Complete Guide to Shoonya (Finvasia) API Authentication in Java: OAuth 2.0, Zero-Dependency TOTP & WebSocket Streaming

package com.thoughtstopen.shoonya.auth;

import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;

public final class ChecksumUtil {

    private ChecksumUtil() {}

    /**
     * Calculates SHA-256 hash for Shoonya GenAcsTok verification.
     * Concatenation rule: appKey + secretKey + authCode (no spaces).
     *
     * @param appKey    The Vendor Code (e.g. FN164668_U)
     * @param secretKey The 64-character PRISM secret key
     * @param authCode  The single-use code from OAuth redirect
     * @return Lowercase 64-character hexadecimal SHA-256 string
     */
    public static String calculateChecksum(String appKey, String secretKey, String authCode) {
        String rawInput = appKey.trim() + secretKey.trim() + authCode.trim();
        try {
            MessageDigest digest = MessageDigest.getInstance("SHA-256");
            byte[] encodedHash = digest.digest(rawInput.getBytes(StandardCharsets.UTF_8));
            
            // Convert byte array to hexadecimal string representation
            StringBuilder hexString = new StringBuilder(2 * encodedHash.length);
            for (byte b : encodedHash) {
                String hex = Integer.toHexString(0xff & b);
                if (hex.length() == 1) {
                    hexString.append('0');
                }
                hexString.append(hex);
            }
            return hexString.toString();
        } catch (NoSuchAlgorithmException e) {
            throw new IllegalStateException("SHA-256 algorithm not available in standard JVM", e);
        }
    }
}

package com.thoughtstopen.shoonya.auth;

import java.net.URI;
import java.net.URLEncoder;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.nio.charset.StandardCharsets;
import java.time.Duration;

public class ShoonyaAuthClient {

    private static final String TOKEN_ENDPOINT = "https://api.shoonya.com/NorenWClientAPI/GenAcsTok";
    private final HttpClient httpClient;

    public ShoonyaAuthClient() {
        this.httpClient = HttpClient.newBuilder()
                .version(HttpClient.Version.HTTP_1_1)
                .connectTimeout(Duration.ofSeconds(10))
                .build();
    }

    /**
     * Exchanges single-use auth code for user session token (susertoken).
     */
    public String exchangeToken(String appKey, String secretKey, String authCode) throws Exception {
        String checksum = ChecksumUtil.calculateChecksum(appKey, secretKey, authCode);

        // Construct jData JSON payload
        String jsonPayload = String.format("{\"code\":\"%s\",\"checksum\":\"%s\"}", authCode, checksum);
        
        // Shoonya requires form URL-encoded parameter: jData=<json>
        String formBody = "jData=" + URLEncoder.encode(jsonPayload, StandardCharsets.UTF_8);

        HttpRequest request = HttpRequest.newBuilder()
                .uri(URI.create(TOKEN_ENDPOINT))
                .timeout(Duration.ofSeconds(15))
                .header("Content-Type", "application/x-www-form-urlencoded")
                .header("User-Agent", "ThoughtsToPen-Java-TradingEngine/1.0")
                .POST(HttpRequest.BodyPublishers.ofString(formBody))
                .build();

        HttpResponse<String> response = httpClient.send(request, HttpResponse.BodyHandlers.ofString());

        System.out.println("Shoonya Server HTTP Status: " + response.statusCode());
        System.out.println("Shoonya Server Response: " + response.body());

        return response.body();
    }
}

package com.thoughtstopen.shoonya.auth;

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.nio.ByteBuffer;
import java.time.Instant;
import java.util.Locale;

/**
 * Pure Java RFC 6238 Time-based One-Time Password (TOTP) Generator.
 * Zero external libraries required.
 */
public final class TotpGenerator {

    private static final String HMAC_ALGO = "HmacSHA1";
    private static final int TIME_STEP_SECONDS = 30;
    private static final int DIGIT_MODULUS = 1_000_000; // 6 digits

    private TotpGenerator() {}

    /**
     * Generates a 6-digit TOTP for the current 30-second window.
     *
     * @param base32Secret The Base32 2FA secret from Shoonya security setup
     * @return A 6-digit formatted numeric string (e.g. "482910")
     */
    public static String generateCurrentTotp(String base32Secret) {
        long currentWindow = Instant.now().getEpochSecond() / TIME_STEP_SECONDS;
        return generateTotp(base32Secret, currentWindow);
    }

    /**
     * Calculates TOTP code for a specific time window.
     */
    public static String generateTotp(String base32Secret, long timeWindow) {
        byte[] keyBytes = decodeBase32(base32Secret);
        byte[] counterBytes = ByteBuffer.allocate(8).putLong(timeWindow).array();

        try {
            Mac mac = Mac.getInstance(HMAC_ALGO);
            mac.init(new SecretKeySpec(keyBytes, HMAC_ALGO));
            byte[] hash = mac.doFinal(counterBytes);

            // Dynamic Truncation algorithm as per RFC 4226 Section 5.3
            int offset = hash[hash.length - 1] & 0x0F;
            int binaryCode = ((hash[offset] & 0x7F) << 24)
                    | ((hash[offset + 1] & 0xFF) << 16)
                    | ((hash[offset + 2] & 0xFF) << 8)
                    | (hash[offset + 3] & 0xFF);

            int otp = binaryCode % DIGIT_MODULUS;
            return String.format(Locale.ROOT, "%06d", otp);
        } catch (Exception e) {
            throw new IllegalStateException("Failed to calculate HMAC-SHA1 hash for TOTP", e);
        }
    }

