# IBKR Web API vs TWS API: login, restarts and who can use it URL: https://fincodelabs.com/en/blog/ibkr-web-api-vs-tws-api · Publisher: Fincode (Fincode Yazılım ve Teknoloji A.Ş.), Istanbul, Turkey · Category: Stocks, forex and broker APIs · Published: 2026-11-06 · Updated: 2026-11-06 IBKR Web API vs TWS API from IBKR's docs read 5 Nov 2026: login, restarts, pacing, eligibility, FIX, three project cases and a map of the moved documentation. **Short answer:** **IBKR Web API vs TWS API** comes down to what must stay running: the TWS API is a socket connection to a logged-in TWS or IB Gateway, while the Web API is REST and WebSocket, reached by retail accounts through the local Client Portal Gateway. Neither offers an individual account unattended login, but as read on 5 November 2026 the TWS route needs a manual login about weekly with auto-restart and the gateway route daily. A hosted product acting on other people's accounts through the Web API needs OAuth approval, which individual accounts cannot get. Both APIs reach the same account, so the choice is about operations rather than features: who logs in, how often, and on which machine. This page compares them from IBKR's own documents, read on 5 November 2026. The documentation was heavily reorganized in October 2026, so a map of where it now lives is at the end, along with the points where its pages disagree. Which credentials you need and what they cost is covered in the [Interactive Brokers API key](https://fincodelabs.com/en/blog/interactive-brokers-api-key) guide. No IBKR account was available, so nothing here ran against a real login. No broker is recommended or ranked here, and rules depend on your country and account type. For readers in Turkey, separate rules apply to leveraged FX with foreign firms: the [Capital Markets Board said on 23 February 2023](https://spk.gov.tr/duyurular/basin-duyurulari/2023/izinsiz-kaldiracli-islemlere-iliskin-basin-duyurusu) that residents may trade leveraged products only through firms it has authorized ([Law No. 6362](https://www.mevzuat.gov.tr/mevzuatmetin/1.5.6362.pdf) Articles 99(4) and 109(2)). Automated trading can lose money. ## IBKR Client Portal API vs TWS API: the comparison For a single account the deciding rows are login, restarts and what has to run on your machine; the rest rarely changes the answer. **TWS API and Web API (retail route), from IBKR's documentation read 5 November 2026** | Question | TWS API | Web API with Client Portal Gateway | | --- | --- | --- | | Transport | TCP socket; the official Python client moves to protobuf message by message, from server version 201 | HTTPS REST and WebSocket, JSON | | What must run | TWS or IB Gateway, both desktop applications | Client Portal Gateway, a small Java program | | Where your code runs | Same machine by default; remote clients need Trusted IPs, single addresses only, no subnets | Same machine as the gateway, for both the browser login and every call | | Login | Manual in a login window; headless operation is not supported | Manual in a browser; automating it is not supported | | How often | Auto-restart Monday to Saturday, then manual login after the weekly reset | Daily; a session lasts up to 24 hours | | Idle timeout | IBKR recommends the Never lock Trader Workstation setting; Hong Kong (IBHK) users cannot choose it, so TWS locks from inactivity and drops API sessions, while IB Gateway does not | About 5 to 6 minutes without requests; call /tickle about every 60 seconds | | Sessions | One brokerage session per username across all platforms; up to 32 client connections per TWS or Gateway | One brokerage session per username; a read-only session can coexist with TWS trading | | Scheduled breaks | A daily restart at a time you choose | /iserver briefly down around 01:00 regional time; wider maintenance on Saturday evenings | | Pacing | Market data lines divided by 2 per second: 50 at the default 100 lines. Error 100, and three breaches end the session, or automatic pacing, depending on a setting | 10 requests per second per session, plus endpoint limits such as order lists at 1 per 5 seconds. HTTP 429, then an IP penalty | | Order prompts | TWS precaution settings can hold or warn on API orders | Reply messages must be confirmed, or suppressed with POST /iserver/questions/suppress | | Languages | Official clients for Python, Java, C++, C# and VB | Any HTTP client | | Account | Open, funded IBKR Pro | Open, funded IBKR Pro; the gateway blocks Lite and fractional order submissions from 30 October 2026 | | Market data | Subscription plus Market Data API Acknowledgement | Same; WebSocket smd requests end after 10 minutes unless sent again | Python readers should also know that IBKR added a synchronous wrapper in TWS API 10.40, which removes the callback style but not the