> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cdp.coinbase.com/llms.txt
> Use this file to discover all available pages before exploring further.

# public/auth

> Authenticate using a Coinbase-issued credential.

**Accepts both `GET` and `POST`.** Use `POST` as best practice — your credential then travels in the request body, keeping it out of URLs, browser history, and access logs.



## OpenAPI

````yaml /api-reference/coinbase-deribit-app-api/adv-starbase-openapi.json post /public/auth
openapi: 3.0.0
info:
  description: Coinbase Retail Advanced Trade API for derivatives trading.
  title: Coinbase Retail Advanced Trade (Deribit) API
  version: 2.1.1
servers:
  - url: https://drb.coinbase.com/api/v2
security: []
tags:
  - description: Can only be used over websockets.
    name: WebSocket Only
  - description: Public methods can be used without authentication.
    name: Public
  - description: >-
      <p>Private methods require authentication. All requests must include a
      valid OAuth2 token.</p>

      <p>A token can be requested using the <a
      href="#public-auth">/public/auth</a> method.</p>

      <p>When using the websockets protocol, the token must be included as a
      parameter <code>access_token</code> in the message. When using REST (HTTP
      GET), the token may also be passed in the <code>Authorization</code>
      header.</p>
    name: Private
  - name: Authentication
  - name: Session Management
  - description: >-
      Subscription works as [notifications](#notifications), so users will
      automatically (after subscribing) receive messages from the server.
      Overview for each channel response format is described in
      [subscriptions](#subscriptions) section.
    name: Subscription Management
  - name: Account Management
  - name: Trading
  - name: Market Data
paths:
  /public/auth:
    post:
      tags:
        - Authentication
        - Public
      description: >-
        Authenticate using a Coinbase-issued credential.


        **Accepts both `GET` and `POST`.** Use `POST` as best practice — your
        credential then travels in the request body, keeping it out of URLs,
        browser history, and access logs.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - grant_type
                - token
              properties:
                grant_type:
                  enum:
                    - coinbase_cdp
                    - coinbase_oauth2
                  example: coinbase_cdp
                  type: string
                  description: Coinbase grant type used to authenticate.
                token:
                  type: string
                  description: Coinbase-issued credential matching `grant_type`.
      responses:
        '200':
          $ref: '#/components/responses/PublicAuthResponse'
components:
  responses:
    PublicAuthResponse:
      content:
        application/json:
          examples:
            response:
              description: Response example
              value:
                id: 9929
                jsonrpc: '2.0'
                result:
                  access_token: >-
                    a3f8c2e1d4b7f09e5c6a2d8b1e4f7c0a9d3b6e2f5a8c1d4e7b0f3a6c9d2e5f8
                  expires_in: 3600
                  scope: >-
                    wallet:user:read wallet:accounts:read
                    wallet:transactions:read wallet:buys:create
                  token_type: bearer
          schema:
            $ref: '#/components/schemas/PublicAuthResponse'
      description: Success response
  schemas:
    PublicAuthResponse:
      properties:
        id:
          description: The id that was sent in the request
          type: integer
        jsonrpc:
          description: The JSON-RPC version (2.0)
          enum:
            - '2.0'
          type: string
        result:
          properties:
            access_token:
              description: >-
                Access token to be used for authentication of subsequent
                requests.
              type: string
            expires_in:
              description: Token lifetime in seconds
              type: integer
            scope:
              description: Space-separated list of granted scopes
              type: string
            token_type:
              description: Authorization type, always `bearer`
              enum:
                - bearer
              type: string
          required:
            - access_token
            - token_type
            - expires_in
            - scope
          type: object

````