Coinbase's getting-started guide distinguishes key-based access to your own account from OAuth access for other users. A Coinbase integration should not ask customers to hand over private API credentials as a substitute for consent.
Begin with the minimum read access required and test authorization removal.
Akousa