We don't have a need for "other users" to connect to our back-end and it would probably be quite a challenge to make that secure.
While each TWS/IBGW instance can only log into one account, that can be an "account of accounts" in case the various accounts are linked together. That does not necessarily mean all accounts have to have the same owner. In that case, a single client can trade for all linked accounts by simply adding the relevant account number when placing orders. And during login, 2FA is only required for that "account of accounts".
If the accounts are not linked, individual instances of TWS/IBGW plus client application have to be started. You can automate that with Richard King's IBC and there are several discussions over at /g/ibcalpha/topics how to setup IBC such that 2FA during login takes place on a mobile device that can be far away from where IBC/TWS/IBGW run.
闯ü谤驳别苍
On Fri, Jul 29, 2022 at 11:29 AM, bart decanne.com wrote:
Jurgen, I totally agree with your assessment about the need for 2FA.?
?
One question: is your system allowing other users to connect to your backend? If so how do you handle them entering their PW/2FA code securely so your backend can connect to their accounts? There are some robotrading sites that do that and just wonder how it is implemented.?
?