need for a running TWS or Gateway. Setup and code are in [Interactive Brokers API Python](https://fincodelabs.com/en/blog/interactive-brokers-api-python). ## IBKR Web API authentication: three methods, one open to individuals Individual accounts use the Client Portal Gateway; OAuth 1.0a and OAuth 2.0 are for institutions and approved vendors, and they call https://api.ibkr.com directly with no gateway. Once logged in, a session has two tiers. A [read-only session](https://www.interactivebrokers.com/docs/web-api/authentication/trading) reaches non-/iserver endpoints such as portfolio data and leaves a TWS session undisturbed. Market data and orders need a brokerage session, with a set start-up order that IBKR describes in prose. This is that order in code. It ran on 5 November 2026 (Python 3.11, requests) against a local stub standing in for the gateway, not against IBKR software, so it shows the sequence and not real responses. ```python import os, time import requests, urllib3 urllib3.disable_warnings() # the gateway's certificate is self-signed BASE = os.environ.get("CPGW", "https://localhost:5000") + "/v1/api" s = requests.Session() s.verify = False # acceptable only for this localhost hop s.headers["User-Agent"] = "my-tool/1.0" # IBKR asks for one on every request def start_brokerage_session(): """Run after the human has logged in through the browser on this machine.""" s.post(f"{BASE}/iserver/auth/ssodh/init", json={"publish": True, "compete": True}, # compete disconnects other sessions timeout=15).raise_for_status() time.sleep(2) # IBKR: wait 2 seconds before /iserver calls accounts = s.get(f"{BASE}/iserver/accounts", timeout=15).json() if not accounts.get("accounts"): raise RuntimeError("brokerage session not ready") return accounts["accounts"] def keep_alive(): r = s.post(f"{BASE}/tickle", json={}, timeout=15) body = r.json() if r.ok else {} return body.get("iserver", {}).get("authStatus", {}).get("authenticated", False) # False: log in or re-init if __name__ == "__main__": print("accounts:", start_brokerage_session()) print("authenticated:", keep_alive()) ``` Output against the stub: ``` accounts: ['DU0000000'] authenticated: True ``` The compete flag deserves attention: [IBKR says](https://www.interactivebrokers.com/docs/web-api/v1/endpoints/session/initialize-brokerage-session) it decides whether other brokerage sessions are disconnected in favor of this one. If the same username is trading in TWS, this call can stop it, which is why a second username is the usual arrangement. IBKR also lists an [MCP server for AI tools](https://www.interactivebrokers.com/en/trading/ai-integrations.php) on api.ibkr.com, signed in through its own login screen. That is a separate product from the two APIs compared here and was not tested. ## FIX, the third route FIX is for order routing at volume, costs a monthly minimum and sends no market data, so it rarely fits a single trader's script. [IBKR's FIX page](https://www.interactivebrokers.com/docs/fix/requirements) asks for USD 10,000 minimum equity to apply and sets a monthly minimum commission of USD 1,500 for the first session and USD 1,000 for each further one, so two sessions mean USD 2,500 a month if commissions fall short. Its [FAQ](https://www.interactivebrokers.com/docs/third-party-integrations/general-third-party-frequently-asked-questions) says FIX carries orders only. Institutions need [dedicated connectivity](https://www.interactivebrokers.com/docs/fix/connectivity); others can run FIX over the internet through IB Gateway, where the [pacing page](https://www.interactivebrokers.com/docs/tws-api/doc/pacing-limitations) gives 250 messages per second. [Onboarding](https://www.interactivebrokers.com/docs/fix/onboarding) ends in a supervised certification test that includes unsolicited cancels, simulated trade busts and a line failure. FIX in general is covered in [broker API integration](https://fincodelabs.com/en/blog/broker-api-integration-fix-rest). ## Three cases: which IBKR API to build on Match the route to who is being served: yourself, your reports or other people. ### One trader's script on a VPS The TWS API with IB Gateway is the lower-maintenance fit, because auto-restart limits manual logins to about one a week, against a daily browser login on the gateway. The server still needs a desktop session, since neither application runs headless, and someone must be available to complete 2FA when the login comes round. IB Gateway uses about 40% fewer resources than TWS, by IBKR's figure. The Web API suits you if your stack is not one of the supported languages and you accept the daily login. > **Hypothetical example.