How to persist the 2FA for weekly use?

[Amir-Inbar]

Hi everyone 👋

I'm using the Docker image and everything is working well — except for 2FA persistence.

Each week I want to restart the container without manually re-approving 2FA again on my phone.
I'm mounting volumes and using CUSTOM_CONFIG=yes as well, but still I get prompted again after restart.

I’m wondering:

What's the correct way to persist the 2FA token across container restarts?

Is there a specific file or volume that needs to be mounted to achieve that?

Is CUSTOM_CONFIG required for this, or can it work with the default image setup?

Thanks so much in advance 🙏
Any guidance or working examples would be really appreciated!

[rlktradewright]

You cannot do 2FA persistence across a Sunday: it is IBKR's policy that there must be at least one full 2FA authentication each week: this is a hard-and-fast rule and there is no way around it.

When TWS/Gateway do an auto-restart, the credentials established by 2FA are persisted temporarily in a file called autorestart, and are used during the restart to bypass the need for another 2FA. As soon as the new instance of TWS/Gateway has used the credentials to re-establish the logon session, the autorestart file is deleted. The autorestart file thus only ever exists for a couple of seconds during the auto-restart process.

But those credentials are invalidated by IBKR on Sunday at 01:00 US/Eastern (see https://www.ibkrguides.com/traderworkstation/auto-restart-considerations.htm). Thus the first start of TWS/Gateway during the week will always require 2FA.

And therefore you will necessarily have to do a 2FA at least once a week.

Note that if you leave TWS/Gateway running without restarting on Sunday, the next autorestart does actually succeed, but the following one will fail. I don't know why IBKR allow this - it should fail at the first auto-restart - but I wish they wouldn't because it causes confusion.

If you close down TWS/Gateway during the week (for example by restarting your container), the autorestart file won't exist (because it's only created during an auto-restart exit), and full 2FA will be necessary.

[Amir-Inbar]

Hi all,

I'm running IB Gateway in Docker for automated trading. My setup spins up a new container per trade, which runs for 1–2 minutes, sends an order, and then shuts down.

I'm fine doing 2FA manually once a week, and I want to reuse that valid session in all containers launched during the same week (avoiding repeated 2FA prompts).

Current setup:
I perform 2FA once at the beginning of the week.

I mount a persistent volume:

volumes = {
    "~/.ib_gateway_sessions/myuser": {
        "bind": "/home/ibgateway/Jts",
        "mode": "rw"
    }
}

Question:
What exactly needs to be persisted to make this work reliably?

Is persisting /home/ibgateway/Jts enough?

Do I need to avoid CUSTOM_CONFIG=yes after the initial login?

Should I copy additional files after a successful 2FA?

Thanks in advance for your help!

[rlktradewright]

DId you read what I wrote?

This is not possible.

Reusing a previous session depends on the autorestart file existing. That file is only created when Gateway is doing an autorestart at the specified autorestart time, and is deleted as soon as autorestart has happened, within a few seconds.

Shutting down your container is not an autorestart situation, so the autorestart file is not created. So there's no wayto restart using those credentials.

Why start a new container for each trade? And if you really want to do that, why is tapping your phone to do the 2FA each time such a big deal?

[Amir-Inbar]

Thanks for the explanation! I'm trading the ES and MES, and some trades happen at night, so I prefer to launch the container only when needed and shut it down right after the order is sent.

Just to confirm—does that mean the only way to make this work is to keep the container alive for the entire week and perform 2FA only once per week? Am I missing something?

[rlktradewright]

You have two options:

1. Keep the container running all week using autorestart, and do 2FA once a week when you start it up.

2. Run the container when you need to place an order, and do 2FA each time. Given that 2FA is such a trivial and straightforward procedure, I really don't see why you seem to feel that it's a burden.

[Amir-Inbar]

Thanks!
The challenge for me with 2FA is that I'm not near the computer when my algorithm sends the order. I don't trade manually, and many strategies run overnight, so I prefer to handle 2FA just once a week instead of dealing with it every time.

[rlktradewright]

Ok, thanks for giving me the full picture. Now I see where you're coming from.

As a result of some experiments I did a while back, I may possibly have a solution for you. This is not something I want to discuss publicly, so I won't say anything more about it here.

I'll need to do some further experimenting to convince myself that it will work. This will probably have to wait until the weekend, because I'll need to use my Ubuntu VM with my live account (which is in use on Windows during the week).

If you're interested in this and would like to discuss it further, email me here: temp at aultan.com, which is a temporary junk address. I'll then email you back from my proper address.