env:

GROWW_API_KEY=eyJraWQi...your_api_key
GROWW_API_SECRET=your_api_secret

5. Every day: Visit the Trading APIs page and click "Approve" next to your key

Technical Details

• Uses SHA256 checksum: SHA256(api_secret + timestamp_ms)
• Token endpoint: POST https://api.groww.in/v1/token/api/access
• Payload: { key: API_KEY, key_type: "approval", checksum: SHA256_HEX, timestamp: epoch_ms }

Important Note

The API secret may contain special characters (%, (, )) that break in shell environments. The Ruby implementation handles these correctly — no escaping needed.

---

Method 3: Direct Access Token (Manual)

For quick testing. Token expires daily at 6:00 AM IST.

Setup

1. Go to groww.in → Settings → Trading APIs
2. Click "Generate API key" dropdown → "Generate Access Token"
3. Copy the token
4. Add to .env:

GROWW_ACCESS_TOKEN=eyJraWQi...your_access_token

You'll need to regenerate this token every day before 6:00 AM IST.

---

Auth Priority

If multiple credentials are present, the server uses this priority:

1. TOTP (if GROWW_TOTP_KEY + GROWW_TOTP_SECRET are set)
2. Approval (if GROWW_API_KEY + GROWW_API_SECRET are set)
3. Manual (if GROWW_ACCESS_TOKEN is set)

Static IP Requirement

Groww requires a static IP for order placement (SEBI compliance). Register your IP at:

Groww App → Settings → Trading APIs → Add Static IP

Read-only operations (holdings, positions, order list) work without a static IP.

Troubleshooting

Issue	Cause	Fix
401 Unauthorized	Token expired	Restart server (TOTP auto-refreshes) or regenerate manual token
403 Forbidden on market data	No subscription	Subscribe to Groww Live Data (₹499/mo)
Invalid credentials	Wrong TOTP secret	Regenerate TOTP token on Groww website
Token works but orders fail	No static IP	Register your IP in Groww Trading APIs settings