Commit db37780
committed
fix(coinbase): drop invented OAuth client credentials
Coinbase for Agents is URL-only login OAuth. Requiring CLIENT_ID and
CLIENT_SECRET blocked the documented sign-in path.1 parent 14ef85f commit db37780
4 files changed
Lines changed: 5 additions & 43 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -31,24 +31,5 @@ | |||
| 31 | 31 | "crypto", | |
| 32 | 32 | "mcp" | |
| 33 | 33 | ], | |
| 34 | - "variables": { | ||
| 35 | - "type": "object", | ||
| 36 | - "properties": { | ||
| 37 | - "CLIENT_ID": { | ||
| 38 | - "type": "string", | ||
| 39 | - "title": "Coinbase OAuth Client ID", | ||
| 40 | - "description": "OAuth client ID from the Coinbase Developer Platform portal (portal.cdp.coinbase.com \u2192 OAuth)." | ||
| 41 | - }, | ||
| 42 | - "CLIENT_SECRET": { | ||
| 43 | - "type": "string", | ||
| 44 | - "title": "Coinbase OAuth Client Secret", | ||
| 45 | - "description": "OAuth client secret from the same Coinbase Developer Platform OAuth client." | ||
| 46 | - } | ||
| 47 | - }, | ||
| 48 | - "required": [ | ||
| 49 | - "CLIENT_ID", | ||
| 50 | - "CLIENT_SECRET" | ||
| 51 | - ] | ||
| 52 | - }, | ||
| 53 | 34 | "mcpServers": "./mcp.json" | |
| 54 | 35 | } | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -5,5 +5,5 @@ All notable changes to this plugin will be documented here. | |||
| 5 | 5 | ## 1.0.0 — initial release | |
| 6 | 6 | ||
| 7 | 7 | - Added the `coinbase` MCP server pointing at Coinbase's hosted Streamable HTTP endpoint (`https://agents.coinbase.com/mcp`). | |
| 8 | - - Auth uses OAuth with Coinbase user login. Declared `CLIENT_ID` and `CLIENT_SECRET` plugin variables and forwarded them through MCP auth, since `login.coinbase.com` does not support dynamic client registration. | ||
| 8 | + - Auth uses Coinbase user login OAuth against the hosted remote URL. No client ID or secret is required. | ||
| 9 | 9 | - Logo: Coinbase's official mark, from the `coinbase` GitHub organization. | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -8,7 +8,7 @@ Check balances, get quotes, and preview or place trades. | |||
| 8 | 8 | ||
| 9 | 9 | 1. Open **Cursor Settings → Plugins**. | |
| 10 | 10 | 2. Search for **Coinbase**. | |
| 11 | - 3. Click **Install**, then follow **Setup** below. | ||
| 11 | + 3. Click **Install**, then complete the Coinbase sign-in prompt. | ||
| 12 | 12 | ||
| 13 | 13 | Or run `/add-plugin coinbase` in chat. | |
| 14 | 14 | ||
@@ -18,28 +18,13 @@ Or run `/add-plugin coinbase` in chat. | |||
| 18 | 18 | { | |
| 19 | 19 | "mcpServers": { | |
| 20 | 20 | "coinbase": { | |
| 21 | - "url": "https://agents.coinbase.com/mcp", | ||
| 22 | - "auth": { | ||
| 23 | - "CLIENT_ID": "${CLIENT_ID}", | ||
| 24 | - "CLIENT_SECRET": "${CLIENT_SECRET}" | ||
| 25 | - } | ||
| 21 | + "url": "https://agents.coinbase.com/mcp" | ||
| 26 | 22 | } | |
| 27 | 23 | } | |
| 28 | 24 | } | |
| 29 | 25 | ``` | |
| 30 | 26 | ||
| 31 | - ## Setup | ||
| 32 | - | ||
| 33 | - Coinbase's authorization server (`login.coinbase.com`) does not support dynamic client registration, so an OAuth client has to be registered before anyone can connect. | ||
| 34 | - | ||
| 35 | - 1. In the [Coinbase Developer Platform portal](https://portal.cdp.coinbase.com/), create an OAuth client and enable the Coinbase for Agents (`mcp:*`) scopes you want to expose. | ||
| 36 | - 2. Register both redirect URIs on that client: | ||
| 37 | - - Desktop: `http://localhost:8787/callback` | ||
| 38 | - - Web and Cloud Agents: `https://www.cursor.com/agents/mcp/oauth/callback` | ||
| 39 | - 3. In **Dashboard → Plugins → Configure**, set **Coinbase OAuth Client ID** and **Coinbase OAuth Client Secret** from that client. | ||
| 40 | - 4. Complete the Coinbase login when Cursor prompts. | ||
| 41 | - | ||
| 42 | - On a team marketplace an admin sets the client ID and secret once for everyone; each member still completes their own Coinbase login, so tool calls run against that member's account. Coinbase recommends scoping the agent to a dedicated portfolio. | ||
| 27 | + Auth is OAuth against Coinbase. Cursor prompts for Coinbase user login when the plugin connects — there is no API key or client ID to configure. On the approval screen, select which portfolios to give the agent access to. Coinbase recommends scoping the agent to a dedicated portfolio. | ||
| 43 | 28 | ||
| 44 | 29 | ## What agents can do | |
| 45 | 30 | ||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -1,11 +1,7 @@ | |||
| 1 | 1 | { | |
| 2 | 2 | "mcpServers": { | |
| 3 | 3 | "coinbase": { | |
| 4 | - "url": "https://agents.coinbase.com/mcp", | ||
| 5 | - "auth": { | ||
| 6 | - "CLIENT_ID": "${CLIENT_ID}", | ||
| 7 | - "CLIENT_SECRET": "${CLIENT_SECRET}" | ||
| 8 | - } | ||
| 4 | + "url": "https://agents.coinbase.com/mcp" | ||
| 9 | 5 | } | |
| 10 | 6 | } | |
| 11 | 7 | } | |
0 commit comments