What the user does
The user authorises the account over OAuth, in the exchange’s own interface. They never hand you credentials and they sign no on-chain transaction, which is the main practical difference from a wallet connection.Supported exchanges
Flow accepts deposits from a user’s balance at Coinbase and Gemini. A Kraken account can also be connected, but for reading balances only: it cannot fund a flow today. Authorisation is set up per exchange in the dashboard, under the OAuth providers for your environment. Coinbase, Kraken, and Gemini have their own setup pages:Coinbase
Creating the app and obtaining OAuth credentials.
Kraken
Arranged with the Kraken team.
Gemini
Linking only, not a sign-in method.
Gemini authorises an exchange account rather than a person, so it can only be linked to a user who is already signed in. It is not available as a sign-up or login method.
Permissions are per exchange
How much an authorisation grants differs by exchange, and the difference decides what your integration can do. Both are configured through the Additional Scopes field on the OAuth provider in the dashboard. Coinbase grants read-only access when the user connects, which is enough to list accounts and show balances. Sending funds needs an extra scope. An app that only displays balances never gains the ability to move the user’s money, which is a reasonable default to leave in place. Kraken needs explicit scopes for everything, account reads included. A Kraken connection with no scopes configured cannot even list balances. The specific scope strings, and the transfer flow that uses them, are in Building an exchange transfer UI.Once connected
Reading balances is the baseline. With the sending permission added, a connected account can also transfer funds out to an external wallet address, which is a separate capability from paying into a flow. Coinbase transfers can require additional confirmation after submission, including two-step verification and Travel Rule information, so a transfer is not always a single round trip.Conversion still applies
An exchange source is not exempt from conversion, but it is treated differently. The exchange provider buys the settlement token directly, which means an exchange connection is unaffected by the exact-match restriction that applies to wallet sources.Next
Connections
How exchange connections compare to the other kinds.
Exchange transfer UI
The JavaScript implementation, including scopes and Coinbase’s extra steps.