Standard Structure for Authenticated Requests

Prerequisites

Generic function design: Unlike the previous handshake steps, which were each dedicated to a single fixed endpoint, this function is parameterized by method and endpoint, making it the reusable core for all authenticated IBKR API traffic post-handshake. This should be documented as the primary, ongoing integration point that most consumers of this library will actually call — the handshake steps are a one-time (or infrequent) setup cost, while this function runs on every API interaction.

Construct the Request URL

1
url = f'https://{baseUrl}{endpoint}'

Unlike the fixed OAuth endpoint URLs used in earlier steps, endpoint is caller-supplied, allowing this function to target any path on IBKR’s API gateway (e.g., /portfolio/accounts, /iserver/account/orders, etc.).

Assemble OAuth Parameters

1
oauth_params = {
2
    "oauth_consumer_key": consumer_key,
3
    "oauth_nonce": hex(random.getrandbits(128))[2:],
4
    "oauth_signature_method": "HMAC-SHA256",
5
    "oauth_timestamp": str(int(datetime.now().timestamp())),
6
    "oauth_token": access_token
7
}

This parameter set is notably leaner than every prior step — it omits oauth_callback and oauth_verifier (relevant only to the initial handshake) and, critically, declares oauth_signature_method as HMAC-SHA256 rather than RSA-SHA256.

Build the Signature Base String

1
params_string = "&".join([f"{k}={v}" for k, v in sorted(oauth_params.items())])
2
base_string = f"{method}&{quote_plus(url)}&{quote(params_string)}"

Follows the same structural pattern as the Request Token and Access Token steps: sorted key=value pairs joined with &, then combined into METHOD&URL&PARAMS, with the URL encoded via quote_plus() and the parameter string via quote().

Query parameters excluded from signature base string: Note that query_params (passed separately to the final requests call in Step 6) are not included in this signature base string. Per OAuth 1.0a’s core specification, query string parameters that will be sent with the request are normally required to be included in the signature base string alongside the OAuth parameters.

Sign the Base String with HMAC-SHA256

1
bytes_hmac_hash = HMAC.new(
2
    key=base64.b64decode(live_session_token),
3
    msg=base_string.encode("utf-8"),
4
    digestmod=SHA256
5
).digest()
6
7
b64_str_hmac_hash = base64.b64encode(bytes_hmac_hash).decode("utf-8")
8
oauth_params["oauth_signature"] = quote_plus(b64_str_hmac_hash)

The signature is computed as:

$\text{signature} = \text{HMAC-SHA256}(\text{key}=\text{base64\_decode}(\text{live\_session\_token}),\ \text{message}=\text{base\_string})$

The resulting digest is Base64-encoded, then percent-encoded (quote_plus) for safe inclusion in the Authorization header — consistent with every prior signing step in this series.

This is the moment the LST is actually put to use. All prior documentation in this series has been building toward this single line: live_session_token, once decoded from Base64 back into raw bytes, becomes the symmetric signing key for every authenticated request.

Construct the Authorization Header

1
oauth_params["realm"] = realm
2
oauth_header = "OAuth " + ", ".join([f'{k}="{v}"' for k, v in sorted(oauth_params.items())])
3
headers = {"Authorization": oauth_header}
4
headers["User-Agent"] = "python/3.12"
5
headers["Accept"] = "*/*"
6
headers["Connection"] = "keep-alive"

realm is added to oauth_params (and thus rendered quoted) only after signature computation.

New headers introduced at this step:

Execute the Request

1
try:
2
    with s.request(method=method, url=url, headers=headers, params=query_params, json=content, stream=True) as req:
3
        if print_data == "y":
4
            print(pretty_request_response(req))
5
        if not req.ok:
6
            logger.error(f"Request to {url} failed: {req.status_code} - {req.text}")
7
            raise IBKRApiError(f"Request failed with status {req.status_code}: {req.text}")
8
        return req
9
except requests.exceptions.RequestException as e:
10
    logger.exception(f"Failed to submit request to {url}")
11
    raise IBKRApiError(f"Request submission failed: {e}") from e

This is the most operationally significant step, as it is executed on every authenticated API call rather than once during setup.