# Coinbase Advanced Trade API vs Kraken API (slim)

> Kraken scores 71 (BB) to Coinbase Advanced Trade's 61.7 (C) for exchange spot trading. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/coinbase-advanced-trade-vs-kraken.md (~4,850 tokens) · this version ~2,530 tokens · JSON https://www.anchorterminal.com/compare/coinbase-advanced-trade-vs-kraken.json · canonical https://www.anchorterminal.com/compare/coinbase-advanced-trade-vs-kraken
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-04
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Kraken API scores 71 (BB) on agent readiness against Coinbase Advanced Trade API's 61.7 (C), and leads in 5 of 7 scored categories. Both do exchange spot trading.

- Coinbase Advanced Trade API: C 61.7, rank #537 of 1349 · https://www.anchorterminal.com/tools/coinbase-advanced-trade.min.md
- Kraken API: BB 71, rank #159 of 1349 · https://www.anchorterminal.com/tools/kraken.min.md
- Coinbase Advanced Trade API, good for An agent trading a person's or a treasury's Coinbase account with its own key, where the person wants sandbox tests and portfolio scoping.
- Kraken API, good for An agent that trades spot, xStocks, forex or futures on a person's Kraken account from a local machine, with paper trading to test first and an approval gate on live orders. Ahead on Reliability, 67 against 58; Agent ergonomics, 79 against 73; Security & auth, 80 against 68; Payments & pricing, 40 against 20; Maintenance & community, 81 against 57. Also Agent-ready, a grade of BB or better; Runs on your own machine.

| Category | Coinbase Advanced Trade API | Kraken API |
| --- | --- | --- |
| Reliability (16%) | 58 | 67 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 80 | 80 |
| Agent ergonomics (13%) | 73 | 79 |
| Security & auth (14%) | 68 | 80 |
| Payments & pricing (10%) | 20 | 40 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 57 | 81 |
| Transparency & trust (7%) | 67 | 65 |

| Fact (where they differ) | Coinbase Advanced Trade API | Kraken API |
| --- | --- | --- |
| Vendor | Coinbase, Inc. | Payward, Inc. |
| Transports |  | stdio |
| Licence | Proprietary hosted service under the Coinbase User Agreement, which answered a bot check and wasn't read. The official Python SDK coinbase-advanced-py is on GitHub | Proprietary hosted service under Kraken's Global Terms of Service (30 October 2026). kraken-cli, which carries the kraken-mcp server, is MIT |
| Tools exposed | none | 152 |
| Last release | 2026-10-01 | 2026-10-29 |
| Terms last updated | couldn't be read | 2026-10-30 |
| Privacy policy last updated | 2026-05-27 | 2026-10-21 |
| Customer content may train models | couldn't be read | not found in the text |
| Terms restrict automated access | couldn't be read | yes |
| Terms restrict benchmarking | couldn't be read | yes |
| Terms or service can change without notice | couldn't be read | yes |
| Arbitration or class-action waiver | couldn't be read | yes |
| Popularity | none | 795 stars |

