بحث موثق بالمصادر: Coinbase Advanced Trade Portfolio

Decision outcome: Before connecting a bot or reporting tool, create a dedicated key for the target portfolio, prefer view-only permissions when possible, avoid Transfer unless needed, store the secret once in a secret manager, bind allowed IPs, rotate on exposure, and stop if a workflow asks for a passphrase, secret, wallet seed or broad all-account permission outside the official key screen.

Evidence snapshot. This article was researched at 2026-09-22T05:44:42.988Z using Coinbase Help, Coinbase Developer Documentation. A local queue, old draft, search snippet, social repost, price chart or AI summary was not treated as proof. Those surfaces can suggest a question, but every material claim below is tied to the cited source list and claim map.

Verified facts. Claim c1: Coinbase Help says an Exchange API key can only be used for a single portfolio and requires an IP address whitelist during creation. Claim c2: Coinbase Help says the API secret and passphrase are shown only once and Coinbase cannot retrieve them if lost. Claim c3: Coinbase Help lists API key permissions including View, Transfer, Trade and Manage, with Transfer able to move value for accounts including deposits and withdrawals. Claim c4: Coinbase Developer documentation says Advanced Trade supports multiple portfolios and each portfolio should have a dedicated CDP API key to limit portfolio access. These facts are deliberately narrow. They do not prove personal eligibility, future availability, execution quality, legal status beyond the cited text, tax treatment, account approval, support outcome, redemption, price direction, liquidity depth or platform solvency.

Reader job. The reader searching for Coinbase Advanced Trade portfolio API key scope controls is not helped by a broad slogan. The reader needs to know what has to be checked before a login, transfer, order, report, registration, comment filing, wallet signature or portfolio API workflow moves from planning into action.

Decision table use. | Decision checkpoint | Evidence to read | Stop condition | | --- | --- | --- | | Official object | Coinbase Advanced Trade, portfolio API key, CDP API key | the source cannot name the exact product, setting, route, policy, date or account surface | | User boundary | account, jurisdiction, device, wallet, API key, bot, route or verification state | user state differs from the public source | | Failure handling | recovery path, cancellation path, warning, test transfer, support channel or rollback note | the next step is irreversible or secret-dependent | | Evidence log | URL, access time, selected setting and non-secret stop rule | proof would expose credentials, identity documents, private keys, balances or positions |

Decision discipline for Coinbase Advanced Trade portfolio API key scope controls. The useful answer is not a universal winner. It is a source-bound scorecard: which official source answers the immediate question, which control is blank, which blank changes user risk, which test is reversible and which condition reopens the decision. An honest blank is safer than an invented advantage.

FAQ. What is the short answer? Coinbase documentation separates portfolio-level trading operations from broad account access. What should be verified first? Verify the official source and the exact control surface. What should not be inferred? Do not infer eligibility, future support, legal treatment, tax treatment, recovery, execution quality, liquidity, redemption, consumer protection or account approval. When should the user stop? Stop when source, object, user state, permission, route, issuer, jurisdiction or failure handling is unclear.