Coinbase API Key
Detects Coinbase Developer Platform (CDP) API key names, which use the distinctive resource-path form organizations/{org-uuid}/apiKeys/{key-uuid}. This key name is paired with an EC/ECDSA (or Ed25519) signing secret and is used to mint ES256 JWTs for the Coinbase API. A leaked CDP key can grant programmatic access to accounts, trading and funds. The associated EC PRIVATE KEY PEM secret is detected separately by global-ec-private.
- Type
- regex
- Engine
- universal
- Confidence
- high
- Confidence justification
- High confidence: the literal organizations/.../apiKeys/... path carrying two UUIDs is a Coinbase-specific structure that does not collide with ordinary identifiers, so the value is reliable on its own; corroborative Coinbase/credential keywords further raise precision.
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, SOC 2
- Data categories
- credentials, security
- Scope
- narrow
- Risk rating
- 9
- Platform compatibility
- Purview: Compatible, GCP DLP: Unsupported, Macie: Unsupported, Zscaler: Compatible, Palo Alto: Unsupported, Netskope: Unsupported
Pattern
(?<![A-Za-z0-9])organizations/[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}/apiKeys/[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}(?![A-Za-z0-9])Corroborative evidence keywords
coinbase, cdp, coinbase developer platform, api key, api_key, key_name, private key, ec private key, jwt, apikey, access key, access token, auth token, authorization, bearer, conn str, connection string, connectionstring, cookie, credential (+15 more)
Proximity: 300 characters
Should match
organizations/00000000-0000-0000-0000-000000000000/apiKeys/11111111-1111-1111-1111-111111111111— CDP key name with zero-entropy placeholder UUIDs (org + apiKey)key_name = organizations/aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee/apiKeys/12345678-1234-5678-1234-567812345678— Labelled CDP key name in an assignment, repeated-letter and sequential filler UUIDs"organizations/abcdef01-2345-6789-abcd-ef0123456789/apiKeys/00112233-4455-6677-8899-aabbccddeeff"— Quoted CDP key name with sequential-hex filler UUIDs
Should not match
organizations/00000000-0000-0000-0000-000000000000/keys/11111111-1111-1111-1111-111111111111— Wrong path segment (keys instead of apiKeys)organizations/0000-0000-0000-0000-000000000000/apiKeys/11111111-1111-1111-1111-111111111111— Malformed org UUID (4 hex in first group instead of 8)create a coinbase cdp api key under your organizations settings— Prose mention with the word organizations but no key-name value
Known false positives
- The literal word organizations followed by unrelated UUIDs (e.g. an unrelated resource path) could in principle resemble the structure. Mitigation: The pattern requires the exact organizations/.../apiKeys/... two-UUID path; require corroborative Coinbase/credential keywords for the highest-precision alerting.
- Documentation or examples showing placeholder organizations/.../apiKeys/... strings. Mitigation: Check for placeholder markers (example, 0000, xxxx) and require Coinbase context.