Unauthorized/Invalid api key
Your API key is missing, expired, or invalid. Ensure you're sending all required authentication headers.
Usually one of two things: part of the credential set is missing (L2 needs the key, secret and passphrase together), or the machine's clock has drifted enough to invalidate the signature.
Retry? Don't retry, fix credentials
Check that the key, secret and passphrase are all set, that they were derived for the wallet you sign with, and that the machine's clock is accurate to a few seconds. Retrying unchanged will fail the same way.
Any authenticated CLOB endpoint can return this.
Handling it in code
The CLOB API returns errors as {"error": "..."}. It also rewrites status codes by message, so branch on the text: anything containing "not found" becomes 404 and anything containing "unauthorized" becomes 401.
r = session.post(url, json=payload, headers=headers)
if r.status_code >= 400:
msg = r.json().get("error", "")
if "Unauthorized/Invalid api key" in msg:
raise ValueError(msg) # fix the request, don't retryRelated errors
For errors Polymarket doesn't document, like "order manager not ready" or 403s from the edge, see the full error guide.
Message and status from Polymarket's error reference, synced 2026-10-04.