What to use instead of the Coinbase Pro API

The product

Coinbase Pro was Coinbase's trading screen for active traders, launched in 2018 as a direct line into the Coinbase Exchange order book, and its API was the reason so much crypto code mentions it. Underneath the app sat three interfaces: a REST API at api.pro.coinbase.com, a websocket feed at ws-feed.pro.coinbase.com and a FIX gateway. The public half needed no key and served products, tickers, trades, candles and the order book down to individual orders. The private half placed and cancelled orders with a key, a secret and a passphrase you chose yourself, and a separate sandbox host sat beside it. For most of its life this was the same API as Coinbase Exchange's institutional one, under a retail brand and a retail login.

It ended in three steps, all on Coinbase's own pages:

• 22 June 2022. The announcement, "Hello Advanced Trade, goodbye Coinbase Pro": Coinbase would rebuild the Pro experience inside the main app as Advanced Trade and "sunset Coinbase Pro later this year". Full REST and websocket support for Advanced Trade was promised for later.
• 20 November 2023. An update on that post says the phased migration was complete, that Pro would no longer be supported on web and mobile, and that customers could no longer log in. Coinbase's Advanced Trade FAQ gives 1 December 2023 as the date every customer had been migrated, and describes that as accelerated from an earlier plan to deprecate Pro in 2024.
• 11 September 2024. The Exchange API changelog: "The Pro API (https://api.pro.coinbase.com) has been deprecated. For REST API access, leverage the Exchange API." That entry is the date carried above as the end. Coinbase published no separate cut-off date that we could find, so when exactly the host began refusing requests is not on record.

What is on record is the state today. Checked on 4 October 2026: pro.coinbase.com redirects to Advanced Trade on coinbase.com; docs.pro.coinbase.com redirects to the old Exchange docs path; api.pro.coinbase.com answers /time with a 200 and every market-data path with a 503 and {"message":"Coinbase Pro API is deprecated."}; and ws-feed.pro.coinbase.com fails the websocket handshake with Cloudflare's 530 / error code: 1016, meaning the name resolves and there is nothing behind it. The same Advanced Trade FAQ that dates the migration still says "Unauthenticated Pro APIs are still available for customers with access". It is wrong now.

What to use instead

Say the awkward part first: the Pro API split in two, and which half you get depends on who you are, not on what your code does. Coinbase's own FAQ draws the line. Advanced Trade is for individual traders and uses CDP API keys; the Exchange API is for institutional clients and needs a Coinbase Exchange account to get a key at all. Pro let a retail account use the institutional-shaped API. Nothing does that now.

If what you had was public market data. Coinbase Exchange API is the shortest path on this page and first on the list for that reason. It is the same engine behind a new host: the paths you called on api.pro.coinbase.com, the response shapes your parser expects, and the websocket subscribe protocol, including the order-by-order book, all answer on api.exchange.coinbase.com and ws-feed.exchange.coinbase.com, without a key. For a script that only ever read data, this is a host change and a test run. Read that card's licence section before shipping: the data is free to call and barred from redistribution.

If what you had was a retail trading script. The successor Coinbase built for you is the Advanced Trade API, which this catalogue does not card — we list data and tooling, not places to trade. It is not a renamed Pro API. Orders go to api.coinbase.com/api/v3/brokerage with a nested order_configuration body, requests are signed with a short-lived JWT, and the websocket is a different protocol with different channels. Rather than writing that client yourself, CCXT carries it: in the current CCXT tree the coinbase id is Advanced Trade with JWT signing, coinbaseexchange is the institutional API, and there is no coinbasepro id left. If your script already went through CCXT's old Pro id, the change is the id and the credentials; if it called Pro directly, CCXT is a rewrite of your client layer onto something somebody else keeps current.

If what you had was a market-making bot. Hummingbot lists Coinbase Advanced Trade among its spot connectors. It is a framework rather than a library, so this is the most work on the list if your bot was your own code — and the least ongoing work if what you really want is for the next Coinbase auth change to be somebody else's problem.

If you are institutional and write C++. ccapi already targets the Exchange hosts — REST at api.exchange.coinbase.com, websocket at ws-feed.exchange.coinbase.com and an Exchange FIX gateway — so a team holding Exchange keys gets market data and order entry without porting a Pro-era client. Without an Exchange account its Coinbase order entry is of no use to you.

What is not on the list. Moving venue — to Binance, Bybit or OKX, all of which have cards — is a reasonable decision and not a replacement for Coinbase's book, its USD pairs or its regulatory position. If you were reading Pro because it was the US reference price, another venue's tape is a different price.

