Polymarket API: Endpoints, Authentication and WebSockets

Polymarket’s API is split across market-data, trading, and real-time services: Gamma provides market and event information, CLOB provides order-book and trading functions, and the Data API exposes user and activity data. Public market reads generally do not require credentials, but placing orders requires authenticated CLOB access; WebSocket channels deliver live market or account updates.

How Polymarket’s APIs fit together

There is no single endpoint that covers every use case. The main services have different data models and authentication requirements, so choose the API based on what the application needs to do:

• Gamma API: discovers events and markets and returns descriptive information such as titles, outcomes, status, and market identifiers. It is commonly used to find what is available before requesting prices or trading.
• CLOB API: serves order books and market prices, and supports order creation, cancellation, and related trading operations. CLOB is the relevant service for execution.
• Data API: provides user-oriented and historical or activity data, such as positions and trades, where supported by its current endpoints.
• WebSockets: stream updates rather than requiring an application to repeatedly poll an HTTP endpoint. CLOB WebSocket channels include market data and user-specific updates.

Polymarket’s infrastructure and endpoint details can change. Check the current official API documentation for exact hostnames, endpoint paths, request parameters, response fields, and supported features before building against them.

Common endpoints and what they return

The names below describe commonly used routes and endpoint families; treat the documentation as authoritative for current paths and schemas.

• Gamma events and markets: event and market listing endpoints support discovery, filtering, and retrieval by identifiers or slugs. Use them to obtain the market metadata and token identifiers needed for later CLOB requests.
• CLOB market data: endpoints such as /book, /price, and /prices are used to retrieve order-book or price information for a token. A best price is not the same as a guaranteed fill price: book depth and changing liquidity matter.
• Market metadata: CLOB market-related routes can expose market configuration and information needed to interpret tradable tokens. Do not assume a displayed outcome label is itself the token ID used in a request.
• Order operations: authenticated routes support submitting, viewing, and canceling orders. These are materially different from public read requests: signing and account permissions matter, and an accepted request does not guarantee the order will execute.
• Data API queries: user and activity endpoints can help retrieve positions, trades, or related account information. Verify pagination, filtering, and freshness semantics in the endpoint documentation.

For example, an application that displays a market can first find the event through Gamma, map the selected outcome to its CLOB token, then request a CLOB price or book. Mixing identifiers from different layers is a frequent source of empty or misleading results.

Authentication: public reads versus trading

Many market-discovery and market-data requests are publicly readable and can be made without a user’s trading credentials. This does not mean every endpoint is public. Account-specific operations and order placement require authentication, and the CLOB uses a two-stage credential model.

In broad terms, a trader signs an initial request using a wallet account, then uses derived API credentials for authenticated requests. Orders also need the appropriate signature. The exact signing scheme depends on account setup and current protocol details, so follow the official client and authentication documentation rather than copying an old example.

• Keep private keys and API secrets on a trusted server or secure signing environment; never embed them in browser code, public repositories, or client applications distributed to users.
• Do not treat a public wallet address as a secret, but do treat signing capability and API credentials as sensitive.
• Use the correct chain, account configuration, and signature type for the wallet or proxy arrangement. A mismatch can make otherwise valid requests fail.
• Separate read-only components from trading components where possible, and avoid granting or exposing signing access to systems that only need public prices.

Rate limits and reliable request handling

Polymarket applies request limits to protect its services, but limits may vary by service, route, and current operating policy. There is no safe universal requests-per-second figure to assume for all endpoints. Consult the current rate-limit documentation and any response headers, and build for throttling rather than relying on a particular limit remaining unchanged.

When a request is rejected for excess traffic, reduce request volume and retry with backoff rather than immediately repeating it. A practical client should:

• Cache relatively stable event and market metadata instead of fetching it for every screen refresh.
• Use pagination and filters, and request only the fields or records needed.
• Batch requests where the API supports it, while respecting documented batch limits.
• Handle HTTP errors, timeouts, and transient server failures separately; retry only operations that are safe to retry.
• Use exponential backoff with jitter for throttling or transient failures, and cap retries so a problem does not create a request storm.

Order submission deserves extra care: a timeout does not prove that an order was not accepted. Before submitting again, check the order state using the supported account or order query, so a retry does not create an unintended duplicate.

WebSockets: live market and account updates

WebSockets keep a connection open so the service can push updates as they occur. They are useful for price displays and order-book monitoring, where frequent polling can add delay and unnecessary HTTP traffic. The CLOB provides a market channel for public market data and a user channel for authenticated account-related events.

A typical client connects to the documented WebSocket host, subscribes to the desired channel and market or asset identifiers, then processes incoming messages according to the published schema. The user channel requires the relevant authentication material. Subscription formats and event types can evolve, so do not infer a message schema from a different channel.

• Maintain a heartbeat or respond to server keepalive messages as documented.
• Reconnect after disconnects with backoff, then resubscribe to the required assets or markets.
• Expect gaps during network interruptions. If correctness matters, refresh state from an HTTP snapshot and then resume processing stream updates.
• Do not assume every message is a complete replacement for the order book; apply updates according to the channel’s documented event semantics.

A WebSocket feed is a delivery mechanism, not a guarantee of zero latency or an authoritative record of every event after a dropped connection. Robust applications combine streaming with a way to resynchronize.

Choosing an API and avoiding common mistakes

Use Gamma for discovery and descriptive metadata, CLOB for executable market data and trading, and the Data API when the question concerns user activity or positions. Use WebSockets when updates need to arrive continuously; use HTTP for initial loads, snapshots, and occasional queries.

Common integration mistakes include treating an outcome label as a token identifier, assuming the latest trade equals the current executable price, using authenticated routes with public-only credentials, and polling too aggressively. Another misconception is that a successful order request means a filled trade: it may only mean the order was accepted, and its status can change later.

Start with read-only requests and validate the returned identifiers and values before implementing order submission. For production systems, log request IDs and error responses without logging secrets, monitor stream disconnects, and periodically verify assumptions against the live documentation.

Frequently Asked Questions

Does the Polymarket API require authentication?
Not for many public market and event reads. Trading, order management, and some account-specific operations require the appropriate CLOB authentication and signatures.

What is the difference between Gamma and CLOB?
Gamma is primarily for event and market discovery and descriptive metadata. CLOB handles order books, prices, and trading-related operations.

Does Polymarket have a WebSocket API?
Yes. CLOB WebSocket channels provide live market data and authenticated user updates. Consult the current documentation for subscription formats and message schemas.

What are Polymarket API rate limits?
Limits depend on the service and route and can change. Check current official guidance and response headers rather than relying on a fixed limit copied from an old example.

Can I place an order with a public API key?
No. Public market access is not trading authorization. Order operations require the correct account authentication, credentials, and order signing process.

Why might a price request return no data?
Check that you are using the correct CLOB token ID, that the market is available, and that the endpoint and parameters match the current documentation. Market labels and token identifiers are not interchangeable.

Related

• Integrated Device Manufacturer: What the IDM Model Includes
• Local AI Coding Assistants: Try One Before You Pay?
• Headphones Under Rs 6,000 in India: Which Fits You?