Skip to main content

​
API Scopes and Permissions

Coinbase App APIs employ two distinct permission schemes to ensure granular access to user data and functionality. The scheme in use depends on the authentication method you choose for your application.

​
API Keys: Simple permissions

API keys offer a straightforward permission model. When a user generates an API key, they can select from the following basic permissions:
  • View: Allows your application to read user data such as account balances, transaction history, and profile information.
  • Trade: Grants permission to execute buy and sell orders on the user’s behalf.
  • Transfer: Enables your application to send and receive funds, on and off platform.
  • Receive: Allows your application to create new addresses to receive inbound payments.

​
OAuth: Granular scopes

OAuth employs a more detailed scoping system, see detailed list. With OAuth2, scopes should be considered as grants. Users can select which scopes they grant access to for the application. The application might need to request new scopes over the lifecycle of the authorization. In general, only ask for the scopes that your application needs, and avoid asking for access to unnecessary ones.