How to revoke old API keys in Coinbase account settings?

Accessing API Management Interface

1. Log in to your Coinbase account using verified credentials and two-factor authentication.

2. Navigate to the Settings section via the user dropdown menu located in the top-right corner of the dashboard.

3. Select the API tab from the left-hand navigation panel—this displays all active and inactive keys associated with your account.

4. Confirm you are viewing the correct profile by checking the email address and account ID shown at the top of the page.

5. Review the list of generated keys, paying close attention to creation timestamps, assigned permissions, and last-used dates.

Identifying Obsolete Keys

1. Locate keys marked as “Legacy” or those created before December 2024, as these often lack modern security headers and use deprecated signing methods.

2. Cross-reference each key’s permission scope: keys granting full wallet access without IP restrictions should be flagged for immediate revocation.

3. Check audit logs for any key that has not been used in over 90 days—such keys pose dormant attack vectors if compromised.

4. Identify keys tied to decommissioned third-party applications or services no longer integrated with your trading workflow.

5. Verify whether any key still holds active session tokens or pending withdrawal authorizations before proceeding.

Executing Key Revocation

1. Click the three-dot menu icon next to the target API key entry.

2. Select “Revoke” from the contextual options—this action cannot be undone without generating a new key pair.

3. Enter your current password or approve the action via hardware security key when prompted.

4. Confirm revocation by clicking “Yes, revoke permanently” in the modal dialog box.

5. Wait for the system status indicator to change from “Revoking…” to “Revoked” before closing the window.

Post-Revocation Verification

1. Refresh the API page to ensure the revoked key no longer appears in the active list.

2. Open the Activity Log tab and filter for “API Key Revoked” events to validate timestamp and initiating IP address.

3. Run a test call using the revoked key—expect HTTP 401 Unauthorized response with error code “invalid_api_key”.

4. Scan connected services for failed webhook deliveries or authentication errors occurring within five minutes after revocation.

5. Export a fresh copy of your updated API key inventory report for internal compliance documentation.

Frequently Asked Questions

Q: Can a revoked API key be restored after deletion? No. Coinbase does not provide restoration functionality for revoked keys. A new key must be generated manually.

Q: Does revoking an API key invalidate existing OAuth tokens issued under it? Yes. All access and refresh tokens derived from the revoked key become immediately invalid.

Q: Will revoking a key interrupt ongoing automated trading bots? Yes—if those bots rely exclusively on that key for authentication, they will cease operation until reconfigured with a new key.

Q: Is there a rate limit on how many API keys can be revoked per hour? No official cap exists, but rapid sequential revocations may trigger temporary account verification prompts for security review.