IB has a "reverse firewall whitelist" feature. You go into account management and set it up, after which their server will accept only one IP address, the [static ip] that you give them. Then you put up a hardware firewall [I know, I know, you have to get all geeky and do the setup] which whitelists only the IP addresses that you need for accessing their servers and from then on, unless someone breaks into your office nobody can access your account, even if they have ALL your personal info and your password, etc.... you might set that up so that you could have remote access to your pc via a VPN or somesuch [I'm thinking out loud here] and have secure trading from anywhere........ no token needed really at that point, but you could use it anyhow for added security
That is a nice feature to have, but too bad I cannot take advantage of it. I use RR, and it has dynamic IP. It does change, but I don't know how often.