Bot for Polymarket
Distinguish keys and credentials
Polymarket’s key guidance says not to share a private key with another party. Its API documentation distinguishes wallet signatures from API credentials: public market data needs no credentials; private trading operations require authentication and order authorization.
Review before installation
- Identity: follow links from official documentation when choosing an official SDK; verify the repository and package names.
- Installation: inspect dependencies and install scripts before running code. Open-source availability alone does not establish safety.
- Permissions: document whether the tool needs public data, private account data, trading authority or withdrawal capability.
- Secret handling: identify where credentials are stored, logged or transmitted. Do not paste a wallet key into a third-party form or chat.
- Control: understand how to stop the process and remove the access it uses before connecting an account.
- Scope: check the US or International path and test the risk controls.
If credentials may have been exposed
Stop using the untrusted tool. Use independently verified wallet or platform controls to review activity and secure the affected account. Do not rely on instructions supplied by the suspected tool. Revoking an API credential is different from securing a disclosed wallet private key.
Our product status
Bot for Polymarket currently provides research and a product waitlist. No wallet credentials are required to read these guides or join the list.
Also read: copy-trading considerations and vendor evaluation questions.
Security guidance reviewed October 7, 2026: Polymarket private-key guidance and API authentication documentation.