POST/auth/builder-api-key

Create builder API key

Creates a new builder API key for the authenticated user. Requires Polymarket L2 Authentication. The owner is determined from the L2 authentication headers.

Base URL: https://clob.polymarket.com
Auth: L2 API credentials (key, secret, passphrase)POLY_API_KEY, POLY_ADDRESS, POLY_SIGNATURE, POLY_PASSPHRASE, POLY_TIMESTAMP
Rate limit: 9,000 req / 10s (900 per second)
Limit applies to: CLOB API general

Example

curl -X POST "https://clob.polymarket.com/auth/builder-api-key" \
  -H "POLY_API_KEY: $POLY_API_KEY" \
  -H "POLY_ADDRESS: $POLY_ADDRESS" \
  -H "POLY_SIGNATURE: $POLY_SIGNATURE" \
  -H "POLY_PASSPHRASE: $POLY_PASSPHRASE" \
  -H "POLY_TIMESTAMP: $POLY_TIMESTAMP"

L2 requests are signed with HMAC-SHA256 using your API secret, and the timestamp is part of the signature, so keep the machine's clock accurate. A missing credential or a stale signature both come back as Unauthorized/Invalid api key. The Python SDK signs for you.

Response fields

Field	Type	Description
key	string	Unique UUID identifier for the builder API key
secret	string	Base64-encoded secret key for HMAC authentication
passphrase	string	Hex-encoded passphrase for secret decryption

Responses

Status	Meaning
200	Builder API key successfully created
401	Unauthorized - Invalid API key or authentication failed
500	Internal server error

Errors this endpoint returns

500could not create builder api key

Related endpoints

POST /auth/api-key CLOB API
DELETE /auth/api-key CLOB API
GET /auth/api-keys CLOB API
GET /auth/derive-api-key CLOB API
GET /auth/ban-status/closed-only CLOB API
GET /auth/builder-api-key CLOB API

Polymarket's API serves current state only, so it cannot show what a market's book looked like after it resolved. PolyTest records Up/Down markets while they run and keeps the snapshots. Try it free, or read the full rate limit reference.

From Polymarket's published OpenAPI spec and rate-limit tables, synced 2026-10-04.