There is another option, and that's to use Open Authentication (OAuth) via the newish Client Portal Web API. It doesn't require 2FA, requires no GUI client and offers a true 'fully automated' solution.
The only negative, for me, is the order types are a bit limited compared to TWS API, no...