The IBKR login form requires localhost access — port-forward the CP Gateway to your machine, then open it in the browser:

Then open: https://localhost:5055

Accept the self-signed certificate warning. Log in with your IBKR paper credentials and approve the IBKR Push notification. The session is maintained automatically after login.

Gateway is also reachable via NLB at — useful for re-authentication after initial login, but the login form will not render there (IBKR SSO requires localhost).