Skip to main content

Environments

Coinbase Derivatives: Predictions operates the following environments:
  • Production
  • Disaster Recovery (DR)
  • Sandbox
Production and Disaster Recovery are co-located with Coinbase Derivatives: Futures in Equinix CH4 (Chicago) and Equinix NY5 (Secaucus) and are reachable over the internet or cross connect. Addresses, host names, and ports are coming soon. The Sandbox is hosted in AWS us-east-1 across two availability zones and is reachable over the internet only. Sandbox data is test data only.

Connectivity Protocols

FIX sessions use BeginString (8) = FIXT.1.1 and DefaultApplVerID (1137) = 9 (FIX50SP2). SBE order entry and UDP multicast market data are not offered for Coinbase Derivatives: Predictions.

Points of Presence

Connectivity via Internet

Clients connect to the Sandbox over the internet. Only TLS-encrypted connections are accepted. See IP Addressing for target host names.

SSL/TLS Details

The FIX gateways (fix-order, fix-marketdata, fix-drop-copy) accept TLS 1.2 only. Allowlist the two public IP addresses listed under Sandbox.
  • Preferred: TLSv1.2 128 bits ECDHE-RSA-AES128-GCM-SHA256 Curve P-256 DHE 256
  • Accepted: TLSv1.2 128 bits ECDHE-RSA-AES128-SHA256 Curve P-256 DHE 256
  • Accepted: TLSv1.2 256 bits ECDHE-RSA-AES256-GCM-SHA384 Curve P-256 DHE 256
  • Accepted: TLSv1.2 256 bits ECDHE-RSA-AES256-SHA384 Curve P-256 DHE 256
  • Accepted: TLSv1.2 128 bits AES128-GCM-SHA256
  • Accepted: TLSv1.2 128 bits AES128-SHA256
  • Accepted: TLSv1.2 256 bits AES256-GCM-SHA384
  • Accepted: TLSv1.2 256 bits AES256-SHA256
The REST and WebSocket host (cpm-sandbox.coinbase.com) is served through a CDN. TLS 1.2 and TLS 1.3 are accepted at the CDN edge; cipher suites are negotiated by the CDN and differ from the list above.

IP Addressing

Production

Unicast (TCP)

Disaster Recovery

Unicast (TCP)

Production and Disaster Recovery addresses, host names, and ports are coming soon.

Sandbox

Unicast (TCP)

All three FIX host names resolve to a single sandbox gateway load balancer. The load balancer has one static public IP address in each availability zone (us-east-1a and us-east-1b); DNS returns both, so allowlist both. These are not A/B feeds — either address reaches every gateway.

HTTPS

The REST gateway and WebSocket market data feed are served over HTTPS on port 443 from a single host: