Skip to main content
Scopes allow you to specify fine-grained access for your OAuth2 applications. Getting your scopes right is key to developing safe and trustworthy applications.

​
Overview

With OAuth2, scopes are set in the authorization URL and determine what API endpoints your application can access. All authenticated endpoints, except GET /user, require a specific scope. With OAuth2, scopes should be considered as grants—users can select which scopes they allow for your application. To see which scopes a user has granted, use the GET /user/auth endpoint.
Plan your scopes carefully before launch. Scopes are declared when you register your OAuth application and are difficult to change later. Adding new scopes after users have already authorized your app requires them to re-authorize, which can disrupt their user experience.
Only request scopes your application needs. Users more readily grant access to limited, clearly described scopes.

​
Naming pattern

Scopes follow the pattern service:resource:action. The main services are wallet and data.

​
Account access

In addition to scopes, Coinbase App applications can request different levels of access to user’s wallets. This access is defined by a dropdown selection on the consent page when the user connects to your app. Account access works together with scopes. For example, account=all combined with scope=wallet:buys:create allows your app to create buys on all of the user’s wallets, but won’t give access to sell on any of their accounts.

​
Specifying scopes

Scopes are specified by including a scope parameter in your OAuth2 authorization request. Multiple scopes should be separated with a comma:
If you need to obtain more permissions later, you can re-authenticate the user, prompting them to authorize additional scopes.

​
Supported scopes

Below are listed all the available scopes for both Coinbase App application and API keys. For more information to understand which permission is required for a specific API action/endpoint, follow our API reference which includes Permissions section under each endpoint.