Coinbase toolkit: CDP ECDSA connection marked Active but private account calls 401

[human-regen8]

Summary

Connecting Coinbase via Composio For You MCP (https://connect.composio.dev/mcp) with a Coinbase Developer Platform ECDSA secret API key succeeds (connection status ACTIVE), but every private/account call returns 401 Unauthorized. Public market data works.

This looks like an auth-scheme mismatch: the Connect Link accepts CDP ECDSA keys, while COINBASE_LIST_WALLETS and the toolkit proxy sign Coinbase App v2 / Exchange account endpoints that those keys cannot authorize.

Environment

• Client: Grok custom MCP connector → https://connect.composio.dev/mcp (Composio For You)
• Toolkit: coinbase
• Auth type: API_KEY (CDP Secret API key, ECDSA / ES256)
• Key permissions: view only (no trade, no transfer)
• IP allowlist: empty
• Key name format: full organizations/{org_id}/apiKeys/{key_id} + PEM BEGIN EC PRIVATE KEY
• Connection alias: coinbase-view
• Connected account: ca_MKNoL9Lbw1c9 / coinbase_spank-scove
• Auth config actually bound: ac_-J9hzTQTuysz (Composio default). A user-created Platform auth config ac_uhJc_KZU4dEP was not used by For You MCP.
• Date: 2026-08-23

Reproduction

1. Create a CDP Secret API key at https://portal.cdp.coinbase.com/api-keys/secret
   • Signature algorithm: ECDSA (not Ed25519)
   • Permission: view
   • No IP allowlist
2. Connect Coinbase through For You MCP Connect Link and paste the key name + PEM secret.
3. Connection becomes ACTIVE.
4. Call COINBASE_LIST_WALLETS.
5. Optionally proxy_execute GET /accounts and GET /api/v3/brokerage/accounts on toolkit coinbase.

Actual behavior

Call	Result
COINBASE_GET_SERVER_TIME	200
COINBASE_LIST_MARKET_PRODUCTS / COINBASE_GET_PRODUCT	200
COINBASE_LIST_WALLETS	401 on GET https://api.coinbase.com/v2/accounts
proxy_execute GET /accounts (Exchange)	401 Unauthorized
proxy_execute GET /time	200
proxy_execute GET /api/v3/brokerage/accounts	404 page not found (wrong host)

COINBASE_LIST_WALLETS is documented as “via the CDP SDK” but the live request is Coinbase App GET /v2/accounts. The toolkit proxy appears bound to Coinbase Exchange (GET /time works; GET /accounts 401s with a CDP JWT key).

Expected behavior

Either:

1. Map Coinbase private account/wallet reads to Advanced Trade GET /api/v3/brokerage/accounts (or real CDP Wallet API) and sign with CDP JWT (ECDSA), or
2. Reject CDP ECDSA keys on connect if this toolkit is Exchange HMAC-only, and document that Exchange key + secret + passphrase are required.

Do not mark the connection ACTIVE if stored credentials cannot authorize the toolkit’s private tools.

Composio log IDs

Please inspect these (no secrets in this report):

• log_ytNlmwbTrH8W — COINBASE_LIST_WALLETS 401 on /v2/accounts
• log__T3jHtC3i8zY — proxy GET /accounts 401
• log_RmuwRYqak_DV — proxy Advanced Trade path 404
• log_cD6Ln92zi3fA — connection became ACTIVE (ca_MKNoL9Lbw1c9)
• log_u88fn75cgkMR — public market tools succeeded

Impact

Cannot list wallets or balances through Composio Coinbase. Market data only. For You MCP also does not bind a custom Platform auth config (ac_uhJc_KZU4dEP).

Ask

Please confirm the intended Coinbase auth scheme for this toolkit (CDP JWT vs Exchange HMAC vs Coinbase App v2) and fix COINBASE_LIST_WALLETS / proxy base URL accordingly.

[github-actions]

🤖 Automated Claude triage note: this does not look like an SDK bug, so I've labeled it as support for support team follow-up. Claude cannot reply back in a conversation.

[sohambasu963]

Thanks for the detailed report. We confirmed this is a bug in the current Coinbase toolkit, not a problem with your connection or Coinbase permissions.

COINBASE_LIST_WALLETS does not generate the short-lived CDP JWT that Coinbase requires for private requests, so the connection can appear ACTIVE while private account calls return 401. Reconnecting or changing scopes will not fix this path.

For an immediate workaround, call Coinbase's private API directly with a correctly generated JWT. We do not have a verified ETA for the toolkit correction, but we will update the issue when the signing and endpoint behavior are fixed.