Could not create api key (400 status code)

[Danialart]

Hello! im heading with the issue with my different accounts, my issue is that when im trying to get api keys
by using a following method -

const signer = new Wallet(PRIVATE_KEY_FROM_WALLET) // imported from '@ethersproject/wallet';
 const creds = await new ClobClient(
    CLOB_HOST,
    137,
    signer
  ).createOrDeriveApiKey();

I'm getting a response -

[CLOB Client] request error {"status":400,"statusText":"Bad Request","data":{"error":"Could not create api key"},"config":{"transitional":{"silentJSONParsing":true,"forcedJSONParsing":true,"clarifyTimeoutError":false},"transformRequest":[null],"transformResponse":[null],"timeout":0,"xsrfCookieName":"XSRF-TOKEN","xsrfHeaderName":"X-XSRF-TOKEN","maxContentLength":-1,"maxBodyLength":-1,"env":{},"headers":{"Accept":"*/*","Content-Type":"application/json","POLY_ADDRESS":"0x4F531514dC5ef078818861cEF5e15eCE6747944e","POLY_SIGNATURE":"0xb39b2a7cdb299740df70c7e9442993d216ee54ad404c0704912d8783b3c299d6250b2582bf23db2068e8ebd01c4a520b29ede5e18a004a78cfd3b9a1c80b92421b","POLY_TIMESTAMP":"1761984932","POLY_NONCE":"0","User-Agent":"@polymarket/clob-client","Connection":"keep-alive"},"method":"post","url":"https://clob.polymarket.com/auth/api-key","params":{}}}

And it happens with my different accounts, through Metamask Wallet or by using reveal.magic.link, the result is the same - i cant get generated api keys. What im doing wrong?

[xiangxn]

This situation may occur when using a proxy; they may be using CF.

[Danialart]

@xiangxn but i was trying with multiple accounts on the Polymarket, registered by using direct email, or via google, or the Metamask one, every secret phrase from every account - could not generate an api key for me to use the api. Locally i dont have any VPN or Proxy.

[Lolosan]

I'm having the same issue.

[allenchuang]

having the same issue as well

[wayne163]

same issue as well.
Besides, when I test with python sdk instread of nodejs, it works with the same key and address.

[SooR]

1. Use ethers version 5.x (instead of 6)
2. Use deriveApiKey() (attempt to restore) or createApiKey() for new credentials (instead of createOrDeriveApiKey())
3. After providing credentials, save (cache) them in a file '.my-clob-creds.json' (or any other name) and always restore before creating a ClobClient.

[wayne163]

1. Use ethers version 5.x (instead of 6)
2. Use deriveApiKey() (attempt to restore) or createApiKey() for new credentials (instead of createOrDeriveApiKey())
3. After providing credentials, save (cache) them in a file '.my-clob-creds.json' (or any other name) and always restore before creating a ClobClient.

Tried.
It works when using deriveApiKey() for creds, but still failed with 400 when using createApiKey. However, I tried to upgrade back to ethers version 6.x, it works too with deriveApiKey().
So I think the key point is not about the ethers version, but about the function createApiKey issue.

Here is the code

const host = 'https://clob.polymarket.com';
const funder = process.env.ADDRESS; //This is the address listed below your profile picture when using the Polymarket site.
const signer = new Wallet(process.env.WALLET_PRIVATE_KEY || ""); //This is your Private Key. If using email login export from https://reveal.magic.link/polymarket otherwise export from your Web3 Application
//In general don't create a new API key, always derive or createOrDerive

// replace with createApiKey or createOrDeriveApiKey to test
const creds = new ClobClient(host, 137, signer).deriveApiKey();

async function main() {
  const result = await creds;
  console.log("creds", result.key, " secret", result.secret, " passphrase ", result.passphrase);
  console.log("result", result);
}
main().catch(console.error);

and the error log is

[CLOB Client] request error {"status":400,"statusText":"Bad Request","data":{"error":"Could not create api key"},"config":{"transitional":{"silentJSONParsing":true,"forcedJSONParsing":true,"clarifyTimeoutError":false},"transformRequest":[null],"transformResponse":[null],"timeout":0,"xsrfCookieName":"XSRF-TOKEN","xsrfHeaderName":"X-XSRF-TOKEN","maxContentLength":-1,"maxBodyLength":-1,"env":{},"headers":{"Accept":"*/*","Content-Type":"application/json","POLY_ADDRESS":"0xxxxxxxxx","POLY_SIGNATURE":"0xcd1xxxxxxxxxxx","POLY_TIMESTAMP":"1762498111","POLY_NONCE":"0","User-Agent":"@polymarket/clob-client","Connection":"keep-alive"},"method":"post","url":"https://clob.polymarket.com/auth/api-key","params":{}}}

