Skip to main content

​
Summary

Coinbase is moving international derivatives off INTX onto Deribit-backed endpoints, with cutover coming soon. INTX trading ends at cutover — migrate your integration before then to keep trading. You already authenticate with Coinbase CDP API keys or OAuth2, and those credentials carry over unchanged — no new keys to issue, no new end-user consent. To migrate, repoint to the new endpoints and add a single public/auth token-exchange call. The protocol moves from INTX REST to JSON-RPC 2.0 over HTTP and WebSocket. The Technical Migration Guide is the full reference — protocol, base URLs, symbology, order types, and endpoint mapping. This guide covers what’s specific to you as an INTX partner.

​
What changes

​
Endpoints and URLs

The new surface speaks JSON-RPC 2.0 over both HTTP and WebSocket. WebSocket is the recommended transport for trading. One endpoint serves both trading and market data on the new surface, unlike INTX where market data is a separate socket.

​
Authentication

Your users authenticate with their existing Coinbase credentials — either a CDP API key or OAuth2 — by calling public/auth to obtain a Deribit access token (HTTP) or an authenticated session (WebSocket). No new credentials, no new end-user consent. Tokens — the following tokens are used in the authentication flows:
Authenticate over the transport you will use: an HTTP token cannot authenticate a WebSocket, and vice versa.

​
API Keys - Private Access Sequence

CDP API key HTTP authentication flow
  • You create a JWT, no round-trip to Coinbase. See creating a JWT.
  • It lasts only ~120s, use a fresh JWT for every public/auth call.
  • You need to provide the Deribit access token on each private method call.
  • Refresh the Deribit access token every 15 minutes.

​
OAuth2 - Private Access Sequence

OAuth2 HTTP authentication flow
  • Retrieve an OAuth2 access token from POST login.coinbase.com/oauth2/token.
  • It expires in 60 mins, use an unexpired OAuth2 access token with every public/auth call.
  • You need to provide the Deribit access token on each private method call.
For OAuth there are 2 separate refresh cycles:
  • Refresh the Deribit access token every 15 minutes.
  • Refresh the OAuth2 access token every 1 hour. POST login.coinbase.com/oauth2/token with grant_type=refresh_token and your refresh token; you get back a new access and refresh token.

​
Notes

  • On WebSocket, the connection is the credential. public/auth returns no token — private method calls are authorized by the authenticated socket itself. Re-send public/auth on the same socket to extend. If the socket drops, you’ll need to re-authenticate from scratch.
  • Request offline_access to get a refresh token (OAuth2). Coinbase only issues a refresh token if the offline_access scope was in your authorize request. Without it, the 1-hour access token cannot be refreshed and the user must re-authorize. See OAuth2 scopes and access & refresh tokens.
  • CDP keys can use Ed25519 or ECDSA algorithms. Ed25519 is recommended and works with direct API calls. ECDSA keys are only required for legacy / third party SDKs.
  • Send public/auth as a POST so credentials stay out of the URL. Deribit accepts public/auth over both GET and POST; use POST so the CDP JWT or OAuth2 access token travels in the request body, not the query string — keeping it out of URLs, browser history, and access logs. See OAuth2 security best practices.

​
Migration Checklist

The INTX to Deribit migration steps:
1

Repoint base URLs

https://drb.coinbase.com/api/v2 (REST) and wss://drb.coinbase.com/ws/api/v2 (WebSocket).
2

Add the token-exchange call

public/auth with the coinbase_cdp or coinbase_oauth2 grant (see Authentication).
3

Restructure to JSON-RPC 2.0

{jsonrpc, method, params, id} envelope.
4

Re-map your endpoints

Replace each INTX REST path with its Deribit equivalent (see the endpoint mapping in the Technical Migration Guide).
5

Update symbology

{BASE}-PERP-INTX → {BASE}_USDC-PERPETUAL (discover exact names via public/get_instruments).
6

Deribit Advanced Trading gateway is live

Cutover is coming soon, no parallel run. Repoint production traffic.

​
Help