The Coinbase API Key Is Not Inside Your Coinbase Account

People spend twenty minutes hunting through Coinbase settings for an API section that used to be there and is not there now. The search is not the problem. The map is.

Coinbase retired its old account-level API keys and moved issuance to the Coinbase Developer Platform, a separate portal you sign into with the same Coinbase login. Legacy keys stopped authenticating in early 2025. If a tracker connection to Coinbase died on you and never came back, that is almost certainly what happened, and no amount of reconnecting with the old credential will fix it.

Which Coinbase am I actually connecting?

Coinbase is four products wearing one logo, and the answer changes depending on which you use.

The Coinbase app is the retail product most people mean. Balances there are reachable with a Coinbase Developer Platform key scoped to read your account.

Coinbase Advanced is the pro trading interface sitting on the same account. It shares the underlying balances and the same key issuance flow, and it supports multiple portfolios within one login.

Coinbase Exchange is the institutional venue. Different system, different key format entirely. Keys there are created from the API link at the bottom of the Exchange sidebar, carry a passphrase you invent at creation, require an IP whitelist as a mandatory field, and use permission names of their own: View, Trade, Transfer and Manage. A tracker needs View and nothing else. Note that an Exchange key binds to one portfolio, so a second portfolio means a second key.

Coinbase Wallet is not on this list, and that is the important part. It is self-custody software holding a seed phrase on your device. There is no account behind it, no server to ask, and no key to issue. You track it the way you track any other wallet: by adding the public address. Tracking an Ethereum wallet covers the address side, and if any app or person asks for the twelve words instead, that is an attack, which never share your seed phrase says in fewer words than this sentence.

Why does the key come from a developer portal?

Because Coinbase consolidated retail, Advanced and its onchain developer tooling behind one credential system. The practical effect for a portfolio tracker user is a flow that feels heavier than it is.

You go to the API Keys section of the developer portal, create a secret API key, and set its permissions before generating. Coinbase asks for a name, an optional IP allowlist, and the permission scope. Grant read access to your account. Leave anything that trades or transfers untouched.

Coinbase then hands you two things: a key identifier and a private key in PEM form, the block that opens with a BEGIN EC PRIVATE KEY line. Coinbase App integrations use ECDSA rather than Ed25519, so if a tracker's field validation rejects what you pasted, the key format is the first thing to check. Coinbase stopped auto-downloading key files, which means the private key is on your screen exactly once and then gone. Paste it into the tracker, then put a copy in a password manager. A downloads folder is not a password manager.

What you have created is a credential that can answer one class of question: what does this account hold, and what has it done. It cannot open an order and it cannot send a coin to an address, because Coinbase evaluates the granted scope on every signed request and refuses anything outside it. That enforcement happens at Coinbase, not in the app you gave the key to, which is the whole reason the arrangement is defensible. Read-only API keys works through why the location of the check matters more than any promise a tracker makes.

What will not import from Coinbase?

Start with the obvious gap and work outward.

Coinbase Wallet balances, as covered, are invisible to an exchange key. So is anything you have already moved to a hardware wallet, which needs its own watched address; tracking a hardware wallet explains how to do that without exposing anything you shouldn't.

Staked ETH is the subtle one. Coinbase reports it as a distinct balance rather than as ordinary ETH, so a tracker will typically see the quantity but may or may not fold it into your ETH line. Check the holdings list rather than the total. If it lands as a separate asset, that is fine, as long as you are not also counting it manually somewhere. Tracking staked assets covers how the various receipt and staked balances behave.

Coinbase One subscription benefits, USDC reward accrual and learning rewards are account features rather than positions, and there is nothing meaningful for a balance query to return. Deposits sitting in a linked bank account are not crypto and will not appear.

Then there is history. If you bought on Coinbase years ago, moved the coins to cold storage, and are now connecting a tracker, the tracker sees a current balance of roughly nothing on Coinbase and a wallet with coins that arrived from an unknown source at an unknown price. The quantity will be right and the profit figure will be nonsense, because the acquisition price never travelled with the coins. Cost basis vs market value explains how to repair that, and it is worth doing before you look at a percentage gain and believe it.

How do I keep the connection healthy?

Rotate on a schedule rather than in a panic. Twice a year is reasonable for a key you use daily. Delete the old one in the portal first, generate a fresh one, reconnect, and let the tracker resync.

Revoke immediately, without waiting, if you stop using the app the key was issued to, if you pasted the private key anywhere it should not have gone, or if the service holding it disclosed a breach. Deleting a key in the Coinbase Developer Platform portal is instant and the exposure ends there. How to revoke an API key covers where the control sits on each major venue.

Use one key per service. Two trackers means two keys, and the cost of that discipline is thirty seconds against the benefit of knowing exactly which credential to kill.

The residual risk of all this is worth naming plainly. A view-scoped key leaks information if it leaks: what you hold, what you bought, when. It does not leak money, because the permission that could move money was never attached to it. Is it safe to connect an exchange sizes that trade-off honestly rather than reassuring you.

Coinbase is where a lot of portfolios begin and, for many people, only a fraction of where the money ends up. The connection is worth setting up carefully precisely because it is the account you compare everything else against. Get the Coinbase figure right, and every wallet you add after it is easier to check.