Set up IBKR Cloud

1. What you need first

• An Interactive Brokers Pro account. IBKR Lite accounts cannot register an OAuth consumer.
• A paper or live IBKR account. Orders from the browser go to whichever account your credentials resolve to — a paper account (ids beginning DU) routes straight through, while a live account additionally requires live-trading access, part of the Pro and Ultimate plans and enabled per account after review.
• OpenSSL on your machine. It ships with macOS and most Linux distributions; on Windows, use WSL or Git Bash.

2. Generate your keys locally

Run these in an empty directory you control. The private halves never leave your machine except for the one signing key you paste into Arcanan.

Signing key pair, encryption key pair, and DH parameters:

openssl genrsa -out private_signature.pem 2048
openssl rsa -in private_signature.pem -pubout -out public_signature.pem
openssl genrsa -out private_encryption.pem 2048
openssl rsa -in private_encryption.pem -pubout -out public_encryption.pem
openssl dhparam -outform PEM -out dhparam.pem 2048

Convert the signing key to PKCS#8 — this is the form Arcanan accepts, and the one whose PEM block begins -----BEGIN PRIVATE KEY-----:

openssl pkcs8 -topk8 -inform PEM -outform PEM -nocrypt \
  -in private_signature.pem -out private_signature_pkcs8.pem

Finally, extract the Diffie-Hellman prime as hex. Printing the parameters shows the prime as colon-separated bytes:

openssl dhparam -in dhparam.pem -noout -text

Copy the prime's hex bytes and strip the colons and whitespace, so you end up with one long unbroken hex string. This one-liner does it for you:

openssl dhparam -in dhparam.pem -noout -text \
  | sed -n '/prime:/,/generator/p' \
  | grep -vE 'prime|generator' \
  | tr -d ' :\n'

3. Register in IBKR's OAuth Self-Service Portal

Reach the portal from Client Portal → Settings → API → OAuth Self Service, or go directly to IBKR's OAuth self-service login.

1. Upload the three public artefacts: public_signature.pem,public_encryption.pem, and dhparam.pem.
2. IBKR shows you a consumer key straight away. Save it.
3. The consumer then has to be activated, which can take until the next day. Once it is, the portal shows an access token and an encrypted access token secret.

4. Decrypt the access token secret

IBKR encrypts the secret to your encryption public key, so only you can read it. Decrypt it and print it as hex:

printf '%s' "<encrypted secret>" | base64 -d \
  | openssl pkeyutl -decrypt -inkey private_encryption.pem \
  | xxd -p \
  | tr -d '\n'

The result is another long hex string — that, not the value IBKR displayed, is what Arcanan needs.

5. Paste it into Arcanan

In the terminal, open Settings → Integrations → Interactive Brokers (Cloud) and choose Connect IBKR. Six fields:

• Consumer key — from step 3.
• Access token — from step 3.
• Access token secret — the decrypted hex from step 4, not the encrypted value.
• Diffie-Hellman prime — the hex string from step 2.
• Private signature key — the whole PKCS#8 PEM block, including the -----BEGIN PRIVATE KEY----- and -----END PRIVATE KEY----- lines.
• Account ID (optional) — e.g. DU1234567. Left blank, the first account IBKR reports is used.

6. Verify the connection

The card should flip to Connected to IBKR and list your accounts, with the default one highlighted. From there:

• Sync executions (last 7 days) pulls your fills into the executions panel.
• Watchlist import brings your IBKR watchlists into Arcanan.
• The order ticket gains an IBKR · Cloud destination, labelled with the resolved account and marked LIVE when that account is a live one.

7. Things worth knowing

• One brokerage session per username. A logged-in TWS or Client Portal session on the same login will compete with the cloud connection, and IBKR will report it. Connect a separate paper login if you keep TWS open.
• Keep the private keys private. Arcanan encrypts the signing key you paste and never shows it again; the encryption private key stays on your machine entirely.
• Disconnect removes it. One click in settings deletes the stored credentials, and every IBKR feature goes back to "not connected".
• Live orders need live trading. If your credentials resolve to a live account, the order ticket only enables that destination once live trading is switched on under Settings → Live trading, and every live order gets an extra confirmation step.