Integrating Coinbase Advanced Trade API with Node.js: A 2026 Engineering Guide

Two channels, different jobs.

REST is the source of truth for accounts, orders, candles, and anything you need a request/response for. Coinbase CDP REST limits are a rolling 10-second window: 600 reads (GET) and 500 writes (POST, PUT, DELETE). Hit the wall and you get 429.

WebSockets are for live data. Public market data lives on wss://advanced-trade-ws.coinbase.com. Private user data lives on wss://advanced-trade-ws-user.coinbase.com. Typical setup: WebSockets for the book, trades, and your fills. REST for placing orders and for periodic reconciliation.

That split is not a style choice. Current Advanced Trade does not offer a trading WebSocket API. You cannot await an order ack on the Advanced Trade socket the way you can on Binance, Bybit, or OKX.

Raw CDP auth is JWT, not HMAC. You build a token per request with issuer cdp, a uri claim, nbf/exp, and a unique nonce. Keys are either ECDSA (PEM, ES256) or Ed25519 (base64, EdDSA). Clock skew on nbf/exp is a common 401.

Other recurring pain:

• Connection health: the socket can look open while the server has stopped sending. You need ping/pong and a teardown if pong never comes.
• Resubscribe: after a drop you must subscribe again, or you sit on a live socket with no data.
• Book state: level2 starts with a snapshot, then deltas. After a disconnect, throw the local book away and wait for a new snapshot.

coinbase-api signs JWTs, opens the right host per feed, heartbeats, reconnects, and resubscribes. It does not throttle you. Stay inside Coinbase's 10-second REST windows and the unauthenticated WebSocket cap of 8 messages per second yourself.

Do not put the private key in source. Use env vars or a secret manager. In CDP, drop withdrawal permission on automation keys. Add IP allowlisting so a leaked key is useless off your network. For rotation, run two keys for a short overlap, then retire the old one.

JWT nbf and exp come from the local clock. If that clock is wrong, Coinbase rejects the token. Keep NTP honest. The SDK does not sync time for you. It does mint a fresh nonce per JWT, which blocks replay.

If you want a latency/skew check, CBAdvancedTradeClient has fetchLatencySummary(). That is a diagnostic helper, not something you need on every request.

For a longer walkthrough of client setup, use the coinbase-api tutorial.

WebsocketClient is event-driven: open, update, response, reconnect, reconnected, close, exception. Filter update events by channel and product. Do not build a fake request/response mapper on top and call it an "awaitable WebSocket order API". That is not how this exchange works today.

International derivatives after September 9, 2026 are a different story. The Deribit-powered gateway speaks JSON-RPC over WebSocket and does support order entry (private/buy, private/sell, and similar). That is a new host and a new protocol. Spot and US futures stay on the REST-plus-streams model above.

Subscribe to user for order and fill updates, and futures_balance_summary if you trade Coinbase futures. Subscribes on advTradeUserData are signed automatically when you pass CDP credentials.

const { WebsocketClient } = require("coinbase-api");

const client = new WebsocketClient({
  apiKey: process.env.API_KEY_NAME,
  apiSecret: process.env.API_PRIVATE_KEY,
});

client.on("update", (data) => {
  console.info(new Date(), "user data:", JSON.stringify(data));
});

client.subscribe("user", "advTradeUserData");
client.subscribe("futures_balance_summary", "advTradeUserData");
client.subscribe("heartbeats", "advTradeUserData");

Push those events into your local order state. Ignore public noise you did not ask for.

Unauthenticated WebSocket messages are limited to 8 per second per IP. Connection attempts are limited too. Authenticate when you can. Throttle subscribe/unsubscribe bursts in your own code.

You do not need to re-send subscribe payloads after a drop. The client already does that.

You do need to treat local book state as dirty. level2 is snapshot then incremental updates. After reconnect / reconnected, wipe the in-memory book and rebuild from the next snapshot. Trading on a half-applied book is how you get nonsense prices.

Listen to exception and close. An unexpected close should be followed by reconnect then reconnected. If it is not, you have a bug or a ban, not a flap.

CDP REST: 600 GET requests and 500 writes per rolling 10-second window, per the Coinbase rate-limit docs. Persistent 429s can get your IP in trouble.

Build a queue or a token bucket in your process. The SDK will not. Watch for 429 and back off. For the plumbing of signed requests and sockets, read the coinbase-api docs.

Install:

npm install coinbase-api

Public REST, no keys:

const { CBAdvancedTradeClient } = require("coinbase-api");
// import { CBAdvancedTradeClient } from 'coinbase-api';

const client = new CBAdvancedTradeClient({});

async function publicCalls() {
  const serverTime = await client.getServerTime();
  console.log("Server Time:", serverTime);

  const publicProduct = await client.getPublicProduct({
product_id: "BTC-USD",
  });
  console.log("Public Product:", publicProduct);

  const productBook = await client.getPublicProductBook({
product_id: "BTC-USD",
limit: 10,
  });
  console.log("Public Product Book:", productBook);
}

publicCalls();

getPublicProduct is product metadata. getPublicMarketTrades hits /api/v3/brokerage/market/products/{product_id}/ticker if you want recent trades and best bid/ask without auth. Authenticated getBestBidAsk is the private sibling.

