Access Token & Access Token Secret

Prerequisites

Before this step can be executed, ensure you have:

Construct the Endpoint URL

1
url = f'https://api.ibkr.com/v1/api/oauth/access_token'

The Access Token endpoint follows the same host as the Request Token endpoint, differing only in path. As with the prior step, this is invoked via POST.

Assemble OAuth Parameters

1
oauth_params = {
2
    "oauth_callback": "oob",
3
    "oauth_consumer_key": consumer_key,
4
    "oauth_nonce": hex(random.getrandbits(128))[2:],
5
    "oauth_signature_method": "RSA-SHA256",
6
    "oauth_timestamp": str(int(datetime.now().timestamp())),
7
    "oauth_token": rToken,
8
    "oauth_verifier": vToken,
9
}

This parameter set extends the Request Token step’s set with two additional required fields:

Nonce/timestamp warning: A new nonce and timestamp are generated for this request, as required by the spec. Do not reuse values from the Request Token step — each signed request must carry its own unique nonce/timestamp pair, even within the same overall authorization flow.

Build the Signature Base String

1
params_string = "&".join([f"{k}={v}" for k, v in sorted(oauth_params.items())])
2
base_string = f"POST&{quote_plus(url)}&{quote(params_string)}"

This follows the identical pattern established in the Request Token step:

1. Parameters sorted alphabetically by key.
2. Joined into a raw key=value&key=value... string.
3. URL encoded via quote_plus(), parameter string encoded via quote().
4. Combined into the METHOD&URL&PARAMS base string format.

Sign the Base String with RSA-SHA256

1
encoded_base_string = base_string.encode("utf-8")
2
sha256_hash = SHA256.new(data=encoded_base_string)
3
bytes_pkcs115_signature = PKCS1_v1_5_Signature.new(
4
    rsa_key=signature_key
5
).sign(msg_hash=sha256_hash)
6
b64_str_pkcs115_signature = base64.b64encode(bytes_pkcs115_signature).decode("utf-8")

Identical process to the Request Token step: SHA-256 digest of the base string, signed with PKCS#1 v1.5 padding using the application’s RSA private key, then Base64-encoded for transport.

Finalize and Encode the Signature

1
oauth_params["oauth_signature"] = quote_plus(b64_str_pkcs115_signature)
2
oauth_params["realm"] = realm

As before, the signature is percent-encoded prior to header insertion, and realm is appended for the Authorization header only — it remains excluded from the signature base string itself.

Construct the Authorization Header

1
oauth_header = "OAuth " + ", ".join([f'{k}="{v}"' for k, v in sorted(oauth_params.items())])
2
headers = {"authorization": oauth_header}
3
headers["User-Agent"] = "python/3.11"

Identical construction pattern to the Request Token step. See prior documentation regarding the User-Agent hardcoding caveat — the same recommendation to parameterize this value for production applies here.

Execute the Request

1
request_request = requests.post(url=url, headers=headers)
2
print(pretty_request_response(request_request))

As with the Request Token call, no request body is sent — all authentication material is carried in the Authorization header.

Parse the Access Token and Secret

1
if request_request.status_code == 200:
2
    aToken = request_request.json()["oauth_token"]
3
    aTokenSecret = request_request.json()["oauth_token_secret"]

Two credentials are returned on success:

🔒 Critical security handling: aTokenSecret must be treated as highly sensitive material. It should:

• Never be logged, including in debug output (pretty_request_response should redact this field if response bodies are logged at any verbosity).
• Never be persisted in plaintext at rest — encrypt if storage is required.
• Be held only in memory for the duration needed to complete the Live Session Token derivation, if your architecture allows discarding it afterward.