Skip to main content
Portfolio isolation is an opt-in account setting that locks every API key to the portfolio it was created in. Once enabled, a key can’t read or act on other portfolios unless it has cross portfolio access. Use it when different clients, desks, or teams each have their own portfolio and one party’s key must never see another’s balances, orders, transfers, or reports. For example, a broker can give each downstream client its own portfolio and key.

​
Terminology

Some API responses call a key with cross portfolio access a Managed key. The Exchange web interface always uses Cross Portfolio Access. They mean the same thing.

​
How it works

​
Isolation off (default)

Order entry, FIX, and WebSocket already limit each key to its own portfolio. Some REST endpoints don’t. They accept a profile_id parameter or return account-wide results, so any key can read other portfolios’ data:

​
Isolation on

  • Portfolio-scoped keys see only their own portfolio on every REST endpoint. Requests for another profile_id return 403 Forbidden. Get profiles returns one portfolio.
  • Keys with cross portfolio access keep the account-wide behavior above.
  • Order entry, FIX, and WebSocket don’t change.
  • Web sign-in doesn’t change. Isolation applies to API keys only.
Enabling isolation takes effect immediately. Every existing key you don’t select in the enablement dialog becomes portfolio-scoped, and integrations that use those keys for account-wide reads get 403.

​
Example

An account has three portfolios: Default, Client A, and Client B. Each client has its own key. The operations team has a key in Default with cross portfolio access.

​
Enable or disable portfolio isolation

  1. Sign in to Coinbase Exchange.
  2. Open your profile menu and select Settings.
  3. Select Security.
  4. Turn on Portfolio isolation.
  5. In the Enable portfolio isolation? dialog, under Keep Cross Portfolio Access, select the keys that need it. Search by name, key, or portfolio, or click Select all. Click Clear to deselect every key.
  6. Click Continue and confirm with 2-step verification.
Keys you don’t select become portfolio-scoped immediately. The enablement dialog is the only time you can add cross portfolio access to an existing key. After isolation is on, you can only set it when you create a new key. To turn isolation off, return to Settings > Security and switch it off. Portfolio-scoped keys regain account-wide access on the endpoints above.
Suggested rollout: list the integrations that use the account-wide endpoints above, then enable isolation and select their keys under Keep Cross Portfolio Access. Keys you leave unselected become portfolio-scoped.

​
Create a key with cross portfolio access

While isolation is on, you can set cross portfolio access when you create a key. New keys are portfolio-scoped unless you select it. To set it on an existing key, use the enablement dialog described in Enable or disable portfolio isolation.
  1. Sign in to Coinbase Exchange.
  2. Select API in the left navigation.
  3. Click New API Key.
  4. Under Permissions, select Cross Portfolio Access along with any View, Trade, Transfer, or Manage permissions the key needs.
  5. Create the key and save the key, secret, and passphrase.
Keys with cross portfolio access show Cross Portfolio Access under Permissions in My API Keys. Outside the enablement dialog, you can’t change this setting on an existing key. To remove it, delete the key and create a portfolio-scoped one.
Cross portfolio access controls which portfolios a key can see. View, Transfer, Trade, and Manage control what it can do. A key with cross portfolio access and View only can list every portfolio’s orders but can’t place or cancel them. See API Key Permissions.

​
Recommendations

  • Give each client, desk, or strategy its own portfolio and a portfolio-scoped key.
  • Grant cross portfolio access only to operations, treasury, or reporting keys.
  • Review keys with cross portfolio access regularly and delete ones no longer needed.
  • Delete a client’s or team member’s keys when they leave.