[codebuster22]

Personal Experience & Assumptions

I had been pulling my hair out for the same reasons a few days ago. Either the internal workings of the CLOB server changed, or there's something I'm missing, but here's my assumption based on which my solution below worked.

Each API Key is assigned a specific nonce, and once an API Key is created with a particular nonce, no new API Key can be created for that same nonce. When using createApiKey() or createOrDeriveApiKey() without passing a nonce parameter, the CLOB client defaults to nonce 0 [as seen in the code here].

This explains the behavior we're seeing:

• When deriveApiKey() works → An API Key already exists with nonce 0
• When createApiKey() fails → It's attempting to create a duplicate key for nonce 0, which is prohibited
• The 400 error is the server's way of preventing duplicate API keys for the same nonce

Root Cause Analysis

The issue stems from the misleading naming and behavior of the createOrDeriveApiKey function. The current implementation attempts to create first, then derive, which causes 400 errors when an API key already exists.

Understanding API Keys and Nonce

API Keys in Polymarket are intrinsically linked to a nonce (think of it as a unique identifier):

• By default, createApiKey() creates an API key with nonce 0
• Each nonce can only have one API key
• You can create additional keys by specifying a custom nonce: createOrDeriveApiKey(1)

Why 400 Errors Occur

When you encounter a 400 error, it typically means:

1. An API key already exists for the default nonce (0)
2. The createApiKey call fails because it's trying to create a duplicate
3. This is expected behavior, not a bug

The solution is to use deriveApiKey() first, which works when an API key already exists.

Recommended Implementation Approach

Basic Solution

// 1. Try to derive existing API Key first
// 2. If it exists, use it and store locally (e.g., .0-${funderAddress}.key.json)
// 3. If it doesn't exist, then create a new API key

Advanced Solution

Implement proper nonce tracking to manage multiple API keys per address.

Suggestions for Maintainers

I'm willing to contribute a PR to address this in one of two ways:

1. Documentation Update: Add clear documentation explaining the API key lifecycle and nonce relationship
2. Function Rename: Change createOrDeriveApiKey to deriveOrCreateApiKey to reflect the proper sequence

Question for maintainers: If my understanding is incorrect, I'd appreciate clarification on why the current "create-first" approach is intentional and how the Polymarket CLOB server internally handles API key management.

[codebuster22]

Attached example:

/**
 * Authentication utilities for Polymarket CLOB
 * Derives API credentials
 */
import { ClobClient } from '@polymarket/clob-client';
import { Wallet } from 'ethers';
import type { ClobApiCredentials } from './types';
import type { Logger } from '../../logger';
import { SignatureType } from '@polymarket/order-utils';
import fs from 'fs/promises';
import path from 'path';

export interface AuthConfig {
  privateKey: string;
  chainId: number;
  clobApiUrl: string;
  funderAddress?: string;
}

const API_KEY_FILE_BASE_PATH = path.join(process.cwd(), '.keys/');

/**
 * Get path for storing keys
 * @param walletAddress - Wallet address
 * @returns path
 */
const getKeysPath = (walletAddress: string) => (path.join(
  API_KEY_FILE_BASE_PATH,
  `.0_${walletAddress}.json`
));

/**
 * Derive CLOB API credentials from a private key using L2 authentication
 * @param config - Authentication configuration
 * @param logger - Logger instance
 * @returns API credentials (apiKey, secret, passphrase)
 */
export const deriveApiCredentials = async (
  config: AuthConfig,
  logger: Logger
): Promise<ClobApiCredentials> => {
  try {
    logger.info('Finding API credentials from private key');

    // Create wallet from private key
    const wallet = new Wallet(config.privateKey);
    logger.debug({ address: wallet.address }, 'Wallet created, now finding keys locally');

    const loadedApiCreds = await loadApiCredentials(getKeysPath(wallet.address));

    if (loadedApiCreds) {
      logger.debug({address: wallet.address, nonce: 0}, 'API Keys found locally.')
      return loadedApiCreds;
    }
    logger.debug({ address: wallet.address, nonce: 0 }, 'No API Keys found locally, derving key.')

