[api-v2-bug] The V2 API requires OAuth2 CB-2FA-Token even with OAuth2 is not used

[brianddk]

The /v2/accounts/:account_id/transactions "Send Money" endpoint requires CB-2FA-Token headers when CDP (v3) API keys are used. The documentation implies that these fields are only required for OAuth2 not for API Key authorizations.

This is a serious problem since it requires users to downgrade account security to Authy in order to use the API. It would be reasonable if account security could remain at "Security Key" levels and allow Authy codes to work in parallel on the API calls alone. But this is not the case. Perhaps this is because the API is mis-identifying the authentication method. If this is not a design error, but rather the intended use, there is a coinbase-python-py PR that adds this functionality.

[brianddk]

Should be fixed now pending retest

• Retest this issue with the claimed fix

Still broke.

[brianddk]

Fixed via CB Support