Making your Coinbase key
About five minutes, done once. You'll need your Coinbase sign-in and your phone for the security code.
What a key actually is
It's a permission slip. You stay signed in to Coinbase; we never see your password and never sign in as you. The slip says what our software is allowed to do in your account — and you decide what that is.
You'll give it permission to trade and nothing else. A trade-only key cannot move a penny out of your account. Not to us, not to anyone who somehow got hold of it. That's not a promise we're making; it's a limit Coinbase enforces.
You can tear the slip up whenever you like. Delete the key at Coinbase and everything stops, with no help needed from us.
The steps
Open the Coinbase API keys page
Sign in to Coinbase, then go to portal.cdp.coinbase.com/projects/api-keys. You should see an API keys page with a tab called Secret API keys already selected.
This is Coinbase's own site, not ours. If it asks you to make a "project" first, accept the name it suggests — the name doesn't matter.
Press "Create secret API key" and name it
Press the blue Create secret API key button at the top right. A window opens. Under API key nickname, type a name you'll recognise later, like carefultrade.
Check "Opt-out of IP allowlisting"
Right below the nickname is an IP allowlist box. Leave it empty, and check the box underneath that says Opt-out of IP allowlisting.
Our software runs from a connection whose address changes, so pinning the key to one address would make it stop working at an unpredictable moment. The trade-only permission you'll set in the next step is what actually protects you.
Open "Advanced settings" and check Trade — only Trade
Click Advanced settings to open it. Under Coinbase App & Advanced Trade, leave the portfolio on Primary (or pick wherever your money actually is), then check Trade (execute trades on your behalf). The View (read-only) box is already checked — leave it.
Leave everything else unchecked - Transfer, Receive, Export and Manage. Transfer is the one that matters most on the whole screen: it's what would let a key move money out. Without it, the worst anyone could do with your key is buy and sell coins inside your own account.
Scroll down to Signature algorithm — pick ECDSA
The window is taller than it looks — scroll down inside it, past the Account section, until you see Signature algorithm. Pick ECDSA (Legacy SDKs) — yes, even though Ed25519 says "Recommended".
ECDSA is the kind that produces the long key starting -----BEGIN EC PRIVATE KEY-----, which is what the box on our page is expecting. If yours came out as one short line of jumbled letters instead, that's an Ed25519 key — paste it anyway and tell us if it doesn't connect.
Press Create, then pass the security check
Press Create. Coinbase will ask for 2-step verification — the same code you use to sign in. That's normal: it's Coinbase making sure it's really you.
Copy both parts before you close the window
Coinbase shows you the secret once. Close the window and it is gone forever — not lost, just unrecoverable; you'd delete that key and make another.
You need two things from this screen:
- The API key ID — sometimes shown as a long line beginning organizations/
- The Secret — several lines beginning -----BEGIN
If it offers a JSON file to download, take it — that file contains both parts in their fullest form. Open it in Notepad, copy the two values, and delete the file afterwards.
Paste them into Carefultrade
Go to Your exchange and paste each part into the matching box. Include the -----BEGIN and -----END lines — they're part of the key, not decoration.
Your key is locked before it leaves your browser, using a lock only our trading machine can open. Nobody at Carefultrade can read it, and it isn't stored anywhere readable.
When it doesn't work
It says the key is wrong, but I copied it carefully.
Nine times out of ten a line is missing from either end. Go back and make sure both the -----BEGIN and -----END lines came along.
It connected, but says it can't trade.
The Trade permission wasn't checked. Coinbase won't let you add it afterwards — delete that key and make a new one. Takes two minutes the second time.
It worked, then stopped.
Usually the key was deleted at Coinbase, or an IP allowlist was set and the address changed. Both are fixed by making a fresh key.
I closed the window without copying the secret.
Nothing is broken and nothing is at risk. Delete that key at Coinbase and create another.
My money isn't at Coinbase.
Then we can't help you yet, and we'd rather say so. Coinbase is the only exchange we support today. More are coming — join the waiting list and we'll tell you when yours arrives.
Two things we will never do
We will never ask you for your Coinbase password, and we will never ask you to send a key by email, chat or over the phone. Anyone who does is not us. The only place your key should ever be typed is the box on your own Carefultrade page.