Broker API Authorization & Consent
Effective Date: [TO BE INSERTED ON PUBLICATION]
This Broker API Authorization & Consent ("Consent") forms part of the Agreement between you and SMF Technologies LLP ("Company") and governs the Company's access to your brokerage account via your broker's official Application Programming Interface ("API"). As of the date of this document, the supported broker is Upstox.
1. What You Are Authorizing
1.1 By completing the OAuth authorization flow within the Platform, you grant the Company's Nexora platform a token-based, revocable authorization to access your Upstox account programmatically, solely for the purpose of providing the Service as described in the Terms of Service.
1.2 This authorization is initiated by you, on Upstox's own login interface, using your own Upstox credentials. At no point does the Company receive, view, or store your Upstox login password, trading PIN, or two-factor authentication codes.
1.3 The access token issued to the Company permits the following categories of actions, depending on the scopes granted by Upstox's API and required for the features you enable:
| Category | Description | Used for |
|---|---|---|
| Read: Profile & funds | Account identity, available margin/funds | Capital allocation calculations, eligibility checks |
| Read: Holdings & positions | Current holdings, open F&O positions | Position monitoring, adjustment/exit logic |
| Read: Order book & trade book | Historical and pending orders | Strategy state tracking, P&L computation |
| Read: Market & option chain data | LTP, OHLC, option chain, OI | Strategy entry/adjustment signal generation |
| Place / Modify / Cancel orders | Submit new orders, modify pending orders, cancel orders | Executing the strategies you have configured and activated |
1.4 The Company's access does NOT include, and Upstox's API does not permit, the ability to: withdraw funds, transfer funds, change your bank account or nominee details, change your password or contact details, or close your account. These actions can only be performed by you directly through Upstox.
2. Scope of Automated Action
2.1 Orders are placed, modified, or cancelled by the Service only for strategies that you have explicitly activated and configured, and only within the parameters (capital allocation, instrument universe, position sizing, entry/exit/adjustment rules) you have set in your account Settings.
2.2 You can, at any time and without prior notice to the Company:
- pause or deactivate any strategy from the Platform;
- adjust configuration parameters, which will apply prospectively;
- place, modify, or cancel orders directly through Upstox's own app/web platform, independent of the Service (note: such manual actions may interact with, or be overridden by, the Service's automated logic if the relevant strategy remains active — see Section 4); and
- revoke this Consent entirely (Section 5).
3. Token Handling and Security
3.1 Your Upstox access/refresh tokens are stored encrypted at rest and are transmitted only over TLS-encrypted connections.
3.2 Upstox access tokens expire daily (per Upstox's standard token policy) and must be refreshed by you via the re-authorization link sent to you (e.g., via Telegram). If a token expires and is not refreshed, the Service will be unable to place, modify, or cancel orders on your account until you re-authorize.
3.3 You are responsible for ensuring the security of the device and accounts (e.g., email, Telegram) used to receive re-authorization links.
4. Interaction with Manual Trading
If you place, modify, or cancel orders manually on Upstox while an automated strategy is active on the Platform for the same instrument(s), this may result in: (a) the Service's view of your positions becoming temporarily inconsistent with your actual broker positions until the next synchronization; (b) the Service placing orders that, combined with your manual orders, exceed your intended exposure; or (c) the Service's automated adjustment/exit logic acting on positions you have already manually modified. The Company is not responsible for losses arising from such interactions. If you intend to trade manually in the same instruments/strategies, you should first pause the relevant strategy on the Platform.
5. Revoking this Consent
5.1 You may revoke this Consent at any time by either:
- disabling the broker connection from the Platform's Settings (which instructs the Company to cease use of, and delete, your stored tokens); or
- revoking the Company's access directly from your Upstox account's connected apps/API access settings.
5.2 Revocation will immediately stop all new order placement, modification, or cancellation by the Service on your account. Revocation does not automatically close any open positions — any open positions resulting from previously placed orders remain in your account and are your responsibility to manage.
6. No Custody, No Pooling
The Company does not, at any time, take custody of your funds or securities, commingle your funds with those of other users, or have the ability to direct payments out of your brokerage account. All assets remain at all times with Upstox (the broker) and the relevant depository participant, in your name.
7. Acknowledgment
By completing the OAuth authorization flow, you confirm that:
- you are the lawful holder of the Upstox account being connected;
- you have read and understood the scope of access described in Section 1;
- you understand the risks described in the Risk Disclosure Document, including risks arising from automated order placement; and
- you consent to the Company accessing and using your account data and placing orders as described in this document, until such time as you revoke this Consent under Section 5.