SEBI static IP for algo trading
Retail algo orders through a broker API are tied to one static IPv4 stored on the API key; calls from any other address are refused. Host the strategy on a VPS that holds the address, whitelist it in the broker console, then confirm a test order from a second network is rejected.
For retail traders whose broker-API algos must whitelist one static IPv4 before live orders.
knowledge
- Read time
- 4 min
- Sections
- 5
- Updated
- 14 Nov 2026
- Written by
- WebJi® team
Last editorial update: 15 November 2026.
What the SEBI framework requires of retail algo traders
The retail algo framework brokers cite stores one static IPv4 against each API key, refuses orders from any other address, and logs API sessions out daily. The address maps to one client at a time, and the broker's risk checks stay on the connection regardless of where the order originates.
At or under 10 orders per second per exchange or segment, the published norm does not ask you to register the strategy — the exchange tags those orders with a generic algo id. Above that line you register through the broker and the exchange returns an id. Confirm the live number with your broker, because the exchange can revise it. If you hold more than one API key, unregistered algos stay on the single key the broker designates; the other keys are for algos that already carry an exchange id.
Public write-ups cite SEBI circular SEBI/HO/MIRSD/MIRSD-PoD/P/CIR/2025/13 of 4 February 2025, titled "Safer participation of retail investors in algorithmic trading", an NSE note in May 2025, and a broker go-live discussed as 1 April 2026 — and the same write-ups say an earlier date was extended. The notice in your broker console is the date you trade on.
Who needs a static IP on the API key — and who does not
You need the whitelist when a script, a webhook or a program on a server sends orders through the broker API; you do not when every order is clicked inside the broker's own website or app. A bot on a VPS is in the first group, and so is any third-party tool you have handed the API key to. A chart that never places an order, like the app-only trader, has no separate source address to pin.
- API, webhook or bot: the static IPv4 goes on the key.
- Clicks only in the broker app: nothing to whitelist.
- Other people's accounts: a separate static IPv4 for each client — parking several unrelated accounts on one address is the pattern broker explainers flag.
How a VPS address passes the broker whitelist
A VPS works because it holds one IPv4 that survives reboots, while a home line usually gets a new address whenever the router reconnects — and the next order then leaves from an address the key does not list. An ISP-pinned home address is no substitute: it stays at the house, so a laptop at the office is a different source and fails the check. A shared VPN exit is not your address either — many people use it and you may not keep it. Use IPv4 unless the broker console has a field that accepts IPv6; broker notes have generally not said IPv6 is enough on its own.
- Copy the IPv4 from the algo trading VPS panel. Reboot once and confirm the same address is still listed.
- Whitelist it in the broker API console, then finish the OTP or callback the broker sends.
- Run the strategy on that VPS so every order leaves from the copied address — a Kite Connect walk-through is in the Zerodha algo VPS guide; other broker APIs use the same idea.
- Prove the whitelist by sending a test with the same key from a phone hotspot. The broker should refuse it — that refusal is the proof.
- Leave the bot on the VPS. Do not also send live orders from a laptop on the home line.
It worked when the VPS order is accepted and the hotspot order is rejected, before you put on live size.
Family accounts, a changed IP and second locations
One static IP belongs to one client: family members can share it only after the broker records written consent or a 2FA request, and unrelated clients each need their own address. Broker summaries of the exchange norm allow the mapped address to be updated on a weekly cycle — do it while the market is shut. If the address changes while the bot is sending, new calls from the old address fail, but orders the exchange has already accepted are not cancelled by that check.
| Situation | What to whitelist |
|---|---|
| One client, one bot | That client's static IPv4 on the key |
| Two family accounts | Same address only after the broker's consent or 2FA |
| Two unrelated clients | A different static IPv4 for each client |
| The address must change | Update in the weekly window, then move the bot |
What the VPS costs — and what WebJi® does not do
No monthly amount is printed for this setup: a machine with a fixed IPv4 is quoted by email before you pay — write to support@webji.services, with replies in Hindi and English and an average first reply under 60 minutes. WebJi® VPS plans generally start from ₹499 a month for an entry configuration; your algo machine is scoped and quoted, not sold off a rate card.
WebJi® hosts the server — nothing more. We are not your broker and we are not SEBI: we do not register the strategy, do not hold the API key, and do not enter the address in the broker console. You do that. If you also run MetaTrader, the MT4/MT5 VPS setup guide walks the same fixed-IP logic. Free migration of an existing server is subject to terms and approval, and it is not instant.
Frequently asked questions
What is the SEBI static IP rule for algo trading?
Brokers store one static IPv4 on the API key used for retail algo orders, and calls from any other address are refused. Public write-ups cite SEBI circular SEBI/HO/MIRSD/MIRSD-PoD/P/CIR/2025/13 of 4 February 2025 and later exchange notes. Confirm the live date in your broker console, because published go-live dates have already moved.
Do I need a static IP if I only trade from the broker app?
No. If every order is clicked inside the broker's own website or app, no API call leaves your machine, so there is no source address to whitelist. A script, a webhook or a bot on a server does need the static IPv4 on the key.
How do I whitelist a VPS for algo trading?
Copy the IPv4 from the VPS panel, add it to the API key in the broker console, and complete the broker's OTP. Then place a test order from the VPS and a test from another network — the second should be rejected. Only that rejection proves the whitelist works.
Can two accounts share one static IP?
One static IP maps to one client. Family members may share it only when the broker has written consent or a 2FA request on file. Unrelated accounts each need their own address, and brokers flag several unrelated accounts parked on one IP.
What happens if my IP changes during market hours?
New API calls from the old address fail; orders the exchange has already accepted stay there. Update the key only in the broker's weekly change window, with the market shut, and move the bot after the new address is saved.
Last editorial update: 15 November 2026.
Ready to get started with WebJi®?
Join 12,000+ businesses across India and overseas. INR pricing, 18% GST shown before payment and 24/7 email support in Hindi and English — average first reply under 60 minutes.