GET/auth/derive-api-key

Derive API key

Derives an existing API key from an Ethereum address and nonce. The API key must have been previously created using the same address and nonce.

Base URL: https://clob.polymarket.com
Auth: L1 wallet signaturePOLY_ADDRESS, POLY_SIGNATURE, POLY_TIMESTAMP, POLY_NONCE
Rate limit: 9,000 req / 10s (900 per second)
Limit applies to: CLOB API general

Example

curl -X GET "https://clob.polymarket.com/auth/derive-api-key" \
  -H "POLY_ADDRESS: $POLY_ADDRESS" \
  -H "POLY_SIGNATURE: $POLY_SIGNATURE" \
  -H "POLY_TIMESTAMP: $POLY_TIMESTAMP" \
  -H "POLY_NONCE: $POLY_NONCE"

L1 requests carry an EIP-712 signature from your wallet, which proves you control the address. The response is your API credentials. The Python SDK builds the signature for you.

Response fields

Field	Type	Description
apiKey	string	UUID of the API key
secret	string	Base64-encoded secret key for HMAC authentication
passphrase	string	Hex-encoded passphrase for secret decryption

Responses

Status	Meaning
200	API key successfully derived
400	Bad request - Could not derive API key
401	Unauthorized - Invalid L1 headers
500	Internal server error

Errors this endpoint returns

Related endpoints

POST /auth/api-key CLOB API
DELETE /auth/api-key CLOB API
GET /auth/api-keys CLOB API
GET /auth/ban-status/closed-only CLOB API
GET /auth/builder-api-key CLOB API
POST /auth/builder-api-key CLOB API

Polymarket's API serves current state only, so it cannot show what a market's book looked like after it resolved. PolyTest records Up/Down markets while they run and keeps the snapshots. Try it free, or read the full rate limit reference.

From Polymarket's published OpenAPI spec and rate-limit tables, synced 2026-10-04.