How to create a Coinbase API key and keep it safe
To create a Coinbase API key, sign in to the Coinbase Developer Platform (CDP), open Secret API Keys and click Create API key. Name it, set the portfolio and permission limits, add an IP allowlist and switch the signature algorithm to ECDSA.
Then save the private key somewhere outside your code. Give the key only the permissions your script needs, and never the Transfer permission unless moving funds is the whole point.
The facts below come from Coinbase’s own developer documentation. Coinbase is explicit that API key authentication is for accessing your own account only. Apps that act for other users are supposed to use OAuth2 instead.
Step by step: creating the key in the CDP portal
Coinbase App keys are created through the CDP portal. The sequence Coinbase documents is:
- Open the Coinbase Developer Platform and choose Secret API Keys under the API Keys tab.
- Click Create API key and give it a nickname you will recognise later, such as “tax-export-readonly”.
- Expand API restrictions and Advanced Settings.
- Enter your IP addresses in the IP allowlist. Coinbase marks this as recommended but not required.
- Set the portfolio and the permissions.
- Change the signature algorithm to ECDSA. Coinbase says Ed25519 keys are not supported by the Coinbase App SDKs and authentication may fail.
- Click Create API key and store the key pair safely.
One detail catches people out. Coinbase no longer downloads the key file automatically, so copy the key name and private key from the modal before you close it. Coinbase recommends loading them as environment variables rather than keeping a file next to your code.
Video: SmartMoneyTutorials
View, Trade or Transfer: which permission to give a key
Coinbase’s key permissions endpoint reports three flags for every key: can_view, can_trade and can_transfer. Each one widens what a stolen key could do.
| Permission | What the key can do | Typical use | If the key leaks |
|---|---|---|---|
| View | Read balances, orders and account data | Portfolio trackers, tax exports | Your holdings are exposed, funds stay put |
| Trade | Place orders | Trading bots on Advanced Trade | Someone can trade your balance badly |
| Transfer | Send crypto out of the account | Automated withdrawals only | Coinbase warns all digital currency can be sent out |
Source: Coinbase Developer Documentation, API key authentication and Get API Key Permissions pages, checked 22 October 2026.
Most people need View only. A bot needs View plus Trade. Coinbase also scopes each key to a single portfolio, so a bot can run in its own portfolio while your long-term holdings sit in another one the key is not scoped to.
Locking the key down after you create it
Coinbase’s security best practices page starts with storage. Never embed keys in code, and keep key files outside your project folder so they never get committed to GitHub.
A secrets manager such as AWS Secrets Manager or HashiCorp Vault is one option Coinbase suggests.
The IP allowlist accepts IPv4 and IPv6 addresses and CIDR ranges. You can add one later under Manage, then Edit Key, then API restrictions. If your home IP changes often, run the script from a server with a fixed address instead of skipping the allowlist.
The JWT your code signs with the key expires after two minutes, and Coinbase requires a fresh one for each request. That limits replay attacks, but it does nothing if the private key itself is out.
What to do if a Coinbase API key leaks
Treat any key pasted into a chat or a public repo as compromised.
Coinbase’s guidance is to delete unused keys and rotate by creating a new key and deleting the old one, because CDP uses asymmetric cryptography, so rotation means a new key rather than editing the old one.
Delete the leaked key in the CDP portal first, then create a replacement with tighter permissions.
Check recent orders and transfers in your account. For a related risk, read the Coinbase text scam warning signs.
If you are still choosing an exchange for automated trading, our Bitpanda vs Coinbase comparison for EU users covers fees and availability. For how Coinbase earns revenue, see how Coinbase makes money.
Coinbase API key questions
Should I pick Ed25519 or ECDSA?
It depends on the API. Coinbase recommends Ed25519 for new CDP keys in general, but its Coinbase App docs require ECDSA. For Coinbase App access, pick ECDSA.
Why does my Coinbase API key fail to authenticate?
One cause Coinbase documents is the key type. Coinbase App SDKs need ECDSA keys, and an Ed25519 key may fail. An expired JWT or a missing IP on the allowlist also blocks requests.
Can I use one API key for several portfolios?
Coinbase says each new CDP key is scoped to one portfolio, so create a dedicated key for each portfolio you automate.