** A script runs on the 20 trading days of a four-week month. With auto-restart the TWS route asks for about 4 manual logins, one a week. The gateway route asks for about 20, one each trading day, in a browser on that same server. ### A reporting tool for your own account Start with the [Flex Web Service](https://www.interactivebrokers.com/docs/web-api/flex-web-service/introduction): a token, a query you define in Client Portal, and no session to keep alive, so it cannot disturb live trading. It delivers reports rather than live data. For intraday positions, read-only Web API endpoints come next. ### A product serving other people On the Web API, an individual account cannot ship this: OAuth 2.0 is closed to individual structures, and [third-party vendors](https://www.interactivebrokers.com/docs/web-api/trading/getting-started/trading-access-for-third-parties) may currently seek approval only for OAuth 1.0a. IBKR expects an established business and a public site describing the product, and its three stage estimates add up to 8 to 14 weeks if they run in sequence. It also expects vendors of automated trading to hold registration in each region served, or a legal opinion on why none is needed. Software that each user connects to their own TWS or Gateway takes the TWS API route instead, and IBKR's [integrations list](https://www.interactivebrokers.com/docs/third-party-integrations/available-integrations) shows many such products. Its [download page](https://download2.interactivebrokers.com/installers/tws-api/index.html) still prohibits using the TWS API to pass market data to third parties without prior written approval. Serving other people's accounts raises licensing questions that no API choice solves, so take legal advice first. Fincode does not offer account management. For general scoping, see [project and product analysis](https://fincodelabs.com/en/services/project-and-product-analysis) or [exchange API integration](https://fincodelabs.com/en/services/exchange-api-integration); naming IBKR here does not mean Fincode integrates it or has built on it. ## Interactive Brokers API documentation: where it lives now Current documents sit under interactivebrokers.com/docs, and the older locations either redirect, point onward or mark themselves deprecated. **Documentation map, checked 5 November 2026** | Topic | Current page | Older location | | --- | --- | --- | | TWS API | [/docs/tws-api/doc/introduction](https://www.interactivebrokers.com/docs/tws-api/doc/introduction) | interactivebrokers.github.io/tws-api says it is deprecated; the Campus twsapi-doc address redirects to /docs | | Web API | [/docs/web-api/introduction](https://www.interactivebrokers.com/docs/web-api/introduction) | The Campus webapi-doc page is still served separately | | TWS API download | [download2.interactivebrokers.com](https://download2.interactivebrokers.com/installers/tws-api/index.html) | interactivebrokers.github.io now only links there | | Third-party integrations | [/docs/third-party-integrations](https://www.interactivebrokers.com/docs/third-party-integrations/available-integrations) | Consolidated on 24 September and 2 November 2026, per its changelog | | What changed | [TWS API changelog](https://www.interactivebrokers.com/docs/tws-api/changelog) and [Web API changelog](https://www.interactivebrokers.com/docs/web-api/changelog) | The 27 October 2026 TWS entry shortened many URL paths, so old deep links may fail | Where these pages disagree, test on your own session rather than trusting either: - **Penalty box.** The [trading pacing page](https://www.interactivebrokers.com/docs/web-api/trading/usage-and-availability/pacing-limitations) says 10 minutes; the [v1.0 page](https://www.interactivebrokers.com/docs/web-api/v1/pacing-limitations) says 15. - **/tickle.** The pacing table lists GET; the [endpoint page](https://www.interactivebrokers.com/docs/web-api/v1/endpoints/session/ping-the-server) shows POST. - **Idle timeout.** The authentication FAQ gives both about 6 minutes and 5 minutes. - **Weekly login.** The TWS download page and FAQ point to Sunday, after the Saturday reset; the reauthentication page says Monday. - **Ports.** Quick-start code comments show 7946 and 7947; the Campus lesson and the sync documentation give 7496 and 7497. - **OAuth.** The Web API introduction says authorization uses OAuth 2.0; the registration page excludes individual accounts. - **Third-party OAuth.** The [organizations page](https://www.interactivebrokers.com/docs/web-api/trading/getting-started/trading-access-for-organizations) lists OAuth 2.0 (beta) for third-party use; the third-party page allows only OAuth 1.0a. All of these were read on the live pages on 5 November 2026; the main ones are listed under Sources. ## Questions to answer before you commit Five answers usually decide the route before any code is written. 1. **Who logs in, and when?