How to create a read-only Coinbase API key

Open Coinbase Developer Platform ↗

We checked these steps against Coinbase's own documentation on 25 September 2026. Coinbase can rename a button at any time. If a label differs, look for the same permission.

Before you start

• Coinbase's old legacy API keys no longer work. If you still have one, create a new key with these steps.
• If your crypto is in a Coinbase Business account, sign in as the business.

Permissions

Turn on only:

• View (read-only)

Keep these off:

• Trade
• Transfer
• Receive

Steps

Sovereign connects to Coinbase from one fixed IP address. The connection form in Sovereign shows it next to these steps, with a copy button.

1. Sign in to the Coinbase Developer Platform with the Coinbase account that holds your crypto.
2. On the “Secret API Keys” tab, click “Create API key”.
3. In “API key nickname”, type a name you will recognise, such as Sovereign.
4. Expand “API restrictions” and paste Sovereign's IP address into “IP allowlist”, so the key works only from Sovereign.
5. In the portfolio menu, pick the portfolio Sovereign should track, usually your main one.
6. Keep “View (read-only)” ticked and leave “Trade”, “Transfer” and “Receive” unticked.
7. Leave “Advanced Settings” as it is — Sovereign reads both signature algorithms, ECDSA and Ed25519. Pick “ECDSA” if you want to choose.
8. Click “Create API key”, and enter a verification code if Coinbase asks for one.
9. Before closing the window, copy the key name (starts with organizations/) and the whole private key. Coinbase shows the private key only once.
10. Paste the key name into API KEY NAME and the private key into PRIVATE KEY in Sovereign, then press “Connect & Sync”.

Where each value goes in Sovereign:

• Key name (organizations/…/apiKeys/…) → API KEY NAME
• Private key → PRIVATE KEY. An EC key: the whole block, BEGIN and END lines included. An Ed25519 key: the single base64 line.

Does a Coinbase API key expire?

• With an IP restriction: No expiry date.
• Without an IP restriction: No expiry date — the IP restriction is for security only.

Each key covers one portfolio, so add a separate Coinbase connection for every portfolio you want tracked. Futures and perpetuals are not imported.

If something goes wrong

• If you closed the window without copying the private key: delete that key in Coinbase and create a new one.
• If the private key is an Ed25519 one (a single base64 line, no BEGIN/END): paste it as it is. It works.
• If Coinbase asks you to create or pick a project: keep the default one.
• If a working connection suddenly fails: check the key is still enabled in Coinbase's API key list.

Sources

• docs.cdp.coinbase.com/coinbase-app/authentication-authorization/api-key-authentication
• docs.cdp.coinbase.com/coinbase-app/advanced-trade-apis/guides/portfolios
• docs.cdp.coinbase.com/coinbase-app/authentication-authorization/legacy-keys
• docs.cdp.coinbase.com/get-started/authentication/security-best-practices