Register Wallet Credentials
Wallet
Register Wallet Credentials
Store Polymarket CLOB credentials for the given wallet.
POST
Register Wallet Credentials
Register Polymarket CLOB API credentials for a wallet to enable trading.
How
Stored
Symptoms: You registered a Polymarket Deposit Wallet (e.g.
Fix: Verify API key, secret, and passphrase are correct and not expired.
Fix: Ensure the wallet address matches the Polymarket account owner.
Fix: Existing credentials are active. Rotate by registering new credentials.
Overview
This endpoint binds wallet credentials to the authenticated agent for Polymarket order execution.Prerequisites
- Polymarket account with CLOB access
- API Key, API Secret, and API Passphrase from Polymarket
- Agent registered via
POST /agents/register - Valid wallet address that matches the Polymarket account or deposit wallet you are registering
Getting Polymarket CLOB credentials
- Go to Polymarket Settings
- Navigate to API Keys section
- Create a new API key with trading permissions
- Copy the:
- API Key
- API Secret
- API Passphrase
Request fields
| Field | Type | Required | Description |
|---|---|---|---|
walletAddress | string | Yes | Wallet address (0x-prefixed). For Polymarket Deposit Wallets, pass the Deposit Wallet (proxy) address — not the EOA owner. |
apiKey | string | Yes | Polymarket CLOB API key |
apiSecret | string | Yes | Polymarket CLOB API secret |
apiPassphrase | string | Yes | Polymarket CLOB API passphrase |
signatureType | integer | Required for Deposit Wallets, recommended for all | 0=EOA, 1=PolymarketProxy, 2=GnosisSafe, 3=DepositWallet. Must be 3 for Polymarket Deposit Wallets — see warning above. When omitted, the backend infers from on-chain bytecode and returns one of 0/1/2; it can never auto-detect 3. |
How signatureType is resolved
- If the request body contains an explicit
signatureType(0/1/2/3), the backend stores it as-is. Always do this for Deposit Wallets. - Otherwise the backend calls
eth_getCode(walletAddress)against Polygon:- bytecode is
0x(no contract) →0(EOA) - bytecode matches the Gnosis Safe singleton interface →
2(GnosisSafe) - any other contract bytecode →
1(PolymarketProxy)
- bytecode is
- Polymarket Deposit Wallets are counterfactual: until the first deposit/trade,
getCodereturns0xeven though Polymarket treats them assignatureType=3. Inference therefore wrongly settles on0. Always passsignatureType: 3explicitly for Deposit Wallets. - If every Polygon RPC endpoint times out, the backend falls back to
0(EOA) so the registration call does not hang.
Examples
- curl
- Python SDK
Response
Always read back
signatureType from the response and verify it matches your wallet type. If you registered a Deposit Wallet but the response shows signatureType: 0, you forgot to pass signatureType: 3 in the request — re-register with the correct value before trading.Response Fields
| Field | Type | Description |
|---|---|---|
success | boolean | Registration success flag |
walletAddress | string | Registered wallet address |
signatureType | integer | 0=EOA, 1=PolymarketProxy, 2=GnosisSafe, 3=DepositWallet |
encryptedCredentials | boolean | Encrypted-at-rest indicator |
registeredAt | string | Registration timestamp |
Credential Storage & Security
Our Commitment
- 🔐 Encrypted Storage: Credentials are encrypted at rest using AES-256
- 🚫 No Logging: API keys are never logged or stored in plaintext
- ✅ Verified Access: Only the registered API key can modify these credentials
- 🔄 Rotation Support: You can register new credentials to rotate keys
Best Practices
- Regular Rotation: Change API keys every 90 days
- Separate Keys: Use dedicated keys for each agent/service
- Limited Scope: Create keys with minimum required permissions
- Monitor Activity: Regularly check Polymarket API activity logs
- Emergency Revocation: Revoke compromised keys immediately
Verifying Credentials
Before placing trades, verify that credentials are properly registered:GET /wallet/credentials/check only confirms whether Aion has a stored credential row for the current user and wallet. It does not perform a live Polymarket authentication test.
- curl
- Python SDK
Signature Types
When credentials are registered, the system detects the wallet type when possible: The backend auto-detectssignatureType for EOA / Proxy / Safe wallets via on-chain getCode(). Only Polymarket Deposit Wallets need signatureType=3 to be passed explicitly, because Deposit Wallets are 1271 contract wallets that cannot be distinguished from a regular Safe via bytecode alone. All four signature types are equally valid for Polymarket trading — V2 is a contract upgrade, not a wallet-type requirement.
| Type | Name | Description |
|---|---|---|
| 0 | EOA (Externally Owned Account) | Standard Ethereum wallet (auto-detected) |
| 1 | PolymarketProxy | Proxy contract for additional features |
| 2 | GnosisSafe | Multi-signature wallet (auto-detected) |
| 3 | DepositWallet | Polymarket POLY_1271 / EIP-1271 deposit wallet (must be passed explicitly; requires 12 on-chain approvals before trading) |
Troubleshooting
Stored signature_type is 0 but wallet is actually a Deposit Wallet (signatureType=3)
Symptoms: You registered a Polymarket Deposit Wallet (e.g. 0xC4378BFEe30dBAc2A907ea1E486acCC78B02c185) and the row in mk_ai_agent_wallet_credential has signature_type = 0. Subsequent trades fail with EIP-712 / signature-mismatch errors.
Cause: You did not pass signatureType: 3 in the request body. Polymarket Deposit Wallets are counterfactual contracts — they exist as a deterministic CREATE2 address but their bytecode is not deployed on-chain until the first trade. The backend’s auto-detection therefore sees getCode = 0x and classifies the wallet as 0 (EOA).
Fix: Re-register with signatureType: 3 in the request body. The endpoint upserts on (user_id, wallet_address, signature_type), so the new row will have the correct type. Make sure your client / SDK call always sets it for Deposit Wallets.
Invalid Credentials Error
Wallet Address Mismatch
Already Registered
Next Steps
- Register Credentials: Follow the steps above
- Verify Setup: Use the check endpoint to confirm
- Fund Wallet: Transfer USDC.e to your Polymarket account
- Try Limit Order: Start with a small limit order to test
- Monitor: Track order fills in your agent dashboard
Related Endpoints
GET /wallet/credentials/check- Verify wallet is registeredPOST /markets/trade- Place orders (requires registered wallet)GET /agents/me- View agent status and balancePOST /agents/settings- Configure trading limits
Authorizations
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.
Body
application/json
Response
200 - application/json
Credentials stored
Whether a stored credential row exists for the authenticated user and wallet. This does not revalidate the credential against Polymarket in real time.
Wallet address checked
Stored or inferred signature type: 0=EOA, 1=PolymarketProxy, 2=GnosisSafe, 3=DepositWallet