Skip to main content
This page explains how to sign and authenticate Coinbase Derivatives: Predictions REST API requests.

​
Signing requests

Every endpoint except GET /api/ping requires these four headers:
  • CB-ACCESS-KEY: The API key.
  • CB-ACCESS-PASSPHRASE: The passphrase for the API key.
  • CB-ACCESS-SIGN: The Base64-encoded signature.
  • CB-ACCESS-TIMESTAMP: The request timestamp.
A request with a missing or invalid header returns 401 UNAUTHORIZED.

​
Selecting a timestamp

CB-ACCESS-TIMESTAMP is the number of seconds since the Unix epoch in UTC. It must be within 5 seconds of the API service time. A timestamp outside that window, or one that is not a number, returns 400 BAD_REQUEST.

​
Creating a signature

CB-ACCESS-SIGN is an HMAC-SHA256 of the prehash string timestamp + method + requestPath + body (where + is string concatenation), Base64-encoded.
  • timestamp is the exact CB-ACCESS-TIMESTAMP header value.
  • method is the HTTP method in upper case, for example GET or POST.
  • requestPath is the path of the endpoint, including the /api or /api/v1 prefix. Do not include the host or the query string: query parameters are not signed.
  • body is the request body exactly as sent, or an empty string when there is no body (for example, on GET).
The HMAC key is your API secret after Base64-decoding it. Base64-encode the resulting digest with standard Base64 and padding, and send that as CB-ACCESS-SIGN.
This differs from the Coinbase Derivatives: Futures REST API, which uses the secret as is. Signing with the undecoded secret, or sending a hex-encoded digest, returns 401 UNAUTHORIZED.

​
Authorization

After the signature is verified, the API key’s user must be active, and the key’s Firm or FCM must be active. Each route then requires a permission or a credential level: A key that lacks the required permission or credential level gets 403 FORBIDDEN.