How to Log In — Web & Mobile
Signing in requires your registered email and password plus any secondary verification you have enabled. For professional traders, secure authentication is essential — below we walk through clear steps for both web and mobile.
- Open your browser and navigate to the official Coinbase Pro login page (use a bookmarked URL you trust).
- Enter your registered email address and password into the login fields.
- If prompted, enter a two-factor verification code from your authenticator app or your hardware 2FA key.
- Confirm any device recognition prompts if you chose to remember your computer; otherwise select "do not remember" for public machines.
- Open the Coinbase Pro mobile app.
- Tap “Sign in,” enter your credentials, and supply your 2FA code when requested.
- Use biometric login (Face ID/Touch ID) for faster access after initial authentication, if desired.
Use an authenticator app (recommended) or a hardware security key for the strongest protection. SMS-based 2FA is less secure and should be used only as a fallback.
- Sign out of shared or public devices.
- Enable device notifications to spot unauthorized logins.
- Review connected devices and revoke unknown sessions immediately.
Troubleshooting Login Problems
Use the platform’s password recovery flow. Choose a unique, long passphrase (not reused anywhere) and enable a password manager to store it securely.
- Ensure your authenticator app’s clock is set to automatic time sync.
- If using hardware keys, confirm drivers or browser support are enabled.
- Keep backup recovery codes stored offline to regain access if your device is lost.
If your account is locked or you notice suspicious logins, immediately change your password from a trusted device and contact platform support to investigate and secure your account.
Advanced Security Practices
- Use a hardware security key (FIDO2/U2F) where supported for phishing-resistant 2FA.
- Enable withdrawal whitelists and IP restrictions if available.
- Keep system software and browsers up to date to avoid zero-day exploits.
- Consider separate accounts for large trading activity and for holding funds.
Session and API Security
For traders using programmatic access, protect API keys by following least-privilege principles: create keys with only the permissions required (read, trade, withdraw) and rotate them regularly. Store keys in secure vaults rather than code or plaintext files.
Frequently Asked Questions
How can I make my login phishing-resistant?
Use hardware security keys and always verify the domain before entering credentials. Avoid clicking links in emails; type the site address or use a bookmark.
Can I use multiple 2FA methods?
Yes — configure more than one authenticator or keep a hardware key plus an authenticator app. Keep recovery codes offline.
What if my phone with 2FA is lost?
Use stored recovery codes to regain access or complete the platform’s account recovery process, which typically requires identity verification.