** Name the person and the fallback for the weekly or daily login, including 2FA, and keep any credentials out of code, as [API key security](https://fincodelabs.com/en/blog/api-key-security-trading-bots) explains. 2. **Will anyone use the same username elsewhere?** A phone login can compete with the session, and IBKR says a Client Portal login with the username of a running TWS stops it reconnecting automatically after the next disconnection. Budget for a second username and its market data fee. 3. **What happens during the restart?** Decide what the program does with pending work while TWS, Gateway or /iserver is down. 4. **Is anyone else's account or data involved?** If yes, stop and read the third-party terms before choosing an API. 5. **Which release do you pin?** IBKR publishes Stable and Latest TWS API releases and [retires old releases over time](https://www.interactivebrokers.com/docs/third-party-integrations/version-control), so plan upgrades as ongoing work. ## Frequently asked questions ### Is the Client Portal API the same as the Web API? Yes, in practice. IBKR's pages use Web API, Client Portal Web API and CPAPI for the same REST interface, and the Client Portal Gateway is the local program retail accounts use to reach it. ### Can the IBKR Web API run without the gateway? Only with OAuth, which calls https://api.ibkr.com directly. As read on 5 November 2026, that route is for approved institutions and vendors, and OAuth 2.0 is not available to individual account structures. ### Is the TWS API faster than the Web API? No latency comparison from IBKR was found, so no figure is given here. What it does publish is pacing: 50 requests per second by default on the TWS API and 10 per second on the Web API. ### Can I use both APIs at the same time? Not for trading on one username, because only one brokerage session can be active across all platforms. A second username works, with market data charged again, and read-only Web API calls can coexist with a TWS session. ### Does the TWS API need TWS open? It needs either TWS or IB Gateway running and logged in. IBKR treats them as equivalent for API purposes, and Gateway uses fewer resources. ## Sources - [IBKR Web API: Introduction](https://www.interactivebrokers.com/docs/web-api/introduction) - [IBKR Web API: Getting Started (retail and institutional)](https://www.interactivebrokers.com/docs/web-api/getting-started) - [IBKR Web API: Authentication introduction](https://www.interactivebrokers.com/docs/web-api/authentication/introduction) - [IBKR Web API: Trading Sessions (start-up sequence, keep-alive)](https://www.interactivebrokers.com/docs/web-api/authentication/trading) - [IBKR Web API: Authentication FAQ](https://www.interactivebrokers.com/docs/web-api/authentication/faq) - [IBKR Web API: Limitations of the Client Portal Gateway](https://www.interactivebrokers.com/docs/web-api/authentication/cpgw/limitations-of-the-client-portal-gateway) - [IBKR Web API: Pacing Limitations](https://www.interactivebrokers.com/docs/web-api/trading/usage-and-availability/pacing-limitations) - [IBKR Web API: Scheduled Server Maintenance](https://www.interactivebrokers.com/docs/web-api/trading/usage-and-availability/scheduled-server-maintenance) - [IBKR TWS API: Download TWS or IB Gateway (headless, restarts)](https://www.interactivebrokers.com/docs/tws-api/doc/download-tws) - [IBKR TWS API: Pacing Limitations](https://www.interactivebrokers.com/docs/tws-api/doc/pacing-limitations) - [IBKR TWS API: Remote TWS API Connections](https://www.interactivebrokers.com/docs/tws-api/doc/connectivity/remote-tws-api-connections-with-trader-workstation) - [IBKR FIX: Requirements and Costs](https://www.interactivebrokers.com/docs/fix/requirements) - [IBKR Web API: Trading Access for Third Parties](https://www.interactivebrokers.com/docs/web-api/trading/getting-started/trading-access-for-third-parties) - [IBKR TWS API: Changelog](https://www.interactivebrokers.com/docs/tws-api/changelog) - [SPK (Capital Markets Board): Notice on unauthorized leveraged transactions, 23 February 2023 (Turkish)](https://spk.gov.tr/duyurular/basin-duyurulari/2023/izinsiz-kaldiracli-islemlere-iliskin-basin-duyurusu) > This guide is general information about software and markets, not investment, legal or tax advice. Automated trading can lose money, past or backtested performance does not guarantee future results, and the rules that apply depend on your jurisdiction and your exchange's terms. Sources, checks and corrections: see the [editorial policy](https://fincodelabs.com/en/editorial-policy). --- Published by Fincode (Fincode Yazılım ve Teknoloji A.Ş.), a software company in Istanbul, Turkey: https://fincodelabs.com/en/blog/ibkr-web-api-vs-tws-api Cite as: Fincode, "IBKR Web API vs TWS API: login, restarts and who can use it", updated November 6, 2026, https://fincodelabs.com/en/blog/ibkr-web-api-vs-tws-api