The package is TypeScript. Types cover most request and response shapes. Not every field on every endpoint is fully typed. Treat "most" as the honest description.

Put CDP credentials in the environment. Use client.generateNewOrderId() for client_order_id (the SDK prefixes IDs so Coinbase accepts them).

const { CBAdvancedTradeClient } = require("coinbase-api");

const client = new CBAdvancedTradeClient({
  apiKey: process.env.API_KEY_NAME,
  apiSecret: process.env.API_PRIVATE_KEY,
});

async function submitOrders() {
  const marketSell = await client.submitOrder({
product_id: "BTC-USDT",
side: "SELL",
client_order_id: client.generateNewOrderId(),
order_configuration: {
market_market_ioc: { base_size: "0.001" },
},
  });
  console.log("Market order:", marketSell);

  const limitBuy = await client.submitOrder({
product_id: "BTC-USDT",
side: "BUY",
client_order_id: client.generateNewOrderId(),
order_configuration: {
limit_limit_gtc: {
base_size: "0.001",
limit_price: "50000.00",
},
},
  });
  console.log("Limit order:", limitBuy);
}

submitOrders();

That is REST. Pair it with the user WebSocket so fills show up without polling.

Rate limits stay in your application. There is no Advanced Trade testnet. previewOrder is useful before you send live size. For Exchange or INTX you can set useSandbox: true on those clients. Not on CBAdvancedTradeClient.

For a wider view of process layout, see Algorithmic Trading System Architecture.

Yes. Coinbase does not charge for API access. You pay trading fees on fills. Advanced Trade is maker-taker, based on trailing 30-day USD volume. Coinbase's own Advanced overview lists fees at or below 0.40% maker and 0.60% taker, with exact tiers in your account. Those numbers change. Check the fee page in Coinbase, not a blog.

In your code. Siebly SDKs do not throttle. CDP REST is 600 reads and 500 writes per rolling 10-second window. WebSocket unauthenticated messages are 8 per second per IP. Queue requests, backoff on 429, and do not retry in a tight loop.

Coinbase Pro is gone. Advanced Trade is the v3 brokerage API. Auth is CDP JWT (ES256 or EdDSA), not the old key/secret/passphrase trio. Passphrase auth still exists on Exchange, International, and Prime via CBExchangeClient, CBInternationalClient, and CBPrimeClient. Those are different products in the same npm package.

Not on the current Advanced Trade sockets. Place orders with CBAdvancedTradeClient.submitOrder(). Subscribe to user on advTradeUserData to hear about those orders. WebSocket order entry is part of the Deribit-powered international derivatives gateway that goes live September 9, 2026. That is JSON-RPC on wss://drb.coinbase.com/ws/api/v2, not WebsocketClient as it exists today. Spot and US futures stay REST-for-orders.

Yes. The package is written in TypeScript and ships declarations. Most request and response shapes are typed. That is stronger than raw fetch, not a guarantee that every nested field is modeled.

Environment variables or a secret manager. Never commit the private key. Disable withdrawals on automation keys. IP allowlist in CDP.

On September 9, 2026 Coinbase cuts international derivatives over to a Deribit-powered gateway (Starbase matching engine). Protocol becomes JSON-RPC 2.0 over HTTP and WebSocket. Open INTX orders are cancelled during the window. Spot and US futures keep the current Advanced Trade REST and WebSocket APIs. coinbase-api covers those current APIs and current INTX REST. The new drb.coinbase.com gateway is a separate integration until the SDK adds it. Official Coinbase docs remain the source of truth for cutover details.

Disclaimer

*Technical and legal disclaimer: Siebly.io provides software development tools, SDKs, documentation, and educational engineering content for crypto exchange API integrations. This content is for software engineering education only and is not financial, investment, legal, tax, accounting, compliance, or trading advice.

Nothing in this article is a recommendation, invitation, or inducement to buy, sell, hold, trade, long, short, or allocate to any cryptoasset, exchange product, strategy, bot, or automated workflow. Examples, code patterns, simulations, backtests, and architecture diagrams are illustrative only and must not be treated as trading signals, investment recommendations, or evidence of future performance.

Cryptoasset markets are high risk and volatile. If you choose to build or operate exchange-connected software, you are responsible for your own legal, regulatory, tax, security, exchange-account, API-key, and risk-management obligations. Use public data, testnet, demo, dry-run, or paper-trading workflows before any live execution. Keep API keys server-side, use least-privilege permissions, and never enable withdrawals for automation keys unless you fully understand and accept the risks.

Siebly.io is not an exchange, custodian, investment adviser, trading-signal provider, or managed trading service. Official exchange documentation remains the source of truth for exchange-specific rules, API behavior, and terms of use. Use of Siebly.io content and software is also subject to the Siebly.io terms and conditions.*