Direct answer
How does a web app safely connect to my Interactive Brokers account?
The web app never touches your broker directly. You run a small connector on the computer that already has IBKR Gateway or TWS. The connector opens a secure tunnel, registers with your workspace, reads portfolio positions, and accepts baskets for sending — with one-time setup and a secret that only your workspace knows.
The connection model
Your broker credentials stay on your machine. The app talks to your connector over an encrypted tunnel, and the connector talks to IBKR Gateway on your machine using its API.
- One-time setup code from the app
- Installer downloads a small connector
- Connector registers with your workspace
- Secret is stored encrypted per workspace
Gateway or TWS
IBKR Gateway is the lightweight program for API use; TWS is the full trading platform. Either works as long as API access is enabled. Paper accounts (port 4002) are a safe way to test; live accounts use port 4001.
How the tunnel works
The connector creates a temporary secure tunnel so the app can reach your machine without opening ports on your router. If your computer is off, the connector is offline and nothing can be sent.
- No public ports on your router
- Works from home, office, or laptop
- Offline when the computer is off
- Reconnects when you run it again
Limits
- The connector must run on a machine with Gateway or TWS installed.
- Paper and live accounts need different ports and settings.
- Connection is read/send only after you confirm — no autonomous trading.
Common questions
Questions about this workflow
Is my broker password shared with the app?
No. The app never receives your IBKR password. The connector uses your local Gateway session, and the workspace secret is used only to authenticate the app to your connector.
Can I test without risking real money?
Yes. IBKR paper accounts simulate trading. Start there to verify portfolio sync and a test basket before using a live account.