# Leaked Coinbase Access Token? Revoke It Now > Coinbase access token exposed on GitHub? Revoke the app's access, check account activity for transfers and move funds to safety. Step-by-step guide. Source: https://leakwatch.net/secrets/coinbase-access-token --- [LeakWatch](/) [Product](/product)[Live feed](/leaks)[Guides](/secrets)[Blog](/blog)[Free scan](/) 1. [Home](/) 2. [Secrets](/secrets) 3. Coinbase Access Token Payments · Secret guide # Leaked Coinbase Access Token: what to do in the first hour High severityDetected onlyLast verified October 23, 2026 · 6 min read A Coinbase access token lets whoever holds it call the Coinbase API as the account that granted it. What that means in practice depends on the permissions the app asked for when the account authorized it. Read-only access shows balances and transaction history. Broader permissions can place trades or send funds to an address of the attacker’s choosing. Because of that, treat an exposed token as urgent. Revoke it first, then check what it was used for. [Check your GitHub account for leaked secrets — free](/) Provider Coinbase Severity High Impact Payments and customer data Checked live by LeakWatch No ## What a Coinbase access token looks like A Coinbase access token from its OAuth2 integration is a string of 64 characters made of lowercase letters, digits, underscores and hyphens. It has no fixed prefix, so the value on its own tells you very little. Masked, it looks like this: ```text coinbase_access_token=…XXXX Coinbase access token (masked) ``` What identifies it is the context around the value: a setting or variable name that contains `coinbase`, an `Authorization: Bearer` header on a request to a Coinbase endpoint, or a configuration file for an app that connects to a Coinbase account. The 64-character shape alone is shared with plenty of harmless strings, which is why the detection depends on that word being nearby. Access tokens are issued in pairs with a refresh token. Coinbase’s documentation says that revoking the access token also invalidates its paired refresh token, and that access tokens are short-lived, lasting about an hour. A leaked refresh token can still mint new access tokens, so revoking the pair is the goal, not just letting the access token expire. If the same file also holds exchange API keys, wallet secrets or other credentials, handle each one separately. ## How Coinbase access tokens get leaked - **Test scripts with a token pasted in.** A quick script to check balances or history, committed with the value still in it because it was meant to be temporary. - **Bots and sync tools.** Configuration for a trading bot, a portfolio tracker or an accounting sync that stores the token in a YAML or JSON file in the repository. - **Environment files.** A `.env` file that lists the token next to database passwords and other API keys, and was never added to `.gitignore`. - **Verbose logs.** A debug log that prints the full `Authorization` header from a failed request, then gets shared in an issue or a chat thread. - **Notebooks and tutorials.** A notebook where the token was set in a cell to try an endpoint, then published with its output. ## What to do in the first hour 1. **Revoke the token now.** Follow the steps in the revocation section below. Revoking the access token also ends its refresh token, so one successful call closes both. Do this before anything else, because every minute the token stays valid is a minute someone can use it. 2. **Check the account for activity you did not start.** Open your Coinbase transaction and activity history for the period since the exposure. Look for trades, withdrawals and sends to addresses you do not recognize, and for logins from places you do not expect. If you see a transfer you did not make, contact Coinbase support right away and say that the transfer is unauthorized. Do not wait for an automated review. 3. **Review the apps connected to the account.** In the account’s security settings, look at the list of connected apps and remove any that you no longer use or cannot name an owner for. Keep only the connections that the current integrations need. 4. **Issue a replacement only where it is needed.** If the app still has to work, have its owner run the authorization flow again so that a new token is issued. Store the new value in your secret manager or in the app’s environment variables. Never paste it into a file in the repository. 5. **Lock down the login.** Change the account password, turn on two-step verification if it is not already on, and confirm that the recovery email address is one you control. 6. **Check for other secrets next to the token.** Look at the rest of the leaked file and its history for exchange keys, wallet passphrases or seed phrases. A seed phrase or a wallet private key that appeared in a public place is fully compromised, so the funds in that wallet should be moved to a new wallet that you create on a fresh device. 7. **Clean the repository.