Market orders fail on new email/magic accounts

[gipadm]

Hi Polymarket team,

I am not able to send market orders via clob-client-v2. Here is my setup:

• "@polymarket/clob-client-v2": "1.0.6"
• PM account was recently created using email/magic.
• Account was funded from Deposit -> Cash (credit card).
• Over 10 manual trades are already successfully completed on polymarket.com.

Now here is my sample code with inline comments:

import { ClobClient, AssetType, Side, OrderType } from "@polymarket/clob-client-v2";
import { createWalletClient, http } from "viem";
import { polygon } from "viem/chains";
import { privateKeyToAccount } from "viem/accounts";

const TOKEN = "{any token here}";
const HOST = "https://clob.polymarket.com";
const CHAIN_ID = 137;

// Polymarket Address copied from https://polymarket.com/settings?tab=profile
// Note: Do not send funds to this address. This address is for API use only.
// Address string: 0xABCD...
const POLY_ADDR = process.env.POLYMARKET_API_ADDR;

// Polymarket Private key copied from
// https://polymarket.com/settings?tab=account > https://reveal.magic.link/polymarket
const PRIVATE_KEY = process.env.POLYMARKET_API_KEY as `0x${string}`;

const ACCOUNT = privateKeyToAccount(PRIVATE_KEY);

const SIGNER = createWalletClient({
	account: ACCOUNT,
	chain: polygon,
	transport: http(),
});

const tempClient = new ClobClient({
	host: HOST,
	chain: CHAIN_ID,
	signer: SIGNER,
});

const API_CREDS = await tempClient.createOrDeriveApiKey();
console.log(API_CREDS);
/*
This returns a credential set with values. Note that these values never change.
{
  key: 'xxx-xxx-xxx-xxx-xxx',
  secret: 'yyyyyyyy',
  passphrase: 'zzzzzzzz'
}
*/

const CLOB_CLIENT = new ClobClient({
	host: HOST,
	chain: CHAIN_ID,
	signer: SIGNER,
	creds: API_CREDS,
	signatureType: 3,
});

const balance = await CLOB_CLIENT.getBalanceAllowance({
	asset_type: AssetType.COLLATERAL,
});
console.log(`Balance: ${balance.balance}`);
/*
	This returns the correct account balance!
*/

const tickSize = await CLOB_CLIENT.getTickSize(TOKEN);
console.log(`Tick size: ${tickSize}`);
/*
	This returns a valid tick size!
*/

const order = await CLOB_CLIENT.createMarketOrder({
	tokenID: TOKEN,
	side: Side.BUY,
	amount: 1,
	price: 0.8,
},
{
	tickSize: tickSize,
	negRisk: false
});

console.log(order);
/*
	Note: maker and signer are the same as the POLY_ADDR string
{
  maker: '0xABCD...',
  signer: '0xABCD...',
}
*/

const posted = await CLOB_CLIENT.postOrder(order, OrderType.FOK);

console.log(posted);
/*
	This always returns the following error:
{
  error: 'the order signer address has to be the address of the API KEY',
  status: 400
}
*/

Using signatureType = 0, 1 or 2 returns error: 'maker address not allowed, please use the deposit wallet flow' on postOrder() calls.

I tried forcing creation of fresh credentials using createApiKey() but it fails with response: { error: 'Could not create api key', status: 400 }
If I run deleteApiKey() the client does lose its key but then createApiKey() returns the old key that was just deleted.

What is a working example of sending a market order for newly created email/magic accounts?

[osr21]

Root cause for the POLY_1271 / deposit wallet order rejection cluster

This comment consolidates the related issues (#63, #64, #65, #66, #67, #73, #75, #83) — all are manifestations of the same underlying SDK gap.

### The asymmetry

The V2 SDK correctly handles order *signing* for deposit-wallet accounts (POLY_1271 / sig type 3): it wraps the EIP-712 order hash in an EIP-1271 outer signature using the proxy wallet as verifier. Orders reach the API with the right structure.

The problem is `createApiKey()` / `createOrDeriveApiKey()`: these also require L1 auth, but the SDK sends a **bare EOA signature** (L1_POLYMARKET_DEFAULT) instead of an EIP-1271-wrapped one. The API then stores the API key bound to the *EOA* address, not the deposit proxy. When an order is submitted with the proxy as maker, the key doesn't match:

```
"maker address not allowed, please use the deposit wallet address"
"the order signer address has to be the address of the maker"
```

### Affected account types

| Account | Root cause |
|---|---|
| Email / Magic (new accounts) | Deposit proxy ≠ EOA — key bound to EOA |
| Migrated Gnosis Safe (V1→V2) | Safe is now a deposit proxy, same mismatch |
| POLY_1271 deposit wallet, explicit | L1 auth in `createApiKey` not EIP-1271 wrapped |

### Fix direction

`createApiKey()` and `createOrDeriveApiKey()` need a POLY_1271 branch in the L1 auth header builder — identical to the pattern already applied in order signing. The `SignatureTypeV2` enum has the value; it just isn't used in the auth path.

### Workaround until fixed

Generate credentials via the Polymarket web UI and copy them into your environment as static `CLOB_API_KEY / SECRET / PASSPHRASE`. This bypasses the programmatic key creation entirely.