SoarSoar
Broker setup

Connect Coinbase Advanced

6 steps1 field

Coinbase asks you to pick a key type. The default ("Ed25519") will NOT work — make sure you switch it to "ECDSA" before tapping Create.

Step by step

Getting your Coinbase Advanced API keys

  1. 1
    Open Coinbase's developer site
    Sign in there. This is a separate account from your regular Coinbase app — you may need to make one.
  2. 2
    Tap "Create API key" on the right
    The form opens right away.
  3. 3
    Name your key, then expand "API restrictions"
    It's closed by default — easy to miss. All the important settings live inside it.
    Soar Bot
  4. 4
    Set permissions + pick the right key type
    • Turn ON: View + Trade
    • Leave OFF: Transfer (never enable for a bot)
    • Change "Signature algorithm" from Ed25519 → ECDSA
  5. 5
    Tap Create, then "Download API key"
    Coinbase saves cdp_api_key.json to your downloads folder.
  6. 6
    Come back here and drop the file in the gold box below
    Soar checks it instantly. You're done.
Permissions

What to enable — and what to leave OFF

✓Enable these
  • View
  • Trade
✕Never enable these
  • Transfer (NEVER turn on — creates a security risk if the key leaks)
Why this matters:Soar only ever needs read + place-order permissions. If you give a key withdraw or transfer access, anyone with that key could move funds — including a security risk if your machine is ever compromised. Disabling withdraw on the key itself means even a worst-case leak can't drain your account.
What you paste

The fields Soar asks for

  • cdp_api_key.json contents
    { "name": "organizations/.../apiKeys/...", "privateKey": "-----BEGIN EC PRIVATE KEY-----..." }
    Paste the contents of the JSON file Coinbase generated when you created the key.
Security & trust

Where your keys live

Soar passes your Coinbase Advancedkeys straight from your browser into YOUR Cloudflare Worker. Soar's servers see them once during the ~30-second deploy window, then never again.

The bot that talks to Coinbase Advanced runs on the free Cloudflare Workers tier in your own Cloudflare account. You see + control everything from your Cloudflare dashboard. You can rotate the keys, pause the bot, or destroy the Worker at any time — Soar has zero ability to undo that.

Read the full security model →
See also

Related help topics