IB Gateway login fails: “Required PassKey is not supported, please upgrade to latest version” (IBSJ / Japan)

Technical Help
#1

Hello,

After the Interactive Brokers Securities Japan PassKey mandate (effective 1 July 2026), I can no longer log in to IB Gateway. The Gateway GUI shows:

Connection to server failed: Required PassKey is not supported, please upgrade to latest version

API Server status in the Gateway GUI is red / disconnected.

Environment

  • QuantRocket: 2.11.0
  • Image: quantrocket/ibg:2.11.0
  • IB Gateway inside the container: 10.33.1 (10331d)
  • IBC: qr3.12.4.0
  • Account: live, Interactive Brokers Securities Japan (IBSJ)
  • Host: DigitalOcean droplet (Linux x86_64)

What I see / have tried

  • quantrocket ibg start → Gateway process starts, but never reaches “running”
  • Status ends up as not accepting connections / error
  • Earlier I also saw the usual 2FA message (“Second factor authentication required… check your mobile device”), but no IB Key notification arrived
  • Opened IB Gateway GUI via NoVNC (/novnc/vnc.html?path=ibg1/proxy/vnc&autoconnect=true) and confirmed the PassKey upgrade dialog above
  • IBC is already configured with SecondFactorDevice=IB Key
  • Force-recreated ibg1 and restarted; same PassKey error persists

Docs check The Usage Guide’s Secure Login / 2FA section documents mobile authentication (IB Key) only. I did not find any mention of PassKey support in the docs or forum.

Questions

  1. Is PassKey supported (or planned) for QuantRocket’s ibg image?
  2. Is there a newer IB Gateway build available for 2.11.0 users affected by the IBSJ PassKey requirement?
  3. Is there any interim workaround (e.g. remaining on IB Key for Gateway/API while PassKey is used for Client Portal)?

Happy to provide IBC logs, Gateway screenshots, or flightlog excerpts if useful.

Thanks.

#2

The error message indicates that a newer version of IB Gateway is required, so let’s start there. Please edit your docker-compose.yml to change:

  ibg1:
    image: 'quantrocket/ibg:2.11.0'

to

  ibg1:
    image: 'quantrocket/ibg:2.11.1'

Then run docker --context cloud up -d ibg1 to pull and launch the updated image. This includes the latest version of IB Gateway, 10.50.1, which should resolve the immediate error.

Since the passkey requirement is currently limited to IBSJ, it’s difficult to fully test the passkey authentication flow, so additional issues may surface. Please let me know if you run into further problems.

Based on discussions of Japan’s regulatory requirements among IBKR customers, my expectation is that you’ll need to manually complete passkey authentication during the weekly Sunday restart, after which it should persist for the rest of the week.

#3

Thanks — we upgraded ibg1 to quantrocket/ibg:2.11.1 (Gateway 10.50.1). The original error (“Required PassKey is not supported, please upgrade”) is gone.

PassKey still cannot be completed in the IB Gateway GUI (NoVNC) on a headless Linux deployment.

Observed

  • NS_AUTH_START … soft=0 token(s)=[token=5, tokenSubtype=4[Passkey]]
  • IBC SecondFactorDevice=IB Key has no effect (no device dropdown; GUI is only “Use your Passkey device”)
  • PassKey dialog flashes (~1s) then fails:

Using JxBrowser passkey authenticator
Failed to create browser
UnsatisfiedLinkError: /tmp/JxBrowser/8.9.4/libtoolkit.so: libgdk-3.so.0: cannot open shared object file

  • Official ibg:2.11.1 does not include GTK. After installing libgtk-3-0 (plus Chromium deps) inside the container, the dialog stays open and loads https://www.interactivebrokers.com.au/auth/dtws/webauthn. That install does not survive container recreate.
  • After GTK, WebAuthn is USB-security-key only (no QR / phone / IB Key). Not usable on a headless host (Xvfb, no USB key, no Bluetooth).
  • We therefore cannot complete PassKey here, so we cannot test Sunday one-time re-auth then week-long persistence.

IBKR status (for awareness) We raised the headless PassKey behavior with Interactive Brokers (Secure Login). They confirmed it cannot be changed from the client side / chat / web ticket, directed us to phone support, and said they are also looking at a solution for this behavior on remote servers. We will follow that with IBKR.

Question for QuantRocket Can the ibg image include the GTK / JxBrowser shared libraries (libgdk-3.so.0 and related Chromium deps) so the PassKey UI does not crash on start? Even with that, IBKR currently offers no headless PassKey path, but the crash is on the image side.

Happy to send redacted launcher.log / IBC excerpts.

#4

Keep me posted on the discussion with IBKR. It is certainly possible to add the GTK dependencies so that they survive container re-creation, but I don't think it makes sense to add them unless there is a workable headless authentication path.