Connecte Coinbase Advanced Trade à ton trading bot

Why Coinbase Advanced Trade

Coinbase Advanced Trade is the order-book replacement for the now-retired Coinbase Pro. It is the natural choice for US-based traders who want a fully regulated exchange with FDIC-passthrough USD and an audited compliance posture. Fees are higher than offshore venues (40 bps maker, 60 bps taker at base tier), but for low-frequency strategies the difference is rounding error.

Noon Barbari uses the Advanced Trade REST API with CDP API keys (the modern variant that signs with Ed25519). Legacy HMAC keys still work but are being phased out.

Before you start

Complete Coinbase's KYC (Identity Verification) — required for any account. Enable 2FA with a passkey, a hardware key, or an authenticator app. Coinbase no longer accepts SMS 2FA on its API keys; you must use a stronger factor.

Create the API key

Coinbase has two key flavours; pick CDP API Keys (the new format):

1. Sign in and go to portal.cdp.coinbase.com.
2. Select API keys in the left nav.
3. Click Create API key.
4. Pick Trading API key (not Wallet API).
5. Enter a nickname.
6. Choose View and Trade scopes (see next section).
7. Click Create & download — Coinbase issues a JSON file containing the key name and an Ed25519 private key block. Download it now; it is not retrievable later.

Set the right permissions

On the create dialog:

• ✅ View — required.
• ✅ Trade — required for placing orders.
• ❌ Transfer — leave OFF. Noon Barbari does not need it.

Click Create.

IP whitelist

Recommended. Under the key settings, add Noon Barbari's egress IP:

51.38.112.198

Coinbase allows multiple IPs per key. Note that with CDP keys, IP restrictions are enforced server-side on every signed request — there is no grace period.

51.38.112.198

Paste keys into Noon Barbari

Coinbase CDP keys are an Ed25519 PEM block, not a short HMAC secret. Paste the entire -----BEGIN EC PRIVATE KEY----- block (including the BEGIN/END lines) into the Secret field, and the key name (organization/.../apiKeys/...) into the API Key field. Once the API key is created, copy the public key and the secret into Noon Barbari from the Profile → Exchange keys section of your account. Keys are encrypted at rest with a per-user envelope key and only decrypted in memory while a strategy run is active — they never leave the worker that needs them.

If the exchange issues a third value (passphrase, API memo, sub-account label), there will be a dedicated field for it. Save the form and the dashboard will run a lightweight balance query to confirm the credentials work.

Test the connection

Noon Barbari will issue a single read-only balance request the moment you save the key. A green tick means the credentials authenticated and your permission scopes match what the strategy needs. A red error usually points to one of four things: wrong key/secret pair, missing permission, IP whitelist mismatch, or 2FA grace period not yet expired.

Once green, run a small paper trade for a day before flipping a strategy to live. Real execution exposes you to fees, partial fills, and slippage that paper mode cannot replicate.

Security tips

Treat exchange API keys like SSH keys to a production server — rotate them on a schedule and revoke them the moment you no longer need them.

1. Never grant withdraw — Noon Barbari only needs read + trade. A key without withdraw cannot move funds out of your account, no matter who steals it.
2. Use a sub-account if your exchange supports them — isolates the bot's capital from your spot stack and your manual trading.
3. Enable IP whitelist even when the exchange does not require it.
4. Rotate keys every 90 days — set a calendar reminder. The exchange's UI will let you create a new key and revoke the old one in the same session.
5. Enable exchange-side alerts for new API keys, failed logins, and large orders so you find out about a compromise within minutes, not days.

Pièges fréquents

• Downloading the JSON, then losing it. Coinbase will not re-issue the private key — you have to create a new one.
• Pasting only the base64 body of the PEM block. Include the BEGIN/END lines verbatim.
• Using a legacy HMAC key (CB-ACCESS-KEY / CB-ACCESS-SIGN) on a strategy configured for CDP keys. Pick one path and stick to it.
• Trying to place a futures order — Coinbase Advanced Trade does not offer futures to retail traders in this product. Use Coinbase Derivatives separately.

Dépannage

• 401 — invalid CB-ACCESS-KEY.

  The key name in your Noon Barbari config does not match the key on Coinbase. The full key name looks like organizations/<uuid>/apiKeys/<uuid> — paste it verbatim, with no leading or trailing whitespace.

• 401 — invalid CB-ACCESS-SIGN.

  The Ed25519 private key block is malformed or truncated. Re-download the JSON from Coinbase and re-paste the exact PEM content.

• 403 — permission denied.

  The key is missing the Trade scope. Edit the key on portal.cdp.coinbase.com and add it.

• Can I still use the old api.coinbase.com HMAC keys?

  For now, yes — Noon Barbari supports both. New keys should be CDP / Ed25519 because Coinbase is deprecating HMAC over the next 12-18 months.