What a broker connection allows
A connection uses your broker's API, the official interface brokers provide for apps and platforms. The broker decides what the API can do.
| A connected platform can | A connected platform cannot |
|---|---|
| See your funds and margin | Withdraw money from your account |
| See your holdings and positions | Change your bank account, address or nominee |
| See your orders and trades | Transfer shares to another demat account |
| Place, modify and cancel orders | See the password you type on your broker's login page |
| Receive market prices for your strategies | Keep trading after your session expires |
Money leaves a trading account only to the bank account registered with your broker, and only when you ask your broker for a withdrawal.
How the login works
- You create an API key in your broker's API console and register your static IP there.
- You add that API key to QuantPower and choose your broker.
- Each trading day, QuantPower sends you to your broker's login page.
- You enter your broker credentials and two-factor code there.
- Your broker issues an access token for that day's session.
- The token stops working when the broker ends the session, and you log in again the next trading day.
QuantPower never asks for your broker password or two-factor codes and does not store them. Your API key, API secret and the day's access token are stored on your own computer or VPS, where QuantPower runs, so they stay with you. NSE's implementation standards under SEBI's framework require OAuth-based login with two-factor authentication for API access, and brokers must log out every API session before the next trading day.
What data QuantPower uses and why
| Data | Used for |
|---|---|
| Profile and client ID | Showing which account a strategy trades on |
| Funds and margin | Checking there is enough margin before a strategy places orders |
| Positions | Position monitoring and the MTM stop loss |
| Orders and trades | Order management and strategy performance reports |
| Holdings | Portfolio views and stock SIPs |
Your broker decides which data its API shares. The connection gives no access to your bank account or to other demat accounts. Our QuantPower security page explains how we protect the platform itself.
Static IP and order tagging
SEBI's framework ties every API order to your API key and to a static IP registered with your broker, and tags algo orders so the exchange can trace them.
- Static IP: API orders must come from a static IP address registered with your broker. You need your own static IP, and your strategies' orders go out from it, so keep that computer or VPS secure.
- Order-rate limit: an algo you build yourself can run without exchange registration only while it stays under 10 orders a second. A faster algo must be registered through your broker.
- Algo ID: each order from a registered strategy carries an exchange-assigned Algo ID, so the exchange can trace it to the strategy, the broker and your account.
These rules make it hard for anyone to trade your account from an unknown computer, or to run a fast algo on it that the exchange has not registered. Our guide to SEBI rules for option trading covers the framework in full.
Two-factor authentication
Every broker login needs a second factor, usually a six-digit code from an authenticator app or an OTP sent to your phone.
- Use an authenticator app if your broker supports one. It works without mobile signal.
- Keep your phone's clock on automatic time, because authenticator codes depend on it.
- Never share your broker password, an OTP or an authenticator code. No genuine support team, including QuantPower's, needs one to help you.
- Never share the setup key or QR code for your authenticator. Anyone who has it can generate your codes.
How to revoke access
You can end a platform's access at any time.
- Disconnect in QuantPower: remove the broker in your broker settings. Strategies on that account stop.
- Revoke at the broker: delete the API key or regenerate its secret in your broker's API console. Most brokers also list connected apps in their account settings, where you can remove access.
- Change your password and reset two-factor authentication if you think someone else has your details.
Before you disconnect, close any positions a strategy is managing or decide how you will manage them. Once access ends, QuantPower can no longer exit them for you.
Warning signs
These are signs that an automation service is unsafe or not following the rules:
- It asks for your broker password, an OTP or your authenticator setup key.
- It promises a fixed daily or monthly return. SEBI bars brokers from referring to algo returns and from working with platforms that do.
- It asks you to transfer money to it, or to hand over control of your account so it can trade for you.
- It sells ready-made strategies but cannot show that it is empanelled with the exchange as an algo provider, or their orders carry no Algo ID.
- Its strategy logic is hidden and it has no SEBI Research Analyst registration.
- Someone in a Telegram or WhatsApp group asks you to send your API key, API secret or access token.
Good habits
- Use a unique, strong password for your broker account.
- Treat your API secret like a password. If it may have leaked, regenerate it in your broker's API console.
- Check your order book and positions at least once a day.
- Read the trade alerts NSE and BSE send to your registered phone and email. They come straight from the exchange.
- Set a daily loss limit for your strategies.
- Review the API keys and apps linked to your broker account every month.
- Test new strategies in paper trading before running them live.
If something looks wrong
- Log in to your broker's app and check orders and positions there.
- Cancel unwanted orders and close unwanted positions directly with your broker.
- Disconnect the platform, change your broker password and regenerate your API secret.
- Contact your broker and QuantPower support with the time, order IDs and screenshots.
- If your broker does not resolve the complaint, raise it with SEBI through the SCORES portal.
Under SEBI's framework, your broker handles complaints about algo orders placed through its systems. You can reach QuantPower at [email protected], by phone on +91 97111 30044, or through our contact page.
Start your free trial
Connect your broker, build a strategy and test it on paper before a single live order goes out.
Frequently asked questions
Can QuantPower withdraw money from my trading account?
No. Broker APIs do not allow withdrawals. Money leaves your trading account only for your registered bank account, when you request it from your broker.
Does QuantPower see my broker password?
No. You type your password on your broker's own login page, so it goes only to your broker. QuantPower works with your own API key and the day's access token, never your password.
Why do I have to log in every day?
SEBI's framework requires brokers to log out every API session before the next trading day. The daily login also limits how long a stolen token could be used.
What happens to my positions if I disconnect?
They stay open in your broker account. QuantPower can no longer manage or exit them, so close them or manage them in your broker's app.
Can someone place orders in my account without my login?
Not through a broker API. A session starts only after you log in with your password and two-factor code, it ends every day, and API orders must come with your API key from your registered static IP.
Sources
- SEBI, circular on safer participation of retail investors in algorithmic trading, 4 February 2025, and glide-path circular, 30 September 2025 (sebi.gov.in) (checked 20 October 2026)
- NSE, implementation standards for retail algo trading, 5 May 2025, and operational modalities, 22 July 2025 (nseindia.com) (checked 20 October 2026)
- SEBI, circular barring brokers from referring to past or expected returns of an algorithm, 2 September 2022 (sebi.gov.in) (checked 20 October 2026)