Why the edge:
- Maintenance & community, Kraken API +24: Coinbase Advanced Trade API 57 (Read as a closed hosted service. The last change to the API itself is the Global Derivatives gateway and INTX retirement of 1 October 2026, 33 days before this check; the Python SDK's v2.0.0rc1 is from 30 September (20 of 30). Dated changes in 90 days are the 1 October migration and the agents entries of 17 and 21 August, which run through Advanced Trade (12 of 20). A public changelog and a CDP Discord; SDK issues not read (8 of 15). Official Python SDK current, the rest samples (12 of 15). SDK CI not read (5 of 10). 20 + 12 + 8 + 12 + 5 = 57.); Kraken API 81 (Read as a closed service with an open-source client. Changelog entry of 27 October 2026 and kraken-cli v0.5.1 on 29 October (30). Fourteen changelog entries since 19 August 2026 and CLI tags on 6 and 7 August and 28 and 29 October (20). A public changelog, api@kraken.com, a status page and a CLI repository merging pull requests at the end of October; issue replies not read (11 of 15). An official Rust SDK pushed in October 2026 and a Go module from January; the MCP server is not in the official registry (12 of 15). The CLI has release and secure SDLC workflows, deny.toml and a pinned toolchain; the SDK's CI not read (8 of 10). 30 + 20 + 11 + 12 + 8 = 81.)
- Payments & pricing, Kraken API +20: Coinbase Advanced Trade API 20 (No machine payment protocol on the API (0). The fee schedule answered a bot check on 3 November 2026, so no per-trade price was read, and the docs give none (0 of 20, unchecked). Six public market endpoints and the sandbox need no key or card (20). A person signs up, passes verification and mints a key in the portal (0). 0 + 0 + 20 + 0 = 20.); Kraken API 40 (No machine payment protocol (0). Maker and taker fees by tier published without login (20). Public market data, paper trading and the futures demo need no account or card (20). A person signs up, verifies and mints a key or approves the OAuth sign-in (0). 0 + 20 + 20 + 0 = 40.)
- Security & auth, Kraken API +12: Coinbase Advanced Trade API 68 (CDP keys with view, trade and transfer permissions, a portfolio restriction, an optional IP allowlist, revocation in the portal, ES256 JWTs that expire after 2 minutes, and OAuth2 with wallet:* scopes for other people's accounts; no key expiry (28 of 30). View-only keys and portfolio scoping limit an agent, and transfer is a separate permission, but no withdrawal address allow-list for API keys and no confirmation step were found (14 of 20). The API returns no untrusted content (10). key_permissions reports a key's scope and account activity shows in the app, but no per-call log was found (6 of 15). HackerOne bug bounty named in a security.txt that expired on 1 June 2024; certifications unread behind a bot check (10 of 20). 28 + 14 + 10 + 6 + 10 = 68.); Kraken API 80 (Keys with nine named permissions, optional expiry, IP restriction and nonce window, plus an OAuth sign-in from the CLI (authorisation code with PKCE, public client) that mints a no-withdrawal key expiring within 90 days or a read-only key (30). Read-only and no-withdrawal keys, position limits and pair allowlists in account settings, and MCP approval prompts for 33 dangerous tools (18 of 20). The API returns no untrusted content; the CLI docs warn that the feedback tool uploads a local file without approval (10). Keys and their permissions are listed in settings and ledgers record activity, but no per-call log for the operator was found (6 of 15). A valid security.txt, a bug bounty policy page, SECURITY.md and a secure SDLC workflow in the CLI; certifications not read (16 of 20). 30 + 18 + 10 + 6 + 16 = 80.)
- Reliability, Kraken API +9: Coinbase Advanced Trade API 58 (Read with the hosted lines. status.coinbase.com is a Statuspage site with Coinbase Advanced Trade, API, US Derivatives and International Derivatives components (20). The incidents feed we could read runs from 16 September to 3 November 2026. In it Advanced Trade was degraded for 25 minutes on 21 September, the website had a 3-minute major on 14 October, converts were down 1 hour 4 minutes on 26 October, and no incident named the API; 5 August to 15 September was beyond the feed, so minor only for the seven weeks read (15 of 30). No REST rate limit with numbers was found; the older rate-limits page answers 404 and llms.txt lists none, while the WebSocket page gives 8 connections and 8 unauthenticated messages per second per IP (5 of 15). Orders take a client_order_id, but no 429 or Retry-After guidance was found for Advanced Trade (8 of 15). No SLA (0). REST and WebSocket are generally available; the Global Derivatives gateway is a month old and not marked beta (10). 20 + 15 + 5 + 8 + 0 + 10 = 58.); Kraken API 67 (Read with the hosted lines on the spot API. status.kraken.com is a Statuspage site with REST, WebSocket and FIX components (20). The incidents feed read covers 4 September to 3 November 2026. On 30 October spot and derivatives clients could not connect or submit orders across web, mobile, REST, WebSocket and FIX for 59 minutes 39 seconds, rated minor by Kraken; on 28 October some FIX clients were rejected on reconnection for 1 hour 59 minutes while other interfaces worked; the futures engine was degraded for 3 minutes on 13 October. A whole-exchange order outage 21 seconds short of an hour is read as one major (10 of 30). Numeric limits per key by tier and per pair for the matching engine (15). EAPI:Rate limit exceeded and EService:Throttled with a retry timestamp, a client order id and a validate flag on orders, but no Retry-After header (12 of 15). No SLA (0). Generally available (10). 20 + 10 + 15 + 12 + 0 + 10 = 67.)
- Agent ergonomics, Kraken API +6: Coinbase Advanced Trade API 73 (Product lists filter by product_type and product_ids with limit and offset, candles take a granularity, but fields cannot be selected and the docs warn that product lists run to hundreds of entries (15 of 25). Cursor pagination with limit on orders and fills, filters by status, product and time (16 of 20). Error codes such as INSUFFICIENT_FUND, ORDER_NOT_FOUND and PERMISSION_DENIED are documented and can be simulated in the sandbox, though the spec gives no shapes (14 of 20). client_order_id on every order; no idempotency key on other writes (16 of 20). Few required fields, an official Python SDK and sample SDKs in three languages, but each request needs a freshly signed JWT (12 of 15). 15 + 16 + 14 + 16 + 12 = 73.); Kraken API 79 (The MCP server loads services with -s, defaults to no live trading, and its 152 tool definitions average about 520 characters; the REST API takes count, limit and pair filters but has no field selection (18 of 25). Cursor pagination on ledgers and trades since 30 September and 6 October 2026, with ofs deprecated (17 of 20). Prefixed error strings such as EOrder:Rate limit exceeded and EAPI:Invalid nonce, and the CLI's error catalogue says which to retry (17 of 20). cl_ord_id and validate on orders, destructive_hint and elicitation on dangerous MCP tools, no idempotency key on REST (16 of 20). An official Rust SDK at 5 stars, a Go module and example clients, HMAC-SHA512 signing with a strict nonce (11 of 15). 18 + 17 + 17 + 16 + 11 = 79.)