All integrations

Coinbase

BUSINESS · COMMERCE & FINANCE

Wallets, balances, and transaction history in the Coinbase account they connected.

Connecting Coinbase in practice

10,000 requests per hour per API key or per OAuth-authorised user is generous; the friction is elsewhere. Scopes are declared when the app is registered and Coinbase warns they are "difficult to change later" because adding one forces every existing user to re-authorize, and sending above a user’s 2FA limit fails with a 400 two_factor_required that retrying never clears.

Scopes that draw scrutiny

  • wallet:transactions:send "Send bitcoin or ethereum" — the scope that moves other people’s money out of the account, and the one that runs into the two_factor_required limit.
  • wallet:withdrawals:create "Create a new withdrawal", so it reaches fiat rails rather than only on-chain balances.
  • wallet:payment-methods:delete "Remove existing payment methods" — destructive against the user’s linked bank accounts, and not implied by reading them.
  • wallet:user:email Reads the current user’s email address as a scope of its own, separate from wallet:user:read, which is the join key most integrations want and most reviewers ask about.
  • offline_access The only way to get a refresh token, which turns a session into standing access that lasts 1.5 years.

Rate limits

  • 10,000 requests per hour per API key, or per OAuth-authenticated Coinbase user.
  • For OAuth apps the allowance scales with the number of unique users who have granted access, each allotted 10,000 per hour.
  • Exceeding it returns 429 with {"id":"rate_limit_exceeded","message":"Too many requests"}; there is also a separate resource_exhausted 429.
  • Pagination is cursor based: limit accepts 0–100 with a default of 25, ordered desc unless order=asc.

Worth knowing

  • The consent screen carries an account-access dropdown alongside the scopes, and the two multiply: account=all with wallet:buys:create can buy on every wallet the user has, while the same scope with a single account cannot. The app does not choose which.
  • Refresh tokens expire after 1.5 years, so a long-lived integration has a hard re-consent date rather than an indefinite grant.
  • Legacy API keys stopped working on 5 February 2025; CDP API keys are now required, so older integrations fail at authentication rather than at authorization.
  • The pagination limit is advisory: "the response list might in some cases return less objects than specified by the limit parameter" because of permissions and access-level control, so a short page does not mean the walk is finished.
  • Outbound notifications ceased on 17 February 2025 and Coinbase says to poll the Transactions API instead, which turns an event-driven design into a polling one.

Checked against Coinbase App rate limiting (2026-09-29), Coinbase App OAuth2 scopes (2026-09-29), Coinbase App error messages (2026-09-29), Coinbase App pagination (2026-09-29)

Acts as the person, not as itself

Each user connects their own account. Every call carries both identities — the agent and the person it is acting for — so the agent can never reach past what that individual can already do.

Credentials never touch the agent

Tokens live in the vault and attach server-side at call time. The agent holds a session, not a secret, and revoking access does not mean rotating a key.

Every call on the record

Who asked, which agent acted, which action ran, and the verdict that let it through — one audit trail across every integration, not one per vendor.

What an agent can do

Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.

coinbase_get_v2_accountsREAD

List every wallet on the connected Coinbase account -- fiat and crypto -- with each one's id, name, currency and balance. The id returned here is the `account_id` every other tool in this integration takes. Coinbase GET https://api.coinbase.com/v2/accounts.

wallet:accounts:read
coinbase_get_v2_accounts_by_account_idREAD

Read one wallet of the connected Coinbase account by its id, including its balance and currency. Coinbase GET https://api.coinbase.com/v2/accounts/{account_id}.

wallet:accounts:read
coinbase_get_v2_accounts_by_account_id_addressesREAD

List the crypto receive addresses that already exist on one wallet, with the network each belongs to. Reads only -- minting a new address is a separate operation and is not offered here. Coinbase GET https://api.coinbase.com/v2/accounts/{account_id}/addresses.

wallet:addresses:read
coinbase_get_v2_accounts_by_account_id_depositsREAD

List deposits into one fiat wallet from a linked bank account or payment method, with their status and amounts. Coinbase GET https://api.coinbase.com/v2/accounts/{account_id}/deposits. NOT REACHABLE WITH A PASTED CDP API KEY: measured 2026-09-16, this endpoint answers 401 "User is not authenticated" to a valid CDP Secret API key while the same key reads wallets and transactions normally. It needs a user-authorized OAuth grant, and Coinbase OAuth is not available to Agentic Fabriq yet.