    /**
     * Standard RFC 4648 Base32 alphabet decoder.
     */
    public static byte[] decodeBase32(String base32) {
        String sanitized = base32.toUpperCase(Locale.ROOT).replaceAll("[\\s-]+", "").replaceAll("=+$", "");
        byte[] output = new byte[sanitized.length() * 5 / 8];
        int buffer = 0;
        int bitsLeft = 0;
        int writeIndex = 0;

        for (char c : sanitized.toCharArray()) {
            int val;
            if (c >= 'A' && c <= 'Z') {
                val = c - 'A';
            } else if (c >= '2' && c <= '7') {
                val = c - '2' + 26;
            } else {
                throw new IllegalArgumentException("Invalid Base32 character encountered: " + c);
            }

            buffer = (buffer << 5) | val;
            bitsLeft += 5;
            if (bitsLeft >= 8) {
                bitsLeft -= 8;
                output[writeIndex++] = (byte) ((buffer >> bitsLeft) & 0xFF);
            }
        }
        return output;
    }
}

String secret = "JBSWQA1QPEHPK3PXP"; // Replace with your real TOTP Secret
String currentCode = TotpGenerator.generateCurrentTotp(secret);
System.out.println("Live 6-Digit 2FA Code: " + currentCode);

package com.thoughtstopen.shoonya;

import com.thoughtstopen.shoonya.auth.ChecksumUtil;
import com.thoughtstopen.shoonya.auth.ShoonyaAuthClient;
import com.thoughtstopen.shoonya.auth.TotpGenerator;

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.WebSocket;
import java.nio.ByteBuffer;
import java.util.Scanner;
import java.util.concurrent.CompletionStage;
import java.util.concurrent.CountDownLatch;

public class ShoonyaAlgoBootstrap {

    // Replace with your credentials
    private static final String USER_ID = "FN12345";
    private static final String VENDOR_CODE = "FN12345_U";
    private static final String SECRET_KEY = "YOUR_64_CHAR_PRISM_SECRET_KEY";
    private static final String TOTP_SECRET = "YOUR_BASE32_TOTP_SECRET";

    public static void main(String[] args) throws Exception {
        System.out.println("==================================================");
        System.out.println("    Shoonya Finvasia Java Authentication Engine   ");
        System.out.println("==================================================");

        // 1. Generate live TOTP to help the developer log in quickly
        String liveTotp = TotpGenerator.generateCurrentTotp(TOTP_SECRET);
        System.out.println("\n[Step 1] Live 2FA TOTP Code (valid 30s): " + liveTotp);
        System.out.println("Open this URL in your browser to get the single-use auth code:");
        System.out.println("https://api.shoonya.com/OAuthlogin/authorize/oauth?client_id=" + VENDOR_CODE);
        
        System.out.print("\nPaste the 'code' parameter from redirect URL: ");
        Scanner scanner = new Scanner(System.in);
        String authCode = scanner.nextLine().trim();

        // 2. Exchange Authorization Code for Session susertoken
        System.out.println("\n[Step 2] Calculating SHA-256 Checksum & Exchanging Token...");
        ShoonyaAuthClient authClient = new ShoonyaAuthClient();
        String responseJson = authClient.exchangeToken(VENDOR_CODE, SECRET_KEY, authCode);

        // Simple manual extraction of susertoken from response
        String tokenKey = "\"susertoken\":\"";
        int startIndex = responseJson.indexOf(tokenKey);
        if (startIndex == -1) {
            System.err.println("Authentication Failed. Check credentials / IP whitelist.");
            return;
        }
        startIndex += tokenKey.length();
        int endIndex = responseJson.indexOf("\"", startIndex);
        String userToken = responseJson.substring(startIndex, endIndex);

        System.out.println("\n[Success] Obtained Active susertoken:");
        System.out.println(userToken);

        // 3. Connect to Live Market Data WebSocket
        System.out.println("\n[Step 3] Connecting to Shoonya WebSocket (NorenWSAPI)...");
        CountDownLatch latch = new CountDownLatch(1);

        HttpClient.newHttpClient().newWebSocketBuilder()
                .buildAsync(URI.create("wss://api.shoonya.com/NorenWSAPI/"), new WebSocket.Listener() {
                    @Override
                    public void onOpen(WebSocket webSocket) {
                        System.out.println("Connected to Shoonya WS Gateway. Sending Auth Packet...");
                        
                        // Send authentication payload
                        String authPacket = String.format(
                                "{\"t\":\"a\",\"uid\":\"%s\",\"actid\":\"%s\",\"usertoken\":\"%s\",\"source\":\"API\"}",
                                USER_ID, USER_ID, userToken
                        );
                        webSocket.sendText(authPacket, true);
                        WebSocket.Listener.super.onOpen(webSocket);
                    }

                    @Override
                    public CompletionStage<?> onText(WebSocket webSocket, CharSequence data, boolean last) {
                        String message = data.toString();
                        System.out.println("[Shoonya WS Recv]: " + message);

                        // If auth acknowledged, subscribe to Reliance (Token 2885) & Nifty 50 (Token 26000)
                        if (message.contains("\"ak\"") && message.contains("\"OK\"") 
                                || message.contains("\"ck\"") && message.contains("\"OK\"")) {
                            System.out.println("Authentication Confirmed! Subscribing to NSE Live Ticks...");
                            String subPacket = "{\"t\":\"t\",\"k\":\"NSE|2885#NSE|26000\"}";
                            webSocket.sendText(subPacket, true);
                        }

                        return WebSocket.Listener.super.onText(webSocket, data, last);
                    }

                    @Override
                    public void onError(WebSocket webSocket, Throwable error) {
                        System.err.println("WebSocket Error: " + error.getMessage());
                        WebSocket.Listener.super.onError(webSocket, error);
                    }
                }).join();

        // Keep program alive to observe live ticks
        Thread.sleep(60_000);
    }
}