Oath1a Setup - Failed to set Key - failed to put consumer info - Request failed with status code 403

[lightbeard]

Hello, I'm trying to complete the Oath 1.0a setup per the ibind docs.

I executed the commands as shown successfully on an Amazon Linux instance and copied them to my pc.

I agreed to the disclosure, put in a Consumer Key and clicked the "Save" button.

However, when I try to upload the my public_signature.pem file, I get the following error:

"Failed to set Key - failed to put consumer info - Request failed with status code 403"

One mistake I made is I first filled out the form using my paper account login during which I received the same error. I closed the browser and started the registration over again with my Pro account, but get the same error. I've tried different eight digit consumer key phrases, that doesn't help.

[lightbeard]

I got past my issue. I ran the openssl commands on my laptop using cygwin and then it worked. I guess the pem files had a different end of line character when copied from EC2 to windows? Who knows.. I'm just glad to be past the issue.

[art1c0]

@Voyz i have the same issue but on a mac, so i cannot use cygwin. any suggestion?

[art1c0]

@Voyz well, i've managed to resolve that by generating openssl files on a linux virtual machine.
now i passed all the steps and getting "401 Client Error: Unauthorized for url: https://api.ibkr.com/v1/api/oauth/live_session_token" but i guess it may be caused because of up to 24h delay. waiting...

[Voyz]

@art1c0 great, thanks for reporting back. I've added a note to the WiKi that 403 can be caused/solved by that.

As for 401, indeed the very post I've shared with you before #58 mentions that after some time 401 stopped appearing. Given that you just proceeded with your application I'd imagine after a few days it will be approved 👍 Let us know how it goes

[art1c0]

@Voyz yes, i can confirm successful connection using both live and paper accounts.
however there's some weirdness involved, such as not all generated pem files are supported by IBKR, some still cause 403 error for whatever reason. so i'd suggest to try a few times in this case.

[Voyz]

@art1c0 great, glad to hear! 🙌 If you could, please update your comment on Reddit where you say it's not possible for individuals to access OAuth. IBKR support indeed says that it's not possible for some reason, but it is.

As for the weirdness - did you spot any pattern, what works vs what doesn't? It could be useful to include in the WiKi

[art1c0]

@Voyz actually I think that it's still 'should' not be possible for individuals to use OAuth, and what we do is a kind of hack, and I feel that this hole may eventually be closed by IBKR if they get to know that many people abusing it. So I'm not sure that we have to spread this widely, otherwise it can work against us, if you know what I mean...
Both IBKR docs and support say that OAuth is only for institutional, and the fact that they did not verify it properly may be just a matter of time. One reason may be that OAuth allows to skip 2FA and gateway, which is a huge advantage they want to keep away from regular poor traders :)

Regarding weirdness, apart from the fact that not every pem file gets accepted by their side for unknown reason (I didn't try too many times though), I found also that paper account gets logged out approximately 1-2 seconds after initialisation, but the live one stays for long. That's being said, there's not much useful (and even confusing) to use paper accounts with Web API.

Another thing is that I found that the API may return 503 errors on some requests if they are made right after login. So I have to use 1 second delay before making requests to give their system some time to prepare.

My general feeling is that Web API is still in beta and for sure lacks many features of TWS API sadly. It goes to limited order types, data streaming and general stability.
What can I say when they require conid for most requests, but there's no straightforward way to get it through Web API...
ServerId returned by websocket is another "nice" feature :) I could continue this list, but I just hope they will develop the API as it's anyway much more modern that the old TWS, even though it's far superior as for now.

[Voyz]

actually I think that it's still 'should' not be possible for individuals to use OAuth, and what we do is a kind of hack, and I feel that this hole may eventually be closed by IBKR if they get to know that many people abusing it.

Frankly, OAuth support was contributed by IBind's users; I don't use it myself and I cannot comment on this in depth. All I can say is that other people with individual accounts trade with it successfully, whether it is officially supported or not, and hence IBind currently supports using it.

503 errors

These do appear occasionally. They indicate some issues on IBKR server side, again probably a good idea to chat with their support about this.

My general feeling is that Web API is still in beta and for sure lacks many features of TWS API sadly.

Absolutely, both lack features that other have. Sadly indeed.