Coinbase Advanced Trade Portfolio API Key Scope 更新清单
已验证事实边界
1. Coinbase Advanced Trade documentation describes REST API and WebSocket protocol support for programmatic trading and market data. 2. Coinbase API key authentication documentation describes API key based authentication and JWT bearer-token use for API calls. 3. Coinbase Advanced Trade portfolio guidance says portfolios can segregate trading strategies and that each portfolio should have a dedicated CDP API key to limit access. 4. The Create Portfolio reference describes authorization through a JWT signed using a CDP API Key Secret and passed as a bearer token. 5. Portfolio and API key documentation do not prove that a user's account is eligible for every portfolio, product, jurisdiction or permission. 6. These sources do not authorize credential sharing, hidden key collection, broad production permissions or untested order placement.
收起完整分析
决策矩阵
文章表格：可横向滑动，或聚焦表格区域后使用方向键。
| Check | What it means | Practical action | Unknown to keep explicit |
|---|---|---|---|
| Portfolio boundary | portfolio-specific access changes how API keys should be assigned | record portfolio UUID, owner, strategy and key scope before use | whether account state allows the intended portfolio operation |
| JWT generation | bearer authorization depends on correct local signing and secret handling | generate tokens in a controlled environment without printing secrets | whether clock, library or key rotation changes token validity |
| Endpoint scope | read, create, order and balance endpoints do not imply the same permission set | test read-only endpoints before any write-capable operation | whether future endpoint permissions are renamed or narrowed |
| WebSocket use | streaming market or private data is a separate liveness surface | test subscribe, reconnect, stale stream detection and REST reconciliation | whether a live session missed account events during outage |
| Evidence stop rule | documentation is not a mandate to collect user credentials | store only non-secret URL, date, endpoint and permission labels | whether user-specific support or compliance state changes access |
来源地图
- Coinbase Developer Documentation：Welcome to Advanced Trade API（coinbase-advanced-trade-overview）
- Coinbase Developer Documentation：Coinbase App API Key Authentication（coinbase-api-key-authentication）
- Coinbase Developer Documentation：Advanced Trade Portfolios（coinbase-advanced-trade-portfolios）
- Coinbase Developer Documentation：Create Portfolio（coinbase-create-portfolio）
控制说明
1. Portfolio boundary
这一项要求读者把公开来源翻译成操作规则。这里的含义是：portfolio-specific access changes how API keys should be assigned。可执行动作是：record portfolio UUID, owner, strategy and key scope before use。仍然未知的是：whether account state allows the intended portfolio operation。因此本文不会把未知部分包装成收益承诺、牌照承诺、审批保证、安全保证、恢复保证、平台排名或价格暗示。
2. JWT generation
这里的含义是：bearer authorization depends on correct local signing and secret handling。可执行动作是：generate tokens in a controlled environment without printing secrets。仍然未知的是：whether clock, library or key rotation changes token validity。
操作测试也必须很窄。这就是本文坚持以清单形式呈现的原因。
3. Endpoint scope
这里的含义是：read, create, order and balance endpoints do not imply the same permission set。可执行动作是：test read-only endpoints before any write-capable operation。仍然未知的是：whether future endpoint permissions are renamed or narrowed。
操作测试也必须很窄。这就是本文坚持以清单形式呈现的原因。
4. WebSocket use
这里的含义是：streaming market or private data is a separate liveness surface。可执行动作是：test subscribe, reconnect, stale stream detection and REST reconciliation。仍然未知的是：whether a live session missed account events during outage。
操作测试也必须很窄。这就是本文坚持以清单形式呈现的原因。
5. Evidence stop rule
这里的含义是：documentation is not a mandate to collect user credentials。可执行动作是：store only non-secret URL, date, endpoint and permission labels。仍然未知的是：whether user-specific support or compliance state changes access。
操作测试也必须很窄。这就是本文坚持以清单形式呈现的原因。
仍需明确的未知项
- whether account state allows the intended portfolio operation
- whether clock, library or key rotation changes token validity
- whether future endpoint permissions are renamed or narrowed
- whether a live session missed account events during outage
- whether user-specific support or compliance state changes access
实用结论
Coinbase Advanced Trade API onboarding 应被视为 portfolio-scoped key management，而不是泛化 exchange-login 步骤。Coinbase 文档说明 Advanced Trade 支持 REST 与 WebSocket workflow，API call 使用 bearer JWT authorization，portfolio guidance 还说明每个 portfolio 应有 dedicated CDP API key 以限制访问。实际更新是：上线 account 或 order operation 前，先映射 portfolio UUID、key owner、JWT generation、endpoint scope、WebSocket use 与 deletion/recovery path。 本文停在证据边界内，帮助读者决定下一步核验什么，而不是把公开文档改写成私人账户、钱包、API key、池子路径、稳定币余额、代币化资产或政策框架在任何未来条件下都能成功的承诺。
相关专题与工具:交易所 API 与行情数据核查