How to create a read-only Interactive Brokers API key

Open IBKR Client Portal ↗

We walked through these steps in a live Interactive Brokers account on 23 September 2026. Interactive Brokers can rename a button at any time. If a label differs, look for the same permission.

Before you start

• Use your live IBKR login, not a paper-trading one.
• Linked or advisor accounts: do this from the Master account, and pick it if IBKR asks you to choose an account.

Permissions

Turn on only:

• Open Positions → Summary: Account ID, Currency, Asset Class, Symbol, Description, Quantity, Mark Price, Position Value, Cost Basis Price, Cost Basis Money
• Cash Report: Account ID, Currency, Ending Cash
• Format: XML
• Period: Last Business Day
• Flex Web Service Status

Keep these off:

• Lot (in Open Positions)
• Other Open Positions fields, e.g. ISIN, CUSIP, Account Alias
• Every other section, e.g. Trades, Cash Transactions, Transfers
• Other Cash Report fields, e.g. Deposits, Withdrawals, Dividends

Steps

Sovereign connects to Interactive Brokers from one fixed IP address. The connection form in Sovereign shows it next to these steps, with a copy button.

1. Log in with your live IBKR username and open “Performance & Reports” → “Flex Queries”.
2. In the “Activity Flex Query” box, click ⊕ and name the query “Sovereign”.
3. Click “Open Positions”, choose only “Summary”, tick the fields listed above, then click “Save”.
4. Click “Cash Report”, tick only “Account ID”, “Currency” and “Ending Cash”, then click “Save”.
5. Under “Delivery Configuration”, set “Format” to “XML” and “Period” to “Last Business Day”. Leave “General Configuration” unchanged.
6. Click “Continue”, then “Save”, then “Create”.
7. Back on “Flex Queries”, click the ⓘ icon left of “Sovereign” and copy the “Query ID”.
8. Click the gear in the “Flex Web Service Configuration” box on the right, tick “Flex Web Service Status”, then click “Save”.
9. Set “Expire After” to the longest option (1 year).
10. Paste Sovereign's IP address into “Valid for IP Address”.
11. Click “Generate New Token”.
12. Copy the “Current Token”, paste it and the Query ID into the fields of Sovereign's connection form, then press “Connect & Sync”.

Where each value goes in Sovereign:

• Current Token → FLEX TOKEN
• Query ID → FLEX QUERY ID

Does an Interactive Brokers API key expire?

• With an IP restriction: Up to 1 year — the IP lock doesn't extend it.
• Without an IP restriction: Up to 1 year (you choose; IBKR's default is only 6 hours).

IBKR has no non-expiring token. When it expires the connection shows KEY EXPIRED; generate a new token and press Reconnect — the Query ID stays the same.

The Flex token only downloads reports saved under your IBKR login (it cannot trade, withdraw or transfer), and Sovereign requests only the query you paste. To include several accounts under one login, add them with “Add/Edit Accounts” in “Delivery Configuration”; accounts under another login need their own connection.

If something goes wrong

• If you don't see “Expire After”: click “Generate New Token” once to open the token form, then do step 9.
• If the gear icon is missing: switch to your Master account; the Flex Web Service settings may not show while a sub-account is selected.
• If another app also uses your Flex token: generating a new token cancels the old one, and this token is locked to Sovereign's IP, so it will not work from that app. Give the other app its own Flex token rather than sharing this one.
• If the card says the Flex Query sends CSV or Text: edit the “Sovereign” query and set “Format” to “XML”.

Sources

• www.ibkrguides.com/clientportal/performanceandstatements/activityflex.htm
• www.interactivebrokers.com/docs/web-api/flex-web-service/client-portal-configuration/enable-and-create-access-token
• www.ibkrguides.com/clientportal/performanceandstatements/flex-web-service.htm
• www.interactivebrokers.com/docs/web-api/flex-web-service/client-portal-configuration/create-a-flex-query