求助：Interactive Brokers OAuth1获取live_session_token遇401错误

问题背景 #

社区普遍认为Interactive Brokers的OAuth功能存在问题，我尝试按官方文档实现，先调试C#代码无果，转用官方Python示例，修复缺少引用、拼写错误后仍返回401状态码。环境为MacOS M2 + Python3，试过TESTCONS和test_realm，但不清楚如何获取对应token及token secret。

代码如下：

import random
import base64
from datetime import datetime
import requests
from urllib.parse import quote_plus, quote
from Crypto.Signature import pkcs1_15 as PKCS1_v1_5_Signature
from Crypto.Cipher import PKCS1_v1_5
from Crypto.Hash import SHA256
from Crypto.PublicKey import RSA

# Generate a random 256-bit integer.
dh_random = random.getrandbits(256)

access_token_secret = 'see_image'
consumer_key = 'see_image'
access_token = 'see_image'
baseUrl = 'api.ibkr.com/v1/api/'
realm = 'limited_poa'

with open("./dhparam_aum_ib.pem", "r") as f:
    dh_param = RSA.importKey(f.read())
    dh_prime = dh_param.n # Also known as DH Modulus
    dh_generator = dh_param.e  # always =2
# Convert result to hex and remove leading 0x chars.
dh_challenge = hex(pow(base=dh_generator, exp=dh_random, mod=dh_prime))[2:]


# Compute the Diffie-Hellman challenge:
# generator ^ dh_random % dh_prime
# Note that IB always uses generator = 2.
# Convert result to hex and remove leading 0x chars.

with open("./private_encryption.pem", "r") as f:
    encryption_key = RSA.importKey(f.read())
bytes_decrypted_secret = PKCS1_v1_5.new(
    key=encryption_key
    ).decrypt(
        ciphertext=base64.b64decode(access_token_secret),
        sentinel=None,
        )
prepend = bytes_decrypted_secret.hex()

base_string = prepend
# Elements of the LST request so far.
method = 'POST'
url = f'https://{baseUrl}/oauth/live_session_token'
oauth_params = {
    "oauth_consumer_key": consumer_key,
    "oauth_nonce": hex(random.getrandbits(128))[2:],
    "oauth_timestamp": str(int(datetime.now().timestamp())),
    "oauth_token": access_token,
    "oauth_signature_method": "RSA-SHA256",
    "diffie_hellman_challenge": dh_challenge,
}
# Combined param key=value pairs must be sorted alphabetically by key
# and ampersand-separated.
params_string = "&".join([f"{k}={v}" for k, v in sorted(oauth_params.items())])
# Base string = method + url + sorted params string, all URL-encoded.
base_string += f"{method}&{quote_plus(url)}&{quote(params_string)}"
# Convert base string str to bytestring.
encoded_base_string = base_string.encode("utf-8")
# Generate SHA256 hash of base string bytestring.
sha256_hash = SHA256.new(data=encoded_base_string)
# Generate bytestring PKCS1v1.5 signature of base string hash.
# RSA signing key is private signature key.
bytes_pkcs115_signature = PKCS1_v1_5_Signature.new(
    rsa_key=encryption_key
    ).sign(msg_hash=sha256_hash)
# Generate str from base64-encoded bytestring signature.
b64_str_pkcs115_signature = base64.b64encode(bytes_pkcs115_signature).decode("utf-8")
# URL-encode the base64 signature str and add to oauth params dict.
oauth_params['oauth_signature'] = quote_plus(b64_str_pkcs115_signature)
# Oauth realm param omitted from signature, added to header afterward.
oauth_params["realm"] = realm
# Assemble oauth params into auth header value as comma-separated str.
oauth_header = "OAuth " + ", ".join([f'{k}="{v}"' for k, v in sorted(oauth_params.items())])
# Create dict for LST request headers including OAuth Authorization header.
headers = {"Authorization": oauth_header}
# Add User-Agent header, required for all requests. Can have any value.
headers["User-Agent"] = "python/3.11"
# Prepare and send request to /live_session_token, print request and response.
lst_request = requests.post(url=url, headers=headers)
# Check if request returned 200, proceed to compute LST if true, exit if false.
if not lst_request.ok:
    print(f"ERROR: Request to /live_session_token failed. Exiting...")
    raise SystemExit(0)
# Script not exited, proceed to compute LST.
response_data = lst_request.json()
dh_response = response_data["diffie_hellman_response"]
lst_signature = response_data["live_session_token_signature"]
lst_expiration = response_data["live_session_token_expiration"]

错误排查及解决建议 #

1. 代码中的明显错误 #

• 参数分隔符错误：代码中params_string = "&".join(...)使用了HTML转义字符&，OAuth参数的合法分隔符是普通&，这会直接导致签名计算错误，引发401。需改为：

  params_string = "&".join([f"{k}={v}" for k, v in sorted(oauth_params.items())])
  

• 签名密钥混用：代码用加密私钥（encryption_key）做签名，但IB OAuth要求签名和加密使用不同的密钥对，签名必须用专门的签名私钥，需确认密钥文件是否用错。
• URL拼接冗余斜杠：baseUrl = 'api.ibkr.com/v1/api/'拼接后会出现//oauth/live_session_token的双斜杠，可能导致签名URL不匹配，建议改为baseUrl = 'api.ibkr.com/v1/api'。

2. 凭据与环境匹配问题 #

• 若使用TESTCONS测试环境，必须配套test_realm，且consumer_key、access_token、access_token_secret都要从测试环境后台生成，不能混用生产凭据。
• access_token_secret是IB返回的加密字符串，需确保用自己的加密私钥正确解密，检查密钥文件路径、格式是否无误。

3. 其他细节问题 #

• 时间戳时区错误：代码用本地时间生成oauth_timestamp，建议改用UTC时间str(int(datetime.utcnow().timestamp()))，避免时区差异导致的有效性验证失败。
• 调试信息缺失：仅判断状态码不够，需打印lst_request.text获取IB返回的具体错误信息（如签名无效、凭据过期等），方便定位问题。

4. 成功实现经验 #

不少开发者已成功实现IB OAuth功能，核心是严格遵循官方签名流程：确保参数排序正确、URL编码规范、密钥使用准确，同时保证凭据、密钥、环境三者完全匹配。

内容的提问来源于stack exchange，提问作者Neville Bamshoot