Coinbase 与 Bybit 私有 API 认证、会话与重放控制对比
本文正文暫以英文原文展示，翻譯版本需完成來源複核後再發布。
已验证事实边界
1. Coinbase Advanced Trade WebSocket documentation describes WebSocket setup, authentication and subscription surfaces for Advanced Trade data. 2. Coinbase List Accounts API reference describes an authenticated account endpoint using bearer-token authorization. 3. Bybit V5 Integration Guidance documents authentication expectations for V5 API requests. 4. Bybit V5 Error Codes documentation includes permission-denied and API-key-expiry failure labels that can be logged without exposing secrets. 5. Bybit Rate Limit Rules documentation provides source material for per-endpoint and account-level request budgeting. 6. These sources do not prove private account eligibility, regional access, live order execution, support recovery, latency, fill quality or future API compatibility.
收起完整分析
决策矩阵
文章表格：可橫向滑動，或聚焦表格區域後使用方向鍵。
| Check | What it means | Practical action | Unknown to keep explicit |
|---|---|---|---|
| Token construction | private API access depends on venue-specific bearer token or signature construction | keep token generation, method path and key scope in a venue-specific module | whether a future SDK update changes the signing or bearer-token format |
| Session subscription | authenticated WebSocket sessions can expose account data after login or token presentation | track channel, session id, subscription count and reconnect replay separately | whether a reconnect duplicated or silently dropped a private subscription |
| Permission scope | read, trade and funding actions are materially different risk surfaces | start with account-read tests and promote only after dry-run evidence | whether the UI permission label covers every endpoint the bot calls |
| Retry and replay | lost responses can make retry behavior unsafe for private account and order actions | classify retries as read-only, subscription, order action, cancel action or unsafe unknown | whether the venue processed the original request before the client lost state |
| Evidence stop rule | public docs are not proof that a private connector is production-safe | record URL, access time, endpoint, non-secret error label and stop condition | whether private support state or compliance review changes the account outcome |
来源地图
- Coinbase Developer Documentation：Advanced Trade WebSockets（coinbase-ws-auth）
- Coinbase Developer Documentation：List Accounts（coinbase-list-accounts）
- Bybit API Documentation：Integration Guidance（bybit-v5-guide）
- Bybit API Documentation：Error Codes（bybit-v5-error）
- Bybit API Documentation：Rate Limit Rules（bybit-v5-rate-limit）
控制说明
1. Token construction
这一项要求读者把公开来源翻译成操作规则。这里的含义是：private API access depends on venue-specific bearer token or signature construction。可执行动作是：keep token generation, method path and key scope in a venue-specific module。仍然未知的是：whether a future SDK update changes the signing or bearer-token format。因此本文不会把未知部分包装成收益承诺、牌照承诺、审批保证、安全保证、恢复保证、平台排名或价格暗示。
2. Session subscription
这里的含义是：authenticated WebSocket sessions can expose account data after login or token presentation。可执行动作是：track channel, session id, subscription count and reconnect replay separately。仍然未知的是：whether a reconnect duplicated or silently dropped a private subscription。
操作测试也必须很窄。这就是本文坚持以清单形式呈现的原因。
3. Permission scope
这里的含义是：read, trade and funding actions are materially different risk surfaces。可执行动作是：start with account-read tests and promote only after dry-run evidence。仍然未知的是：whether the UI permission label covers every endpoint the bot calls。
操作测试也必须很窄。这就是本文坚持以清单形式呈现的原因。
4. Retry and replay
这里的含义是：lost responses can make retry behavior unsafe for private account and order actions。可执行动作是：classify retries as read-only, subscription, order action, cancel action or unsafe unknown。仍然未知的是：whether the venue processed the original request before the client lost state。
操作测试也必须很窄。这就是本文坚持以清单形式呈现的原因。
5. Evidence stop rule
这里的含义是：public docs are not proof that a private connector is production-safe。可执行动作是：record URL, access time, endpoint, non-secret error label and stop condition。仍然未知的是：whether private support state or compliance review changes the account outcome。
操作测试也必须很窄。这就是本文坚持以清单形式呈现的原因。
仍需明确的未知项
- whether a future SDK update changes the signing or bearer-token format
- whether a reconnect duplicated or silently dropped a private subscription
- whether the UI permission label covers every endpoint the bot calls
- whether the venue processed the original request before the client lost state
- whether private support state or compliance review changes the account outcome
实用结论
Coinbase Advanced Trade 与 Bybit V5 都提供 authenticated private API surface，但控制模型不应被合并成一个泛化 crypto-exchange connector。Coinbase Advanced Trade 文档描述 authenticated WebSocket setup 与使用 bearer-token authorization 的 account endpoint；Bybit V5 文档描述 authentication expectation、permission/expiry error 与 rate-limit rules。实际决策是：在启用 private account data 或 order action 前，将 token construction、session subscription、permission scope、retry safety、rate budget 与 non-secret evidence logging 按场所拆开。 本文停在证据边界内，帮助读者决定下一步核验什么，而不是把公开文档改写成私人账户、钱包、API key、池子路径、稳定币余额、代币化资产或政策框架在任何未来条件下都能成功的承诺。
相關專題與工具:任選兩家交易所比較交易所 API 與行情資料核查