wallet:deposits:read
coinbase_get_v2_accounts_by_account_id_deposits_by_deposit_idREAD

Read one deposit into a fiat wallet by its id, with its status, amount, fee and payment method. Coinbase GET https://api.coinbase.com/v2/accounts/{account_id}/deposits/{deposit_id}. Measured 2026-09-16: an id that does not exist answers 200 with an EMPTY record rather than 404, so a caller must check the returned id instead of relying on the status code.

wallet:deposits:read
coinbase_get_v2_accounts_by_account_id_transactionsREAD

List the transactions on one wallet -- sends, receives, buys, sells, transfers and their counterparties and amounts, newest first by default. Coinbase GET https://api.coinbase.com/v2/accounts/{account_id}/transactions.

wallet:transactions:read
coinbase_get_v2_accounts_by_account_id_transactions_by_transaction_idREAD

Read one transaction on one wallet by its id, with its status, amount, native amount and counterparty. Coinbase GET https://api.coinbase.com/v2/accounts/{account_id}/transactions/{transaction_id}.

wallet:transactions:read
coinbase_get_v2_accounts_by_account_id_withdrawalsREAD

List withdrawals out of one fiat wallet to a linked bank account or payment method, with their status and amounts. Coinbase GET https://api.coinbase.com/v2/accounts/{account_id}/withdrawals. NOT REACHABLE WITH A PASTED CDP API KEY: measured 2026-09-16, this endpoint answers 401 "User is not authenticated" to a valid CDP Secret API key while the same key reads wallets and transactions normally. It needs a user-authorized OAuth grant, and Coinbase OAuth is not available to Agentic Fabriq yet.

wallet:withdrawals:read
coinbase_get_v2_accounts_by_account_id_withdrawals_by_withdrawal_idREAD

Read one withdrawal from a fiat wallet by its id, with its status, amount, fee and payment method. Coinbase GET https://api.coinbase.com/v2/accounts/{account_id}/withdrawals/{withdrawal_id}. Measured 2026-09-16: an id that does not exist answers 200 with an EMPTY record rather than 404, so a caller must check the returned id instead of relying on the status code.

wallet:withdrawals:read
coinbase_get_v2_subscriptions_coinbase_oneREAD

Read whether the connected Coinbase account holds an active Coinbase One subscription, and what it covers. Coinbase GET https://api.coinbase.com/v2/subscriptions/coinbase-one. MAY NOT BE REACHABLE WITH A PASTED CDP API KEY: measured 2026-09-16, this endpoint answers a bare 401 to a valid CDP Secret API key, to a bogus one and to no credential at all -- identical responses, so whether the route refuses this credential kind or is not mounted for it cannot be told apart from outside. It is documented as part of the OAuth surface, and Coinbase OAuth is not available to Agentic Fabriq yet.

wallet:subscription:read
coinbase_get_v2_userREAD

Read the public profile of the Coinbase account this connection authenticates as: id, display name, avatar, country, time zone, preferred fiat currency and Bitcoin unit. Reads nothing about balances or transactions. This is also the endpoint Agentic Fabriq checks a pasted API key against. Coinbase GET https://api.coinbase.com/v2/user.

wallet:user:read
coinbase_get_v2_user_personal_detailsREAD

Read the personal details Coinbase holds for the connected account -- the identity fields behind the public profile. Coinbase GET https://api.coinbase.com/v2/user/personal-details. MAY NOT BE REACHABLE WITH A PASTED CDP API KEY: measured 2026-09-16, this endpoint answers a bare 401 to a valid CDP Secret API key, to a bogus one and to no credential at all -- identical responses, so whether the route refuses this credential kind or is not mounted for it cannot be told apart from outside. It is documented as part of the OAuth surface, and Coinbase OAuth is not available to Agentic Fabriq yet.

wallet:accounts:read

Put Coinbase behind one governed endpoint.

Same permissions, same audit trail, whatever else you connect next.