How to provide TOTP for user login(not account)?

[jpedrick]

I would like to use IBC to log in as 'users', but IBC gets stuck here:

2026-02-27 01:18:53:069 IBC: detected dialog entitled: Second Factor Authentication; event=Activated
2026-02-27 01:18:53:070 IBC: detected dialog entitled: Second Factor Authentication; event=Focused

I don't get the IB Key notification within the app, because IB Gateway is expecting me to enter a TOTP password. How can I provide this to IBC so it can authenticate the user login?

I'm planning to use this within a docker container using xvfb-run, so manual intervention in the login dialog isn't possible. However, I can use stdin to provide the TOTP.

[rlktradewright]

There is no way to enter the TOTP password without manually keying it in.

It's not clear to me what you mean by 'I can use stdin to provide the TOTP'. Please explain.

If you can't do manual inputs at login time, you should use the IB Key 2FA method (ie via IBKR Mobile App).

If you have registered for both IBKey and TOTP, you need to read the notes for the SecondFactorDevice setting in config.ini.

[jpedrick]

@rlktradewright I didn't realize I could use IB Keys with user logins. I was able to add the IB Key authentication. I was able to add that to my user login and it works.

It's not clear to me what you mean by 'I can use stdin to provide the TOTP'. Please explain.

I meant that I would be able to enter the TOTP in a prompt from the command line or using telnet/netcat. Though, I still think it would be a useful feature to support.

[rlktradewright]

So what did you think IBKey is for, if not for 2FA during user login?

Providing a means to get the TOTP password into TWS/Gateway other than via the user typing it in (for example by IBC being given the TOTP password by some means and then entering it into the dilaog itself) is not going to happen. Anything that involves third-party software in authentication will not have been validated by IBKR's security authority. Note that IBC does not intervene in any way in 2FA by IBKey or TOTP. In the case of IBKey, IBC can restart the login sequence process if 2FA alert acknowledgment times out, but the 2FA tself is entirely IBKR's software and works exactly the same as when IBC is not involved.

[jpedrick]

So what did you think IBKey is for, if not for 2FA during user login?

I had an IB Key for my account level login(like root access for your account), but Interactive Broker's allows sub-users with various roles and permissions. I had an IB Key for my account level login, but it wasn't immediately obvious the app could manage multiple IB Keys. I have multiple sub-accounts, which have multiple users.

Providing a means to get the TOTP password into TWS/Gateway other than via the user typing it in (for example by IBC being given the TOTP password by some means and then entering it into the dilaog itself) is not going to happen.

That seems reasonable. I just want to be able to manually enter it with a password prompt in the terminal. I'm comfortable enough with Java, but I'm not familiar with AWT/Swing. So, I haven't yet taken a 'swing' at implementing this in my own copy of IBC.

In my case I'm building my trading system on top of Kubernetes and using IBC + IB Gateway in a docker container with xvfb-run. Since Interactive Brokers doesn't allow multiple logins with the same user, I want to keep the top level account login free so I can use it for TWS and manual order entry across all of my accounts, while using the non-root users for market data, risk management and order entry. Starting IBC/IB Gateway will be the most manual part of my startup process. I'm still in early stages of development, so I'm figuring out how all the parts fit together.

Though, "it would be nice" if I didn't have to use my phone to start my trading application. I worry a bit about my phone being stolen/lost/hacked into remotely(where my login credentials and 2FA are both accessible on the same device). I worry less about a computer left in my home, behind a firewall, with an up to date secure operating system, with an encrypted hard drive. I haven't heard of too many real world exploits that make TOTP style authentication insecure. DSC+ would be the most secure(the key and the username/password not stored and managed on the same device), but it's not available to everyone.