Unable to send order with the generated api credentials

[gmoutsin]

I have created a new account using a wallet I created with metamask. I have tried to create the credentials and send an order but I get an error saying "the order signer address has to be the address of the API KEY"

This is the minimal script I used:

host: str = os.getenv("CLOB_API_URL", "https://clob.polymarket.com")
private_key = "0xabc...def"

client = ClobClient(
    host=host,
    key=private_key,
    chain_id=137,
)

creds = client.create_or_derive_api_key()

print("CLOB_API_KEY=", creds.api_key)
print("CLOB_SECRET=", creds.api_secret)
print("CLOB_PASS_PHRASE=", creds.api_passphrase)


client = ClobClient(
    host=host,
    key=private_key,
    chain_id=137,
    creds=creds,
    signature_type=SignatureTypeV2.POLY_1271,
    funder="0x123...456" 
)



resp = client.create_and_post_order(
    order_args=OrderArgs(
        token_id="111...111",
        price=0.1,
        side=Side.BUY,
        size=10,
    ),
    options=PartialCreateOrderOptions(tick_size="0.01"),
    order_type=OrderType.GTC,
)

print(resp)

When I run this, it prints the following:

CLOB_API_KEY=abc...abc
CLOB_SECRET= xyz...xyz
CLOB_PASS_PHRASE= 123...123


[py_clob_client_v2] request error status=400 url=https://clob.polymarket.com/order body={"error":"the order signer address has to be the address of the API KEY"}

In my code, the funder address is the address I see on polymarket when I go to my profile settings.

I'm not sure how reproducible this problem is, but it is very consistent for me.

Am I doing something wrong here or there is actually a bug somewhere?

EDIT: I should clarify that I can use the credentials to see my balance

[gholyst]

mee too

[hksnz]

+1, also reproducing on the TypeScript client @polymarket/clob-client-v2@1.0.3 (latest on npm), so this isn't Python-specific.

Setup

• Deposit wallet (existing Polymarket account): 0x3dDe...74F — sigtype-3 / POLY_1271
• EOA / session signer: 0x00e31c04...74ea
• L2 creds derived via client.createOrDeriveApiKey() on the EOA — bind to EOA, can read balance fine
• Order constructed via signatureType: SignatureTypeV2.POLY_1271, funderAddress: <wallet> — verified maker == signer == wallet in the request body, signature is the full ERC-7739 / Solady wrapper (~190 bytes incl. embedded ORDER_TYPE_STRING)

Empirically tested all four signatureTypes against /order

sigType	Server response
0 (EOA), 1 (POLY_PROXY), 2 (POLY_GNOSIS_SAFE)	"maker address not allowed, please use the deposit wallet flow"
3 (POLY_1271)	"the order signer address has to be the address of the API KEY"

So sigtype-3 is the only path past the maker-allowlist check, and only sigtype-3 hits this rejection.

Also verified ruled out

• POST /auth/api-key with POLY_ADDRESS = wallet + EOA EIP-712 sig → "Invalid L1 Request headers" (no EIP-1271 verification on L1 endpoint)
• Builder API key HMAC headers (POLY_BUILDER_*) sent to /order either alone or alongside user headers → 401 Unauthorized or same signer-mismatch rejection
• Confirmed our EOA can L2-auth the API for non-trade reads with the EOA-bound creds (consistent with @gmoutsin's "I can use the credentials to see my balance")

Looks like the server-side signer == api_key.bound_address check isn't excepting the POLY_1271 / EIP-1271 path, where signer is by definition the wallet contract and the L2 key is intentionally EOA-bound per PR #35's design.

Happy to share more diagnostic context if helpful. Cheers.

[devin202506]

mee too

[nxdht]

same issue

[alex4506]

Using 1.0.1rc1 fix this

[akbararifin]

Using 1.0.1rc1 fix this

Tested with py-clob-client-v2==1.0.1rc1.

The SDK now builds the POLY_1271 order correctly:

1. order.maker = deposit wallet
2. order.signer = deposit wallet
3. signatureType = 3
4. wrapped signature is generated
5. update_balance_allowance(... signature_type=3) succeeds

But POST /order still fails with:

the order signer address has to be the address of the API KEY

Debug:

1. POLY_ADDRESS = EOA owner
2. POLY_API_KEY = derived from EOA
3. order.signer = deposit wallet
4. 4order.maker = deposit wallet

So the SDK-side issue appears fixed in 1.0.1rc1, but the backend still seems to validate order.signer == API key owner, which conflicts with the deposit wallet / POLY_1271 order shape.