Coinbase Advanced Trade API vs dYdX

Coinbase Advanced Trade API 20

No machine payment protocol on the API (0). The fee schedule answered a bot check on 3 November 2026, so no per-trade price was read, and the docs give none (0 of 20, unchecked). Six public market endpoints and the sandbox need no key or card (20). A person signs up, passes verification and mints a key in the portal (0). 0 + 0 + 20 + 0 = 20.

dYdX 60

No machine payment protocol (0). Fees public per tier without login (20). Testnet with a faucet and no card anywhere (20). No signup; an agent with a funded wallet trades, subject to the geographic terms (20). Total 60.

Coinbase Advanced Trade API 57

Read as a closed hosted service. The last change to the API itself is the Global Derivatives gateway and INTX retirement of 1 October 2026, 33 days before this check; the Python SDK's v2.0.0rc1 is from 30 September (20 of 30). Dated changes in 90 days are the 1 October migration and the agents entries of 17 and 21 August, which run through Advanced Trade (12 of 20). A public changelog and a CDP Discord; SDK issues not read (8 of 15). Official Python SDK current, the rest samples (12 of 15). SDK CI not read (5 of 10). 20 + 12 + 8 + 12 + 5 = 57.

dYdX 83

Read on the clients and the chain. v4-clients was pushed on 29 October 2026 and protocol v9.8.0 shipped on 12 October (30). Protocol v9.7 on 11 September, v9.8.0 on 12 October, v4-client-js tags 3.5.0 and 3.6.0, three or more in 90 days (20). A Discord, a help centre and 36 open issues on v4-clients whose replies couldn't be read (12 of 25). Official SDKs current, the TypeScript client at 3.6.0 and the Python client at 1.1.6 from February 2026 (12 of 15). CI workflows for lint, test, publish and audit, with trusted publishing and provenance on npm (9 of 10). Total 83.

Coinbase Advanced Trade API 58

Read with the hosted lines. status.coinbase.com is a Statuspage site with Coinbase Advanced Trade, API, US Derivatives and International Derivatives components (20). The incidents feed we could read runs from 16 September to 3 November 2026. In it Advanced Trade was degraded for 25 minutes on 21 September, the website had a 3-minute major on 14 October, converts were down 1 hour 4 minutes on 26 October, and no incident named the API; 5 August to 15 September was beyond the feed, so minor only for the seven weeks read (15 of 30). No REST rate limit with numbers was found; the older rate-limits page answers 404 and llms.txt lists none, while the WebSocket page gives 8 connections and 8 unauthenticated messages per second per IP (5 of 15). Orders take a client_order_id, but no 429 or Retry-After guidance was found for Advanced Trade (8 of 15). No SLA (0). REST and WebSocket are generally available; the Global Derivatives gateway is a month old and not marked beta (10). 20 + 15 + 5 + 8 + 0 + 10 = 58.

dYdX 83

Read with the hosted lines on the indexer API and the chain endpoints the clients submit to. status.dydx.trade is an Atlassian Statuspage with Frontends, dYdX Chain, Indexer, Order Gateway and Client Libraries components and an RSS history (20). From 1 August to 3 November 2026 the feed has eight items, seven scheduled maintenance windows of 29 minutes to 2 hours (indexer on 9 September, 8 and 15 October, protocol v9.7 on 11 September and v9.8.0 on 12 October, WebSocket compression on 26 and 28 October) and one degraded instant-deposit path through an onboarding partner from 24 to 29 September, outside the trading API. Clean or trivial (30). Rate limits documented with numbers for the indexer, the block limits and the public nodes (15). No 429 shape or Retry-After for the indexer; short-term orders expire by goodTilBlock and client IDs let an agent find an order after a timeout (8 of 15). No SLA (0). Mainnet generally available; the Order Entry Gateway is marked testnet-only (10). 20 + 30 + 15 + 8 + 0 + 10 = 83.

