INTX Retail API Partners — Migration Guide

​

Summary

​

What changes

​

Endpoints and URLs

​

Authentication

​

API Keys - Private Access Sequence

• HTTP
• WebSocket

• You create a JWT, no round-trip to Coinbase. See creating a JWT.
• It lasts only ~120s, use a fresh JWT for every public/auth call.
• You need to provide the Deribit access token on each private method call.
• Refresh the Deribit access token every 15 minutes.

• You create a JWT, no round-trip to Coinbase. See creating a JWT.
• It lasts only ~120s, use a fresh JWT for every public/auth call.
• When you call public/auth that authorizes the websocket session, no return token is needed to access private methods.
• Refresh the websockets authentication before it expires (~50 minutes).

​

OAuth2 - Private Access Sequence

• HTTP
• WebSocket

• Retrieve an OAuth2 access token from POST login.coinbase.com/oauth2/token.
• It expires in 60 mins, use an unexpired OAuth2 access token with every public/auth call.
• You need to provide the Deribit access token on each private method call.

For OAuth there are 2 separate refresh cycles:

• Refresh the Deribit access token every 15 minutes.
• Refresh the OAuth2 access token every 1 hour. POST login.coinbase.com/oauth2/token with grant_type=refresh_token and your refresh token; you get back a new access and refresh token.

• Retrieve an OAuth2 access token from POST login.coinbase.com/oauth2/token.
• It expires in 60 mins, use an unexpired OAuth2 access token with every public/auth call.
• When you call public/auth that authorizes the websocket session, no return token is needed to access private methods.

For OAuth there are 2 separate refresh cycles:

• Refresh the websockets authentication before it expires (~50 minutes).
• Refresh the OAuth2 access token every 1 hour. POST login.coinbase.com/oauth2/token with grant_type=refresh_token and your refresh token; you get back a new access and refresh token.

​

Notes

• On WebSocket, the connection is the credential. public/auth returns no token — private method calls are authorized by the authenticated socket itself. Re-send public/auth on the same socket to extend. If the socket drops, you’ll need to re-authenticate from scratch.
• Request offline_access to get a refresh token (OAuth2). Coinbase only issues a refresh token if the offline_access scope was in your authorize request. Without it, the 1-hour access token cannot be refreshed and the user must re-authorize. See OAuth2 scopes and access & refresh tokens.
• CDP keys can use Ed25519 or ECDSA algorithms. Ed25519 is recommended and works with direct API calls. ECDSA keys are only required for legacy / third party SDKs.
• Send public/auth as a POST so credentials stay out of the URL. Deribit accepts public/auth over both GET and POST; use POST so the CDP JWT or OAuth2 access token travels in the request body, not the query string — keeping it out of URLs, browser history, and access logs. See OAuth2 security best practices.

​

Migration Checklist

​

Help

• Further assistance and timing — your Coinbase account manager.
• Method-level API detail — the Advanced Trade API reference.
• Best practices and detailed guides — Deribit’s documentation.