Coinbase Configuration
appsettings.json, credentials, and registration for both Advanced Trade and Server Wallet
Advanced Trade
appsettings.json
Advanced Trade reads its API origin from a CoinbaseAdvancedTrade section, bound lazily against IConfiguration:
"CoinbaseAdvancedTrade": {
"BaseURL": "https://api.coinbase.com"
}| Key | Type | Required | Description |
|---|---|---|---|
BaseURL | text | No | Bare API origin. Defaults to https://api.coinbase.com. Deliberately does not include the /api/v3/brokerage path — HttpClient discards a BaseAddress's path whenever the relative request URI starts with / (every path here does), so the versioned prefix is applied explicitly by CoinbaseAdvancedTradeApiClient instead. |
Credential
A single vault credential, referenced by the standard credentialId config key on every operation, resolved via ReadCredentialKeyValuePrimaryAsync:
| Field | Description |
|---|---|
| Key ID (username) | The CDP API Key ID. |
| Private key (password) | The matching EC (P-256) private key material, used to sign each request's CDP auth JWT (hand-rolled ES256 signer, no external JWT package). |
Server Wallet
appsettings.json
"CoinbaseServerWallet": {
"BaseURL": "https://api.cdp.coinbase.com"
}| Key | Type | Required | Description |
|---|---|---|---|
BaseURL | text | No | Bare API origin. Defaults to https://api.cdp.coinbase.com. Same path-stripping reasoning as Advanced Trade — the versioned /platform/v2 prefix is applied explicitly by CoinbaseServerWalletApiClient. |
Unconfirmed REST paths: the exact CDP REST paths and the
X-Wallet-Auth JWT claim shape were not independently re-verified against live CDP docs in the design pass. See Roadmap.
Dual Credential
Server Wallet needs two independent vault credentials, because Coinbase's own TEE — not this node — holds the blockchain private key:
| Config Key | Credential Type | Description |
|---|---|---|
credentialId | CDP API Key | Same Key ID + EC P-256 private key pair as Advanced Trade, resolved the same way (ReadCredentialKeyValuePrimaryAsync). |
walletSecretCredentialId | Wallet Secret | A second, independently-configured vault entry holding a single opaque string — the CDP Wallet Secret. Registered internally under a "walletSecret" alias via a RegisterCredentialsFromConfig override, the same flat-picker mechanism the framework's destinationCredentialID pattern uses for dual-endpoint operations. |
Which operations need the Wallet Secret? Every fund-moving operation (
transfer/*, swap/execute) requires it — confirmed. Five more operations (account/requestFaucet, solanaAccount/requestFaucet, policy/create, policy/update, policy/delete) also require it today under a fail-closed policy, because their live requirement wasn't independently confirmed against CDP docs at design time — see each resource page for the exact marker.
Registration (both variants)
Each variant ships its own INodeExecutorDependency:
CoinbaseAdvancedTradeDependency.RegisterDefaults(services)— registers the named HTTP client (rate-limit handler chained on), the JWT signer + API client (Singleton, credential-free), the 7 resource services, the executor (Scoped), and theExecutorRegistryentry forcoinbase-advanced-trade.CoinbaseServerWalletDependency.RegisterDefaults(services)— same shape, registering theExecutorRegistryentry forcoinbase-server-wallet.
A ProjectReference alone does not register either node. The composition root (
BizFirst.Ai.Platform.Web.Server.Core/DependencyInjection/Ai/ServiceCollectionExtensionsForAI.cs, Plugins_RegisterAllNodes()) is a hardcoded list of new {X}Dependency().RegisterDefaults(services) calls. Both new CoinbaseAdvancedTradeDependency().RegisterDefaults(services); and new CoinbaseServerWalletDependency().RegisterDefaults(services); must be added there or the node types won't appear in the workflow designer even though the packages are referenced.
Project Layout
Six .NET projects in total — three per variant, following the same Domain / Services / ExecutionNode split used across this codebase:
| Project | Responsibility |
|---|---|
BizFirst.Integration.CoinbaseAdvancedTrade.Domain | Pure data contracts — shared value types and per-operation result records (Ok(...)/Fail(errorCode, errorMessage) convention). No logic, no I/O. |
BizFirst.Integration.CoinbaseAdvancedTrade.Services | HTTP integration layer: API client, CDP auth JWT signer (hand-rolled ES256), 429 rate-limit handler, error mapper, and the 7 resource services. |
BizFirst.Ai.ExecutionNodes.Blockchain.CoinbaseAdvancedTrade | The executor — operation routing, config parsing, credential resolution, one feature partial per operation. |
BizFirst.Integration.CoinbaseServerWallet.Domain | Pure data contracts for CDP Server Wallet v2 — same conventions as the Advanced Trade Domain project. |
BizFirst.Integration.CoinbaseServerWallet.Services | HTTP integration layer: dual-JWT API client, dual JWT signer, 429 handler, error mapper, and the 7 resource services. |
BizFirst.Ai.ExecutionNodes.Blockchain.CoinbaseServerWallet | The executor — dual-credential resolution, operation routing, one feature partial per operation. |