Polymarket CLOB API (2026): Keys, Endpoints and Rate Limits

What is the Polymarket CLOB API?

CLOB stands for central limit order book, the matching engine behind every Polymarket trade. The CLOB API is how you read that book and put orders onto it. It is one of several Polymarket APIs, and each has its own job:

Live updates arrive over WebSockets: the public market channel at wss://ws-subscriptions-clob.polymarket.com/ws/market and the authenticated user channel at /ws/user on the same host. For discovery, start with the Polymarket Gamma API, and for wallet activity, the Polymarket Data API.

Two details catch most first integrations. Trading collateral is pUSD, Polymarket USD. And the CLOB identifies each outcome by a token ID, so the market you see on a web page has to be translated before you can ask for its book, which is covered in finding Polymarket market and token IDs.

Which CLOB endpoints are public?

Everything that describes the market rather than your account can be read without credentials:

curl -s "https://clob.polymarket.com/book?token_id=YOUR_TOKEN_ID"

How do you get Polymarket CLOB API keys?

CLOB credentials are derived from your wallet rather than issued from a dashboard. The flow is one signature and one request:

1. Build Polymarket's ClobAuth typed data: EIP-712 domain ClobAuthDomain, version 1, chain ID 137, carrying your signer address, a Unix timestamp, a nonce (0 unless you manage several credential sets) and the fixed message "This message attests that I control the given wallet".
2. Sign it with the private key that controls that address. That signature is your L1 signature.
3. Send it in the POLY_ADDRESS, POLY_SIGNATURE, POLY_TIMESTAMP and POLY_NONCE headers to POST /auth/api-key to create credentials, or to GET /auth/derive-api-key to recover the ones that already exist for that address and nonce.
4. Store the three values that come back: apiKey, secret and passphrase.

curl -X POST "https://clob.polymarket.com/auth/api-key" \
  -H "POLY_ADDRESS: YOUR_SIGNER_ADDRESS" \
  -H "POLY_SIGNATURE: YOUR_L1_SIGNATURE" \
  -H "POLY_TIMESTAMP: UNIX_SECONDS" \
  -H "POLY_NONCE: 0"

How are private CLOB requests signed?

Every private request is an L2 request. Concatenate a fresh Unix timestamp in seconds, the uppercase HTTP method, the request path and the exact serialized body, then sign that string with HMAC-SHA256 using your base64-decoded secret, and encode the result as URL-safe base64:

message   = timestamp + "GET" + "/data/orders"      # append the exact body on POST requests
signature = urlsafe_base64(HMAC_SHA256(base64_decode(secret), message))

Placing an order needs one more signature on top. The order itself is signed by the wallet, while L2 authenticates the request that carries it. That third signature, with its rounding rules on price and size, is where most hand-rolled integrations go wrong, and it is the strongest reason to let an SDK do the work.

How do you place an order with the unified SDK?

Polymarket's unified TypeScript SDK wraps all three signatures. This is the flow from Polymarket's own quickstart, placing a small market buy:

import { createSecureClient, OrderSide } from '@polymarket/client';
import { privateKey } from '@polymarket/client/viem';

const client = await createSecureClient({
  wallet: process.env.POLYMARKET_WALLET_ADDRESS as `0x${string}`,
  signer: privateKey(process.env.POLYMARKET_PRIVATE_KEY as `0x${string}`),
});

const market = await client.fetchMarket({ slug: 'your-market-slug' });
const tokenId = market.outcomes.yes.tokenId!;

const response = await client.placeMarketOrder({ tokenId, side: OrderSide.BUY, amount: '10' });
if (!response.ok) throw new Error(response.message);

await client.waitForOrderFillSettlement(response);

What are the Polymarket CLOB rate limits?

Read limits are applied per IP and endpoint, and traffic over them is throttled and queued rather than refused. Order and cancel requests draw on per-signer token buckets instead, and a request over that budget comes back as a 429 with a Retry-After header. The complete tables, including Gamma and the Data API, are in Polymarket API rate limits, and the ways to raise them in how to increase your Polymarket rate limit.

Should you still use py-clob-client?

Not for new work. Polymarket's documentation now points integrations to the unified SDKs, @polymarket/client on npm and polymarket-client on PyPI, both at 0.11.0 this week, and publishes a migration guide away from the earlier packages, including @polymarket/clob-client-v2 and the builder signing libraries. The unified clients cover market data, order placement, settlement and positions through one interface, and they need Node.js 24 or Python 3.11 or newer. Choosing between them is covered in the Polymarket SDK guide.

How do you read Polymarket's books alongside other venues?

The CLOB API answers for Polymarket alone. When a strategy compares Polymarket with Kalshi, Limitless or any other venue, Predictefy serves every order book in one normalized shape through one API key, across 15+ venues:

import { Predictefy } from '@predictefy/sdk';

const client = new Predictefy({ apiKey: process.env.PREDICTEFY_API_KEY });

const polymarketBook = await client.polymarket.fetchOrderBook('POLYMARKET_TOKEN_ID');
const kalshiBook = await client.kalshi.fetchOrderBook('KALSHI_OUTCOME_ID');

Frequently Asked Questions