Polymarket Session Keys: How API Trading Authorization Works and How Not to Get Robbed With One
Session keys are how a bot trades your account without holding your password: scoped API credentials that can place orders, manage positions, and — depending on scope — move funds. Powerful, convenient, and a favorite scam surface (“send me your session key and I’ll manage your account for you”). Here’s how they actually work and how to issue them without armoring a thief.
What are Polymarket session keys?
API credentials derived from your account that authorize trading operations without re-signing every action with your wallet. They underpin the L2 authenticated endpoints — the mechanics of deriving and using them are in the authentication guide. Conceptually: a session key is a standing authorization. Whoever holds it can act as you within its scope — which is why scope discipline and storage discipline are the whole security model. The session keys deep-dive covers the cryptographic details.
The safe-issuance checklist
- Scope minimally. Issue per use case: a market-making bot needs trading scopes, not withdrawal scopes if avoidable — match the bot architecture principle that the risk layer outranks the strategy.
- One key per consumer. A key shared by your bot and your dashboard means one leak compromises both — issue separately, rotate independently.
- Store like a password. Environment variables or a secrets manager — never in code, never in chat, never in a screenshot (see the hardening guide).
- Rotate on schedule and on suspicion. Quarterly routinely; immediately after any device loss, contractor offboarding, or unexplained account activity.
- Revoke what’s idle. Every active key is attack surface; the quarterly pass includes killing unused keys.
The “account manager” scam
The trust-weaponization pattern: someone offers to trade or “manage” your Polymarket account, asks for your session key (or API credentials), and either drains via trading against their own opposite positions, runs up fees, or uses the account for wash-volume. Variants target newcomers with profit screenshots. Rules with no exceptions: nobody legitimate needs your session key — professionals connect via APIs you control, and anyone who DMs offering management is a scammer (the same first-DM tell as support impersonators). If you already shared: rotate/revoke immediately and audit fills and positions — the account-check sequence applies, minus the seed-panic if the key was the only exposure.
Session keys vs approvals vs delegation
Three standing-authorization mechanisms, different blast radii: session keys act at the API layer (trading operations, revocable server-side); token approvals act on-chain at the token layer (allowances — see WalletConnect safety); 7702 delegations act at the account layer (code at your address — see the explainer). Audit all three layers quarterly; a clean session-key list doesn’t imply clean approvals.
FAQ
What is a session key on Polymarket? A standing API credential authorizing trading operations without per-action wallet signatures — how bots and apps act on your account within their scope. See the mechanics.
Is it safe to share my session key with a trading service? Only services you’d trust with your account — and structurally, you shouldn’t: issue scoped keys per consumer, store them like passwords, rotate on schedule. Anyone who DMs asking for one is a scammer.
What can someone do with my session key? Whatever its scope allows: place and cancel orders, manage positions, potentially transfer funds. Treat a leaked key as account compromise — revoke/rotate and audit fills immediately.
How often should I rotate API keys? Quarterly routinely, immediately after device loss, offboarding, or suspicious activity — see the hardening cadence.
Do session keys expire? Depends on how they’re issued (the optional validity-window fields in the auth scheme cover this — see authentication details). Never rely on expiry as security: rotate and revoke actively.
Educational content, not financial advice. Not affiliated with Polymarket. Last updated October 2026.