** Remove the value from the code and, if you want the old copy gone from history, rewrite it. See [I accidentally pushed an API key to GitHub](/blog/i-accidentally-pushed-an-api-key-to-github), and [deep scan your whole git history](/blog/deep-scan-your-whole-git-history) if you want to look for other leaks in past commits. Not sure what else leaked? [Run a free scan](/). [Not sure what else leaked? Run a free scan.](/) ## Revoke it at Coinbase Coinbase’s OAuth2 access tokens are revoked by calling the revoke endpoint of its OAuth service. The call needs the client ID and client secret of the app that issued the token, so in practice the app’s owner or the person who runs the integration does this step. Coinbase’s documentation on [access and refresh tokens](https://docs.cdp.coinbase.com/coinbase-app/oauth2-integration/access-and-refresh-tokens) describes the flow. The revoke endpoint returns the same success response whether or not the token was valid, so do not treat a successful response as proof. Make a test request with the old token afterwards, and expect it to fail. From the account side, the security settings also show which connections can reach the account. Removing the connection there ends that app’s access even if the token is still stored somewhere. If you cannot tell which app the token belongs to, go through the list of connections and remove each one you do not recognize, then reissue the tokens for the apps you keep. You cannot read a token back from Coinbase, so if you no longer have the value, you cannot confirm which token leaked from the account alone; the request test and the connection list are the reliable checks. ## How LeakWatch detects it The rule is called “Coinbase Access Token”. It looks for the word `coinbase`, in any letter case, followed within a short distance by an assignment separator such as `=`, `:` or `=>`, optional quotes or spaces, and then exactly 64 characters made of lowercase letters, digits, underscores and hyphens. The value must end at a quote, whitespace, a semicolon or the end of the line. A 64-character string without the word `coinbase` nearby is not reported. The severity is **high**, and the impact class is payment data, because the token can reach balances and transfers. This type is not checked live: LeakWatch does not send any request to Coinbase with the token it finds. LeakWatch detects this format but does **not** check it live: it can tell you the key is exposed, not whether it still works. Assume it does until you have revoked it. ## FAQ Can someone move my funds with this token? It depends on the permissions that the app requested when the account authorized it. Read-only scopes show balances and history, while broader scopes can place trades or send funds. Check the scopes of the app that issued the token, and assume the worst until you have reviewed the account activity. Does revoking the token also stop the app? Yes. The app loses access and its calls start to fail until someone authorizes it again. Tell the team that owns the integration before you revoke, so the outage is planned and the new authorization is ready. Is two-step verification enough to protect the account? It protects the login, but it does not invalidate a token that already exists. A token that has leaked keeps working until it is revoked, which is why revocation comes first and the account hardening comes after. ## Related - [Stripe secret key](/secrets/stripe-secret-key) - [Paystack Secret Key](/secrets/paystack-secret-key) - [Square Access Token](/secrets/square-access-token) - [I accidentally pushed an API key to GitHub](/blog/i-accidentally-pushed-an-api-key-to-github) - [Which vendors leak most this week](/leaks/trends) - [All secret guides](/secrets) [Get alerted next time a secret leaks — create a free account](/) LeakWatch is not affiliated with Coinbase. ![Gabriel Diyan, founder of LeakWatch](/brand/Photo-Gabriel-Diyan.webp) Gabriel Diyan (0xCr0c0) Cybersecurity student, founder of LeakWatch. I built and run the scanner described here — the detection patterns, the false-positive classifier and the provider validators are mine. [More about who I am](/about). [GitHub](https://github.com/Leakwatch-Scan) · [X](https://x.com/LeakwatchScan) · [LinkedIn](https://www.linkedin.com/in/gabriel-diyan-80a378375) · [GitHub (personal)](https://github.com/crocogab) LeakWatch Secrets leak into public commits every minute. This watches the forges for yours. Built and run by [Gabriel Diyan](/about), a cybersecurity student — [why LeakWatch exists](/about). Scan - [Product](/product) - [Live feed](/leaks) - [Trends](/leaks/trends) - [API docs](/docs) - [CI/CD](/docs?tab=ci) Read - [Blog](/blog) - [Secret guides](/secrets) - [Changelog](/changelog) - [About](/about) Verify - [Security](/security) - [Privacy](/privacy) - [Terms](/terms) - [Legal](/legal) - [Contact](/contact) - [Status](https://status.leakwatch.net) © 2026 LeakWatch [GitHub](https://github.com/Leakwatch-Scan)[X](https://x.com/LeakwatchScan)