Wallet Derive Credentials Via Proxy

Forward locally-signed Polymarket L1 auth headers from Railway.

For external-wallet users whose IP is Cloudflare-blocked from POST https://clob.polymarket.com/auth/api-key (commonly residential AU / SE Asia ranges). The SDK builds the four L1 headers locally with the user’s private key (key stays on user’s machine), POSTs them here, we forward to Polymarket from a non-blocked IP, encrypt and store the resulting creds.

Auth: SDK API key (caller must own poly_address). Rate limit: 3/minute (slowapi, IP-keyed) — Polymarket’s own derive routes are throttled and the encrypted column is per-user, not per-call.

POST /api/sdk/wallet/credentials/derive-via-proxy

Wallet Derive Credentials Via Proxy

cURL

curl --request POST \
  --url https://api.simmer.markets/api/sdk/wallet/credentials/derive-via-proxy \
  --header 'Content-Type: application/json' \
  --data '
{
  "poly_address": "<string>",
  "poly_signature": "<string>",
  "poly_timestamp": "<string>",
  "poly_nonce": "<string>"
}
'

422

{
  "detail": [
    {
      "loc": [
        "<string>"
      ],
      "msg": "<string>",
      "type": "<string>",
      "input": "<unknown>",
      "ctx": {}
    }
  ]
}

Body

application/json

Pre-signed Polymarket L1 auth headers for proxy-derive of CLOB creds.

External-wallet users on residential / Cloudflare-blocked IPs cannot reach Polymarket's POST /auth/api-key endpoint directly. The SDK signs the L1 challenge locally with the EOA private key (the key never leaves the user's machine) and POSTs only the resulting four headers here. The backend forwards them to Polymarket from a non-blocked IP, encrypts and stores the returned creds. The signature is bound to address + timestamp + nonce, so it cannot be replayed as a transaction.

poly_address · string · required

EOA address — must match the authenticated user's wallet_address

Pattern: ^0x[0-9a-fA-F]{40}$

poly_signature · string · required

L1 auth signature: 0x + 130 hex chars (65 bytes: r,s,v)

Pattern: ^0x[0-9a-fA-F]{130}$

poly_timestamp · string · required

Unix timestamp in seconds (10 digits) used in the signature

Pattern: ^\d{10}$

poly_nonce · string · required

Nonce used in the signature (decimal digits, default 0)

Pattern: ^\d{1,20}$

Response

200

application/json

Successful Response