Invalid L1 Request headers
Your L1 authentication headers (HMAC signature) are malformed or the signature doesn't match. See Authentication.
The EIP-712 signature is malformed or doesn't match the address in the header. Sign with the same private key as the address you send, on chain ID 137.
Retry? Don't retry, fix credentials
Check that the key, secret and passphrase are all set, that they were derived for the wallet you sign with, and that the machine's clock is accurate to a few seconds. Retrying unchanged will fail the same way.
Returned by
- POST /auth/api-key 9,000 req / 10s
- GET /auth/derive-api-key 9,000 req / 10s
Handling it in code
The CLOB API returns errors as {"error": "..."}. It also rewrites status codes by message, so branch on the text: anything containing "not found" becomes 404 and anything containing "unauthorized" becomes 401.
r = session.post(url, json=payload, headers=headers)
if r.status_code >= 400:
msg = r.json().get("error", "")
if "Invalid L1 Request headers" in msg:
raise ValueError(msg) # fix the request, don't retryRelated errors
For errors Polymarket doesn't document, like "order manager not ready" or 403s from the edge, see the full error guide.
Message and status from Polymarket's error reference, synced 2026-10-04.