On-device Coinbase Advanced trading: security and device responsibilities

Separate the three responsibilities

On-device trading describes where the software runs. It does not mean that an exchange account moves onto the phone, that every function works offline, or that accepted orders disappear when an app closes. For Citrine, it helps to separate three responsibilities:

• The device: holds imported credentials and runs the local trading runtime.
• Coinbase: holds the account and funds and processes exchange orders.
• Supporting services: provide functions such as paid-access verification, historical market data, notices and support.

The public security guide describes this boundary: account requests go directly to Coinbase; imported credentials are encrypted in app-private storage with an Android Keystore-backed key, rather than held in a Citrine cloud trading account. Local custody of credentials is a useful distinction, not a promise that the product has no network dependencies.

This separation also changes how to diagnose a problem. A phone that cannot refresh its display and an exchange that has rejected an order are different situations. Checking only the chart cannot tell you which one occurred.

Protect the credential's whole journey

Encrypted app storage is only one stage of a credential's life. The original JSON download may still exist in Downloads, a shared folder or a backup. A screenshot or support message can expose information that encryption inside the app cannot protect.

1. Follow the current API-key setup for the eligible Coinbase account. View supports account access; real trading also requires Trade. Citrine does not require Transfer, Receive or withdrawal permissions.
2. Import the key inside Citrine. A website, documentation issue or support form is not a credential-import surface.
3. After validating the import, securely remove exposed copies of the original file when no longer needed. Check where you saved or shared it rather than assuming the import removed it.
4. Keep a recovery route to Coinbase that does not depend on the same phone. If a device is lost or compromised, revoke the key directly at Coinbase.

Minimum permissions reduce what a credential authorizes. They do not make a compromised Trade-enabled key harmless: it can still authorize trading. Device access, account access and key permissions deserve separate checks.

Prepare the execution device

An execution device needs more than a visible chart. Review power, connectivity, the app's notification and background-operation setup, and the selected mode and runtime status. Secure Android and its lock screen; review whether trading notifications reveal financial information to someone nearby.

A spare phone or tablet can be useful, but it is not a requirement or a guarantee of uninterrupted operation. Moving the app to a dedicated device does not remove network outages, exchange issues or the need to inspect status. Establish the setup with a non-trading session before relying on it for real execution.

Make a simple operating note for yourself: which device runs Standard, how you reach Coinbase directly, and which status you expect before leaving the device unattended. The note need not contain balances, credentials or account identifiers.

Check an interruption in order

After a restart, lost connection or unexpected app stop, avoid turning uncertainty into repeated actions. Use this sequence:

1. Check Coinbase first if real exposure is involved. Establish actual positions and open orders. Do not wait for support during an account or trading emergency.
2. Check the device and runtime. Read Citrine's mode, connection and runtime state. Reopening the app is not evidence that automation has resumed.
3. Check protection separately. An intended protective order is not the same as an accepted, still-active exchange order. Review the actual order state.
4. Record what happened before changing the setup. Keep the approximate time and timezone, device model, Android/app version and exact status text. Do not place another trade just to reproduce a display issue.

Coinbase-hosted stop-loss and take-profit orders are distinct from Citrine's local monitoring and exit management. Accepted exchange orders do not need the phone to render a chart, but rejection, gaps, liquidity and exchange failures can still prevent the intended execution. A stop is not insurance against every loss.

Choose Pause, Exit or Observation deliberately

Pause holds new entries while eligible live-position management can continue. Exit Citrine stops the local runtime; it does not automatically close positions or cancel existing exchange orders. Those are different operating decisions, not interchangeable ways to make an account flat.

Observation is monitoring, not a backup execution controller. It does not place trades, manage protection or perform manual closes. An Observation screen on a second device can help you see the account, but it cannot substitute for managing it through the execution device or Coinbase.

The practical question is not simply "Is the app open?" It is "Which component currently owns the action I need, and have I verified its state?" Keep that question separate from whether a number on screen looks reassuring.