Retrieve Live Session Token Signature

Prerequisites

Generate the Diffie-Hellman Challenge

1
dh_random = random.getrandbits(256)
2
dh_challenge = hex(pow(base=dh_generator, exp=dh_random, mod=dh_prime))[2:]

This computes the client’s half of a standard Diffie-Hellman key exchange:

$\text{dh\_challenge} = generator^{\text{dh\_random}} \bmod \text{dh\_prime}$

Critical secret material: dh_random is returned by this function and must be retained (in memory, or securely if persisted) — it is required as an input to compute the final Live Session Token from IBKR’s dh_response in the next step.

Decrypt the Access Token Secret to Produce the Base String Prepend

1
bytes_decrypted_secret = PKCS1_v1_5_Cipher.new(
2
    key=encryption_key
3
).decrypt(
4
    ciphertext=base64.b64decode(access_token_secret),
5
    sentinel=None,
6
)
7
prepend = bytes_decrypted_secret.hex()
8
base_string = prepend

This is a step unique to the IBKR OAuth model and has no equivalent in the prior Request Token / Access Token steps.

Process:

1. Base64-decode access_token_secret (received as a string from the Access Token response) into raw ciphertext bytes.
2. Decrypt using PKCS#1 v1.5 encryption padding (note: encryption/decryption padding, distinct from the PKCS#1 v1.5 signature padding used elsewhere) with the private encryption_key.
3. Convert the resulting decrypted bytes to a hex string — this becomes the prepend.
4. The prepend is placed at the very beginning of what will become the signature base string — before the standard METHOD&URL&PARAMS structure.

Construct the Signature Base String

1
method = 'POST'
2
url = f'https://{baseUrl}/oauth/live_session_token'
3
oauth_params = {
4
    "oauth_consumer_key": consumer_key,
5
    "oauth_nonce": hex(random.getrandbits(128))[2:],
6
    "oauth_timestamp": str(int(datetime.now().timestamp())),
7
    "oauth_token": access_token,
8
    "oauth_signature_method": "RSA-SHA256",
9
    "diffie_hellman_challenge": dh_challenge,
10
}
11
12
params_string = "&".join([f"{k}={v}" for k, v in sorted(oauth_params.items())])
13
base_string += f"{method}&{quote_plus(url)}&{quote_plus(params_string)}"

Parameter set for this request:

This is the most important structural distinction in this entire flow: the signature base string is prefixed with the hex-encoded decrypted secret (prepend) before the standard METHOD&URL&PARAMS string is appended. This prepend is not URL-encoded and is not separated from the rest of the base string by an & — it is direct string concatenation.

Sign the Base String with RSA-SHA256

1
encoded_base_string = base_string.encode("utf-8")
2
sha256_hash = SHA256.new(data=encoded_base_string)
3
bytes_pkcs115_signature = PKCS1_v1_5_Signature.new(
4
    rsa_key=signature_key
5
).sign(msg_hash=sha256_hash)
6
b64_str_pkcs115_signature = base64.b64encode(bytes_pkcs115_signature).decode("utf-8")
7
oauth_params['oauth_signature'] = quote_plus(b64_str_pkcs115_signature)

Process:

1. Encode the base string to UTF-8 bytes.
2. Compute the SHA-256 digest.
3. Sign the digest using PKCS#1 v1.5 padding with your RSA private key (signature_key — a Crypto.PublicKey.RSA key object).
4. Base64-encode the raw signature bytes into a transmittable string.

Construct the Authorization Header

1
oauth_header = f"OAuth realm={realm}, " + ", ".join([f'{k}="{v}"' for k, v in sorted(oauth_params.items())])
2
headers = {"Authorization": oauth_header}
3
headers["User-Agent"] = "python/3.11"

The header follows the standard OAuth scheme format:

Authorization: OAuth key1="value1", key2="value2", ...

Parameters are sorted alphabetically (matching convention, though not strictly required at this stage since the signature was already computed). User-Agent Note: IBKR’s API gateway may enforce User-Agent validation. Update this value to reflect your actual runtime/client rather than hardcoding "python/3.11" for production deployments — pin it to your actual interpreter/environment version, or set a custom identifying string as permitted by IBKR’s integration guidelines.

Execute the Request

1
lst_request = requests.post(url=url, headers=headers)
2
print(pretty_request_response(lst_request))

This is a header-only POST with no request body.

Parse the Response

1
response_data = lst_request.json()
2
dh_response = response_data["diffie_hellman_response"]
3
lst_signature = response_data["live_session_token_signature"]
4
lst_expiration = response_data["live_session_token_expiration"]
5
6
return dh_random, prepend, dh_response, lst_signature, lst_expiration

Response fields:

The next stage in computing the Live Session Token will require the following details from the Live Session Token Signature request:

• dh_random — client’s private DH exponent (Step 1)
• prepend — decrypted secret hex string (Step 2)
• dh_response — server’s public DH value (this step)
• lst_signature — for verifying the computed LST
• lst_expiration — for session lifecycle management