Skip to main content
This page answers the most common questions developers encounter when integrating with the Coinbase Advanced Trade API. Whether you are migrating from the legacy Coinbase Pro API, setting up authentication for the first time, or trying to understand how balances and order types work, you will find practical guidance below. If your question is not covered here, visit the Coinbase Developer Portal or reach out via the developer forums.
The Coinbase Advanced Trade API is the successor to the Coinbase Pro API and offers the same professional-grade trading capabilities — including limit orders, stop orders, and full order book access — under the unified Coinbase platform. Unlike the Pro API, the Advanced Trade API uses JWT-based authentication (rather than API key + secret + passphrase) and is available directly through your standard Coinbase account without needing a separate Pro account. The Pro API reached end-of-life, so all new integrations should target the Advanced Trade API at https://api.coinbase.com/api/v3/brokerage/.
You generate a short-lived JWT using your API key’s private key (ES256 algorithm) and sign a payload that includes your sub (key name), iss ("coinbase-cloud"), nbf, exp, and a uri claim set to the HTTP method and path you are calling. Coinbase provides official helper libraries for Python, Go, and TypeScript that handle JWT generation for you — see the Authentication guide for step-by-step instructions and copy-paste code samples. You pass the resulting token as a Bearer token in the Authorization header on every request.
JWTs for the Coinbase Advanced Trade API are valid for a maximum of 120 seconds from the nbf (not-before) time. You should generate a fresh JWT for each request — or at most reuse one for a very short burst of requests within the same two-minute window. Sending a request with an expired JWT returns a 401 Unauthorized error with a message indicating the token has expired. Most SDK wrappers handle token generation transparently on a per-request basis so you do not have to manage expiry yourself.
Yes. Coinbase provides a sandbox environment for development and testing at https://api-public.sandbox.exchange.coinbase.com. The sandbox mirrors the production API surface but uses test funds, so you can place, fill, and cancel orders without any financial risk. You will need to create separate API keys scoped to the sandbox environment via the Coinbase Developer Platform. Note that sandbox market data may not reflect real market conditions, so load-testing latency or order fill behavior should be validated in production with small amounts.
The Advanced Trade API supports the following order configurations, each passed as a nested object inside order_configuration:Specify the order configuration as a single nested object — for example, "order_configuration": { "limit_limit_gtc": { "base_size": "0.01", "limit_price": "30000" } }.
Use the POST /api/v3/brokerage/orders/batch_cancel endpoint and supply the list of order_ids you want to cancel. A single call can cancel up to 100 orders. To cancel all open orders, first retrieve them with GET /api/v3/brokerage/orders/historical/batch?order_status=OPEN, collect the order_id values from the response, then pass them in a batch cancel request:
You can retrieve the full list of tradeable products at any time by calling GET /api/v3/brokerage/products. The response includes each product’s product_id (for example, BTC-USD, ETH-USDC), status (online, delisted, etc.), minimum order sizes, price precision, and other trading constraints. Filter by product_type=SPOT for spot trading pairs. Availability varies by region — some products are restricted in certain jurisdictions, and the response will reflect only the products accessible to your account.
The most efficient way to receive real-time price data is via the WebSocket Advanced Trade feed at wss://advanced-trade-ws.coinbase.com. Subscribe to the ticker channel for best-bid/ask updates, the level2 channel for full order book changes, or the market_trades channel for a stream of executed trades. WebSocket subscriptions push updates as they occur with no polling overhead and do not count against your REST rate limit. See the WebSocket feed guide for authentication instructions and channel details.
A 401 response means the API could not validate your JWT. The most common causes are:
  • Expired token — JWTs are valid for only 120 seconds. Generate a fresh token per request.
  • Wrong uri claim — The uri in your JWT payload must exactly match the HTTP method and path of the request (for example, GET api.coinbase.com/api/v3/brokerage/accounts). A mismatch causes rejection even if the signature is valid.
  • Clock skew — If your system clock is more than a few seconds out of sync, the nbf or exp claims may appear invalid. Sync your system time with an NTP server.
  • Wrong private key — Ensure the private key you are signing with corresponds to the API key name in the sub claim.
Enable debug logging in your HTTP client to inspect the exact JWT you are sending, and use a tool like jwt.io to decode and verify the payload before sending.
When you query an account via GET /api/v3/brokerage/accounts/{account_uuid}, the response includes two balance fields. available_balance is the amount you can immediately use to place new orders — it is your total balance minus any amounts currently held. hold represents funds that are locked against open orders or pending transactions and cannot be used until those orders are filled, cancelled, or expired. For example, if you have 1 BTC total and an open sell order for 0.3 BTC, your available_balance would be 0.7 BTC and your hold would be 0.3 BTC. Always check available_balance — not a cached total — before placing an order to avoid INSUFFICIENT_FUND errors.
API keys for the Advanced Trade API are managed through the Coinbase Developer Platform portal. Log in with your Coinbase account, navigate to API Keys, and create a new key. During creation you will choose the permissions scope (for example, trade, view, transfer) and download the private key file — this is the only time the private key is shown, so save it securely. The key name (shown as a UUID-like string) becomes the sub claim in your JWTs. Restrict key permissions to the minimum required for your use case, and rotate keys regularly as a security best practice.
Yes. Coinbase maintains official SDK libraries that handle JWT generation, request signing, and response parsing:
  • Python: coinbase-advanced-py — installable via pip install coinbase-advanced-py
  • TypeScript/Node.js: coinbase-advanced-node — installable via npm install coinbase-advanced-node
  • Go: Available via the Coinbase Developer Platform Go SDK
These SDKs wrap all REST and WebSocket endpoints with typed methods and automatic token refresh, significantly reducing the boilerplate you need to write. Community-maintained libraries exist for other languages; check the Coinbase Developer Portal for the current list of officially supported and community SDKs.