What you give up

A retail key on the institutional API. This is the real loss and it does not come back. A Pro key gave an individual the Exchange API's order model, its authenticated feeds and a FIX gateway. Coinbase lists REST, websocket and SDKs as Advanced Trade's interfaces — no FIX among them — and its public websocket has no order-by-order channel: level2 is the deepest book it streams. The full book is still free to read on the Exchange feed; trading against it with the institutional API needs an institutional account.

A test environment beyond request shapes. Pro's sandbox ran on hosts of its own, and its REST host still answers today (see below). Advanced Trade's sandbox at api-sandbox.coinbase.com is, in Coinbase's words, static — "all responses are mocked", and only account and order endpoints exist there. It tests that your request is well-formed, not that your strategy behaves. The Exchange API still documents a sandbox of its own, but it belongs to that API and to the accounts that can use it.

A signature you can write in ten lines. Pro signed each request with an HMAC-SHA256 of timestamp, method, path and body under a base64 secret, plus a passphrase header. Advanced Trade wants an ES256 JWT built from a PEM-encoded EC private key, a fresh one for every request, valid for two minutes. That means a JWT library and a key file where there used to be a string, and Coinbase's own SDK notes say Ed25519 keys are not supported by its app SDKs even though the key creation screen offers them.

One response shape across data and trading. On Pro, a candle from the public endpoint and a fill from the private one came from the same API family. Now public data is cheapest from the Exchange API and trading is on Advanced Trade, which also has public market endpoints of its own, in a different shape. A codebase that used to talk to one Coinbase API now talks to two, or picks one and accepts its limits.

Migration notes

Only the market-data path is a port. Everything that signs a request is a rewrite, and should be planned as one.

• The host map. api.pro.coinbase.com becomes api.exchange.coinbase.com for data and Exchange trading, or api.coinbase.com/api/v3/brokerage for Advanced Trade. ws-feed.pro.coinbase.com becomes ws-feed.exchange.coinbase.com, or advanced-trade-ws.coinbase.com for public Advanced Trade channels and advanced-trade-ws-user.coinbase.com for your own orders. The Pro FIX hosts moved to the Exchange FIX gateways, and the Exchange's own FIX 4.2 order-entry gateway was deprecated on 3 June 2025, so FIX code may need two hops, not one.
• A health check that lies. api.pro.coinbase.com/time still answers 200 with the server clock. A liveness probe that pings it reports a healthy dependency while every real call returns 503. Probe the endpoint you actually use.
• A sandbox that lies the other way. As of 4 October 2026 the old Pro sandbox REST host, api-public.sandbox.pro.coinbase.com, still returns products and tickers, while production Pro returns 503. A test suite pointed at the sandbox stays green against an API that no longer exists in production. Its websocket host fails like production's does.
• The websocket failure is not a close frame. ws-feed.pro.coinbase.com dies at the HTTP handshake with a 530. A client written to reconnect on close or on error, with no backoff, will spin.
• Candle shapes differ between the two successors. The Exchange API returns candles as arrays of numbers in the order [time, low, high, open, close, volume], granularity in seconds, at most 300 per call — the Pro shape, unchanged. Advanced Trade returns {"candles":[{"start":…,"low":…,"high":…,"open":…,"close":…,"volume":…}]} with every value a string, granularity as an enum such as ONE_MINUTE or ONE_HOUR, and up to 350 per call. The array order, with low before high before open, is the classic place a hand-written converter swaps two columns.
• Advanced Trade's public REST is cached. Coinbase documents a one-second cache on the public market endpoints; for live data it points you at the websocket, a cache-control: no-cache header, or the authenticated product endpoints. A poller ported from Pro can read the same second twice and think the market stood still.
• Advanced Trade's websocket changes kind. One channel per subscribe message, a subscribe required within five seconds or the server disconnects you, most channels closing after 60–90 quiet seconds unless you also subscribe to heartbeats, trades batched over 250 ms, and candles only in five-minute buckets. -USDC product ids on public channels return the -USD product's data, so a USDC-pair strategy may be reading the USD book without knowing it.
• Timestamps in auth. Exchange signatures still use a CB-ACCESS-TIMESTAMP in seconds that must be within 30 seconds of server time. Advanced Trade's JWT expires after two minutes and must not be reused across requests. A process that caches one token and reuses it fails after the first call, not after two minutes.
• Product ids carry over. Both successors use the same BTC-USD form Pro did, which is the one thing in this migration that does not need a mapping table.

The rest of the field is in Crypto Market Data APIs.