Skip to main content
App2App turns your buy button into a deep link straight into the Coinbase app. The user taps buy in your app, lands in Coinbase already signed in, confirms the purchase, and gets sent right back to you. Coinbase sends the crypto directly to the wallet address you specify, so there’s no separate send step for the user to complete.
Why partners use App2App over a hosted checkout:
  • No messy logins in your app. The user authenticates with Coinbase, not with your UI: no password fields, no OAuth redirects to build or maintain.
  • Higher conversion. Users who already have Coinbase skip account creation and payment entry entirely; they land on a purchase they can confirm in a couple of taps.
  • A cleaner handoff. Your app never touches a webview or an embedded checkout; it’s a native deep link out and a native deep link back.
Requires the Coinbase app. App2App only works for users who have the Coinbase app installed, since that’s what makes the deep-link handoff possible. If they don’t have a Coinbase account yet, they can create one inline once they land in the app. Detecting whether the installed app supports App2App is covered in setup.
Available for iOS today. Android support isn’t available yet. If you need to support Android, use Coinbase-hosted Onramp instead.

​
How App2App differs from other integration options

Coinbase-hosted Onramp

Redirect users to a Coinbase-hosted page. Your backend authenticates with a CDP API key to create the session.

Headless Onramp

Embed an Apple Pay or Google Pay button directly in your app. Your backend authenticates with a CDP API key to create the order.
App2App is a third path, built specifically for mobile apps that want the purchase to happen in the Coinbase app itself rather than in a webview or an embedded button: your app authenticates using on-device attestation instead of a CDP API key, and the user is deep-linked into the Coinbase app to finish the purchase.

​
Payment methods and geographic availability

App2App doesn’t maintain its own list of supported payment methods, countries, or limits. Whatever the signed-in user’s Coinbase account already supports (card, bank transfer, Apple Pay, their country, their limits) is exactly what’s available to them through App2App. There’s nothing extra to configure and nothing narrower to work around: if Coinbase supports it for that user, App2App supports it too.

Check availability by region

Look up supported assets, networks, and payment methods for any region with the Onramp Asset Availability tool.

​
How it works

  1. Your app registers an attestation key the first time it’s installed.
  2. For each purchase, your app requests a challenge, then creates a session by proving the request came from your genuine app.
  3. Your app opens the returned URL, which hands the user off to the Coinbase app to complete the purchase.
  4. The Coinbase app sends the crypto to the destination you specified, then redirects the user back to your app.
  5. Coinbase confirms settlement by sending your backend a webhook, which is the signal to trust, not the redirect.
See the setup guide for the full step-by-step.

​
Why App2App uses device attestation

App2App doesn’t require a CDP API key on the purchase path. Instead, your app proves its identity using your platform’s built-in attestation: Apple App Attest on iOS. This proves to Coinbase that the request came from your real, unmodified app running on a real device, not from a script or a copy of your app pretending to be you. You register an attestation key once per install, then re-prove your identity with a fresh signature for every purchase. This happens automatically as part of the steps in setup; you don’t need to build any attestation logic yourself beyond calling Apple’s DeviceCheck APIs as shown.

​
Get access

App2App is available to approved apps. To get your app enabled:

Apply for Onramp Access

Contact the Coinbase team to get your app allowlisted for App2App and to register your iOS App Attest identifier.
  • Setup: Register your app, create sessions, and confirm settlement
  • FAQ: Common questions from partners integrating App2App
  • Security Requirements: Domain allowlist requirements for your redirect URL
  • Sandbox Testing: Test your integration without moving real funds