    // Initialize CLOB client
    const clobClient = new ClobClient(
      config.clobApiUrl,
      config.chainId,
      wallet as any,
      undefined, // signature type defaults to EOA
      SignatureType.EOA,
      config.funderAddress
    );

    let apiCreds = await clobClient.deriveApiKey(); // derive for nonce 0

    if (apiCreds.key == undefined) {
      logger.debug({ address: wallet.address, nonce: 0 }, 'No API Key exist for nonce 0. Creating new API Key for nonce 0.')
      // no key exist, create one
      apiCreds = await clobClient.createApiKey(); // create with nonce 0
    }

    // save api creds
    const auth = {
      apiKey: apiCreds.key,
      secret: apiCreds.secret,
      passphrase: apiCreds.passphrase,
    };

    logger.debug({ address: wallet.address, nonce: 0 }, 'API Key either derived or created, storing it locally.')
    saveApiCredentials(auth, getKeysPath(wallet.address));

    return auth;
  } catch (error) {
    const errorMessage = error instanceof Error ? error.message : String(error);
    const errorStack = error instanceof Error ? error.stack : undefined;
    logger.error({
      error: errorMessage,
      stack: errorStack
    }, 'Failed to derive API credentials');
    throw new Error(`Failed to derive API credentials: ${errorMessage}`);
  }
};

/**
 * Create API credentials payload for WebSocket authentication
 */
export const createAuthPayload = (creds: ClobApiCredentials) => ({
  apiKey: creds.apiKey,
  secret: creds.secret,
  passphrase: creds.passphrase,
});

/**
 * Loads API credentials from file
 * @param API_KEY_FILE_PATH path to keys file
 * @returns API Keys if exists else null
 */
async function loadApiCredentials(API_KEY_FILE_PATH: string): Promise<ClobApiCredentials | null> {
  try {
    const fileExists = await fs
      .access(API_KEY_FILE_PATH)
      .then(() => true)
      .catch(() => false);

    if (!fileExists) {
      return null;
    }

    const fileData = await fs.readFile(API_KEY_FILE_PATH, 'utf8');
    const credentials = JSON.parse(fileData) as ClobApiCredentials;

    if (!credentials.apiKey || !credentials.secret || !credentials.passphrase) {
      return null;
    }

    return credentials;
  } catch (error) {
    return null;
  }
}

/**
 * Saves API credentials to file
 * @param credentials API Keys
 * @param API_KEY_FILE_PATH path to store keys at
 */
async function saveApiCredentials(
  credentials: ClobApiCredentials,
  API_KEY_FILE_PATH: string
): Promise<void> {
  try {
    const fileData = JSON.stringify(credentials, null, 2);
    await fs.writeFile(API_KEY_FILE_PATH, fileData, { encoding: 'utf8', mode: 0o600 });
  } catch (error) {
    throw new Error(
      `Failed to save API credentials: ${error instanceof Error ? error.message : String(error)}`
    );
  }
}

[codebuster22]

import type { ClobApiCredentials } from './types';

could you please provide the ClobApiCredentials def?

export interface ClobApiCredentials {
apiKey: string;
secret: string;
passphrase: string;
}

[JejomStark]

Workaround for Polymarket CLOB SDK API key bug (

"@polymarket/clob-client": "4.22.8",
"ethers": "5.8.0"

let apiCreds;
const signer = new Wallet(process.env.PRIVATE_KEY);
const tempClient = new ClobClient(HOST, CHAIN_ID, signer);
apiCreds = await tempClient.deriveApiKey();
// Workaround: remap `key` to `apiKey`
apiCreds.apiKey = apiCreds.key;
const authClient = new ClobClient(HOST, CHAIN_ID, signer, apiCreds);

--console.log(await client.getOpenOrders({ market: marketId }))

[918Ross]

If you are using deriveApiKey() and API key is undefined, but Secret and Passphrase is legit, change userApiCreds.apiKey to userApiCreds.key

The dev made a mistake in docs, check it console.log(userApiCreds)