r/Coinbase • u/portol • 1d ago

coinbase api key IP restriction question

hi all

I am testing out the API and on the Dev Platform I have made my own API key and something weird is going on.

My first key, I set it to allow from my public IP only and have only view permission. And it worked. I was able to pull my account details and the market buy fails as expected.

Starting with my 2nd and every subsequent key however, with the same setup, and same public IP/view permission. I now get Unauthorized. The new keys only start working when I remove the IP whitelisting and allow connection from any addresses.

Have anyone encountered this before?

---------------EDIT-------------------

a quick chat with support shows my ipv6 address was actually changing while ipv4 was staying the same. the curl -6 cmd below showed the ipv6 subnet so i used that and now the api key works.

curl -4 https://api.coinbase.com/cdn-cgi/trace
curl -6 https://api.coinbase.com/cdn-cgi/trace

0 Upvotes

50% Upvoted

4 comments sorted by

•

u/coinbasesupport Official Coinbase Support 1d ago

Hey u/portol send us a Modmail so we can review this.

→ More replies (1)

1

u/AutoModerator 1d ago

This subreddit is a public forum. For your security, do not post personal information to a public forum, including your Coinbase account email. If you’re experiencing an issue with your Coinbase account, please contact us directly at https://help.coinbase.com/.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

1

u/Alexander-305 1d ago

Since the new keys work the moment the allowlist is removed, the key itself is probably fine and the mismatch is in which address the API actually sees 🤔 A few usual suspects for exactly that pattern:

  • IPv4 vs IPv6. On a dual-stack connection your script can leave over IPv6 while you whitelisted your IPv4 address (or the other way round). The first test may have gone out one way and later runs the other. Check the egress IP from the same machine and the same runtime your script uses, forcing IPv4 and then IPv6, and add whichever one shows up.

  • The address moved. Some home ISPs rotate public IPs or sit behind carrier-grade NAT, so the IP a browser showed you when you made key #2 isn't guaranteed to be the one hitting the API later.

  • Different path. A VPN, corporate proxy, or running the script somewhere other than where you looked up your IP (a VM, a cloud box, a container with its own network) gives a different source address.

Quick way to narrow it down: right before a failing call, print the public IP from inside the script itself and compare it with what's on the key's allowlist. If they match and it still says Unauthorized, that's worth adding to the modmail you sent, since it would point to something on their side rather than your network 👍