TOTP 2FA

[TRGORE]

Is there a way to automate TOTP 2FA with IBC? The IBKR login I am using is a secondary login, and doesn't use the IB-key authentication (as with my main IBKR login). The secondary account uses a TOTP auth code instead.

Could this feature be added to IBC?

[code-hustler-ft3d]

[rlktradewright]

Please don’t make claims about what I will or won’t do! I can speak for myself…

It is true that I won't add this functionality to IBC, but not because it is 'winding down'. See my answer below.

[rlktradewright]

It is technically possible for IBC to automate this, but I am completely opposed to doing so. The reason is simple: if 2FA is automated, it has no value. The purpose of 2FA is to provide extra reassurance to IBKR that the person (ie the IBKR human customer) doing authentication is who they claim to be via their username and password: so for example if someone breaks into my house and somehow manages to run IBC on my computer, then the need to manually enter the TOTP code via a registered device means they will fail 2FA (assuming my device is not sitting unlocked on the desk). But if 2FA is automated, then they will succeed, so this would completely bypass the benefit of 2FA.

I will certainly not give my endorsement to any potential IBC replacement that automates TOTP 2FA in this way.

[XYUU]

I was inspired by this discussion and implemented the feature because it was genuinely needed. TOTP support is optional, not mandatory. As a user, you are free to choose between full automation or confirming the login through IB Key manually. Once automation is enabled, you are responsible for the security of your own device.

I do not take responsibility for any loss or damage caused by the use of this feature. It is open‑source, optional, and entirely up to you whether to enable it.

https://github.com/XYUU/IBC

[rlktradewright]

As I said earlier, I won't endorse any IBC replacement that atuomates TOTP (or any other 2FA method).

Automating 2FA bypasses the security mechanisms that IBKR have introduced, which not only provide additional security to users but also provide evidence to IBKR that the user is indeed the intended user, which would be important in case of claims for loss. Automation completely negates this, especially if it doesn't involve a user at all (such as where username and password entry is also automated), and I believe that IBKR would take a very dim view of this. Anyone who wants to follow this path would be advised to take legal advice.

[code-hustler-ft3d]

Thank you is the words you're looking for. And I already said them to you.

[rlktradewright]

When there is something to thank you for, I'll thank you. The conversation is not over yet. When I get time I'll get back to it, but it won't be today.

[code-hustler-ft3d]

roger that. I'll be around

[rlktradewright]

Just quickly, I've often wondered, for companies that offer trading services to IBKR customers (for example wheere the customer can write a trading strategy and it is then executed on that company's servers), what they do about authentication. I suspect, but have no eveidence for this, that theywork with IBKR to makes the service possible. For example they might tag the account to indicate that 2FA is not required, perhaps requiring some magic incantation when starting Gateway/TWS.

If I were in the business of wanting to offer such a service, that's exactly where I'd start: I'd contact IBKR and ask for their advice and assistance. I can't see that the fact that a Gateway is running in a cloud-hosted container changes the equation at all regarding automating TOTP, unless IBKR have sanctioned it.

Besides, there's no reason why such Gateway/TWS instances can't just use IBKey on the mobile app, rather than TOTP. That doesn't require any modfication or bypassing of IBKR's mechanisms. The serivce would presumably start the customer's Gateway or TWS at a specified time every day, and the customer would have to acknowledge the 2FA alert shortly after that time (and if they forget, IBC can be configured to ensure that they keep receiving the alert every 5 minutes or so until they either acknowledge it or cancel it. What's not to like?

[code-hustler-ft3d]

Agreed — that's the right instinct. The moment you're running other people's accounts, step one is IBKR and step two is a lawyer, not a clever auth setup.

But notice what that implies: once the money isn't yours, the gating issue stops being 2FA and becomes financial regulation. In the US, taking discretion over client funds for compensation almost certainly lands you in investment-adviser (RIA) and/or broker-dealer territory, with custody rules on top. And IBKR already has the plumbing — Advisor and Broker master accounts, fully-disclosed introducing arrangements — none of which is an individual account. You'd onboard through that, disclose, and whatever they tell you about authentication, you'd just do it.

So yes, the commercial case is its own animal, and an honest "that's over my head — lawyers and IBKR" is the only correct answer there. Which is also why it's orthogonal to an individual running their own account on their own box: different actor, different risk, different body of law. (Not legal advice — same non-lawyer caveat as yours.)