Coinbase API key permissions for a bot
Coinbase's own key guide says a secret with transfer permission can send the whole balance out. A bot key should not have transfer.
Permissions
The CDP guide API key authentication says API key access is off by default. When you create a key you set portfolio and permission restrictions. The guide does not print a full permission list on the steps we read. It does say that anyone with the api_secret and the transfer permission can send all the digital currency out of the account.
Withdrawals
That transfer warning is the reason to leave transfer off. A bot that reads the account, or that trades, does not need to send coins out.
IP allowlist
The same steps say to enter IPs in the IP allowlist, and they mark that recommended but not required. Add the server IP anyway. The guide also says the signature algorithm must be ECDSA for Coinbase App APIs, and that Ed25519 is not supported there.
Sub-accounts
The page talks about portfolio restrictions, not a named sub-account product. Use a portfolio that only holds what the bot may trade.
How to revoke
The page we opened explains how to create a key, not how to delete one. If a secret leaks, stop using it and remove it where you created it. Do not keep the secret in a repository. The guide says to store it in environment variables.
Worst case for your money, and the safe setup: Coinbase check.
Listing, with the safety facts we track: Coinbase Advanced.
Same rules, other exchanges: API key safety. Exchange directory: crypto exchanges for bots.
More in this set
Questions
Which Coinbase API permission lets a bot withdraw?
Transfer. Coinbase says a key with transfer can send all the digital currency out of the account. Do not give that to a bot.
Does Coinbase require an IP allowlist?
No. The guide says the IP allowlist is recommended but not required. Set it for a bot key anyway.