Coinbase Advanced Trade API 80

Public OpenAPI 3.1 spec (45 paths, 51 operations) and an AsyncAPI document (25). llms.txt and a Markdown twin of every docs page (10). Every operation has a summary and description, some one line, several with multi-sentence guidance for equities (14 of 20). Enums on product_type, granularity, order_status, time_in_forces, order_types, order_side and sort_by, with defaults (13 of 15). Examples in the docs and the sandbox's simulated errors, but the spec documents only a default error referencing grpc.gateway.runtime.Error, with no 4xx or 429 shapes (8 of 15). Paths carry /api/v3, the CDP changelog is dated, and the INTX retirement was announced with a date, but the spec's info.version is 0.1 and the October gateway change has no changelog entry (10 of 15). 25 + 10 + 14 + 13 + 8 + 10 = 80.

dYdX 58

No OpenAPI file found for the indexer; the docs publish a types reference of about 200 pages (OrderSide, TimeInForce, OrderStatus and the rest) and the chain's protobuf messages are in the clients (8 of 25). llms.txt and Markdown docs (10). Endpoint pages describe each call and the guides say when to use short-term against long-term orders and the indexer against the node, but descriptions are short (12 of 20). Enums and types on every field in the reference, with pagination and cursor parameters typed (11 of 15). Examples in Python, TypeScript and Rust for each step; errors are described by HTTP status (400 malformed, 404 not found) with no code list (9 of 15). A /v4 path, protocol releases dated on the status page, deprecated rate-limit fields marked, but no API changelog (8 of 15). Total 58.

Coinbase Advanced Trade API 67

The editorial half. A closed service whose user agreement answered a bot check; the OpenAPI spec is public and the Python SDK is open on GitHub (12 of 30). Privacy facts per the coinbase-cdp-agentkit check of 1 October 2026 (Coinbase, Inc., processing countries, retention tied to need without numbers), not re-read (10 of 30). INTX endpoints retired on 1 October 2026 with a dated notice and a read-only grace period (12 of 20). Processing countries and provider categories per the same earlier check, no subprocessor list (8 of 20). 12 + 10 + 12 + 8 = 42.

dYdX 50

The editorial half. Clients AGPL-3.0 with a terms-bound use condition, the chain under a custom licence, two terms documents (dYdX Trading Inc.'s v4 terms of 12 March 2026 and dYdX International Ltd's of 6 June 2025) that are clear about who runs nothing (22 of 30). The privacy policy of 6 June 2025 names dYdX International Ltd, keeps technical data until no longer necessary with no periods, and names no subprocessors; nothing covers the unnamed indexer operator (12 of 30). Protocol upgrades and the WebSocket compression change were posted as dated maintenance notices, deprecated rate-limit fields are marked, but no deprecation policy or notice period is stated (10 of 20). The policy says data may be processed in the EEA and elsewhere, with no subprocessor list (6 of 20). Total 50.

Coinbase Advanced Trade API 68

CDP keys with view, trade and transfer permissions, a portfolio restriction, an optional IP allowlist, revocation in the portal, ES256 JWTs that expire after 2 minutes, and OAuth2 with wallet:* scopes for other people's accounts; no key expiry (28 of 30). View-only keys and portfolio scoping limit an agent, and transfer is a separate permission, but no withdrawal address allow-list for API keys and no confirmation step were found (14 of 20). The API returns no untrusted content (10). key_permissions reports a key's scope and account activity shows in the app, but no per-call log was found (6 of 15). HackerOne bug bounty named in a security.txt that expired on 1 June 2024; certifications unread behind a bot check (10 of 20). 28 + 14 + 10 + 6 + 10 = 68.

dYdX 78

Orders are signed by the account key or by a permissioned key the owner adds as an authenticator, limited by message type, subaccount and market with AllOf or AnyOf, and revoked by remove_authenticator; no shared secret and nothing in a URL (28 of 30). A key can be confined to placing and cancelling orders on one subaccount with withdrawals and transfers excluded, though not to a position or order size, and the interface's default API wallet trades all cross-margin pairs (16 of 20). The API returns no untrusted content (10). Every action is a chain transaction and the indexer lists fills, orders and transfers per subaccount, and authenticators can be listed; no per-key log (10 of 15). A Cantina bug bounty up to $1,000,000 sponsored by dYdX Trading Inc. over the protocol, indexer, web client and SDKs, an Informal Systems audit; no security.txt and no certification (14 of 20). Total 78.