CDP API Keys

Use API keys to authenticate requests to the suite of APIs offered on CDP.

​

Key Types

​

Secret API Keys

​

Creating Secret API Keys

1. Navigate to the Coinbase Developer Platform and select Secret API Keys under the API Keys tab
2. Click the Create API key button.
3. Enter an API key nickname and click Create & Download.
4. Secure your private/public key pair in a safe location. See our Security Best Practices for secure storage recommendations.

​

IP Allowlist (Optional)

For IP allowlist configuration and examples, see our Security Best Practices guide.

​

Client API Key

​

Rotating the Client API Key

1. Navigate to the Coinbase Developer Platform and select Client API Key under the API Keys tab
2. Click the Rotate button.
3. Select an expiration time for your previous key. This is to ensure you can replace your previous key without any downtime.
4. Click confirm and replace all references to your previous key, including in your RPC endpoint.

​

Domain Allowlist

For domain allowlist configuration and important considerations, see our Security Best Practices guide.

​

OAuth Clients

​

Creating OAuth Clients

1. Navigate to the Coinbase Developer Platform and select OAuth under the API Keys tab
2. Click the Create client button
3. Enter your application details:
   • Application name (shown during OAuth)
   • Application type
   • Service offerings
   • Redirect URIs
4. Configure any advanced options if needed
5. Store your client ID and client secret securely. See our Security Best Practices guide.

​

Authorization Flow

// Authorization Request
const authUrl = `https://login.coinbase.com/oauth2/auth?
  response_type=code
  &client_id=${YOUR_CLIENT_ID}
  &redirect_uri=${YOUR_REDIRECT_URL}
  &state=${SECURE_RANDOM}
  &scope=wallet:accounts:read`;

​

Exchange Code for Tokens:

// Token Exchange
POST https://login.coinbase.com/oauth2/token
{
  "grant_type": "authorization_code",
  "code": "TEMPORARY_CODE",
  "client_id": "YOUR_CLIENT_ID",
  "client_secret": "YOUR_CLIENT_SECRET",
  "redirect_uri": "YOUR_REDIRECT_URI"
}

​

Token Management

• Access tokens expire after 1 hour
• Refresh tokens can only be used once
• Use refresh tokens to obtain new access tokens when needed

​

Available Scopes

The following scopes control what your application can access:

• wallet:accounts:read: View account balances
• wallet:user:read: Access user information
• wallet:transactions:read: View transaction history
• wallet:transactions:send: Send cryptocurrency (requires 2FA)
• offline_access: Get refresh tokens

​

Deleting Keys

To delete any type of API key:

1. Click API keys on the left side navigation bar.
2. Navigate to the API key you’d like to edit and click Manage.
3. Click Delete Key.
4. Copy and paste the ID associated with the key and click Delete Key to confirm.

​

Ed25519 Signature Algorithm

From February 2025 onwards, new CDP API keys will default to using the Ed25519 signature algorithm for enhanced security and performance. Existing API keys signed with ECDSA will continue to function without interruption, but you will need to update your SDK library to support the new key type.

​

Secret Format Comparison

​

🔑 [Previously] ECDSA - PEM Format

-----BEGIN EC PRIVATE KEY-----
MHcCAQEEIGzF05P0YzdmqnlP7ZTExK3tTldWkRbJXp8B/5G+zBKoAoGCCqGSM49
AwEHoUQDQgAEXFh8azfrBkMqBVAiLbLbbZYwK9L/9WNBOfcDYgM1GoyWy3qA5Yc
94yD0gKnKTTOY5z5Y6m8sghG2SnUTPA9Lg==
-----END EC PRIVATE KEY-----

​

🔐 [Now] Ed25519 - Base64 Format

88WPC/9+fV8a7/PGLh+MOL26PBni9KEqP/u3Tl0tWCw=

​

Benefits

• Faster Verification: Ed25519 offers better performance, especially in high-load environments.
• Stronger Security: Provides resistance against common cryptographic attacks.
• Simpler Key Management: Smaller keys and deterministic signatures improve usability.

​

ECSDA vs. Ed25519

​

What is ECDSA?

ECDSA (Elliptic Curve Digital Signature Algorithm) is a widely used asymmetric cryptographic algorithm based on elliptic curve cryptography (ECC). It’s commonly used in secure communications, blockchain, and digital signatures.

​

What is Ed25519?

Ed25519 is a modern public-key signature algorithm based on the Edwards-curve Digital Signature Algorithm (EdDSA), specifically using the Curve25519 elliptic curve. It is designed to be fast, simple, and resistant to common cryptographic vulnerabilities.

​

ECDSA vs. Ed25519 Key Differences