What Are Session Keys?
When you sync your trading session, Predicade creates API credentials (called L2 keys) that authenticate your requests to the Polymarket CLOB. These credentials consist of three parts:- API Key - Your unique identifier
- Secret - Used to sign requests (HMAC-SHA256)
- Passphrase - Additional authentication factor
How They’re Created
Session keys are derived from your wallet signature:- You sign an EIP-712 message with your wallet (L1 authentication)
- This signature proves you own the wallet
- API credentials (L2) are generated from this signature
- Credentials are stored locally in your browser only
Your private key never leaves your wallet. The signature process proves ownership without exposing your key.
What Session Keys Can Do
| Action | Allowed |
|---|---|
| View your balances | Yes |
| View your positions | Yes |
| View your open orders | Yes |
| Cancel your orders | Yes |
| Post orders you’ve signed | Yes |
What Session Keys Cannot Do
| Action | Allowed |
|---|---|
| Withdraw your funds | No |
| Create orders without your signature | No |
| Access other wallets | No |
| Transfer tokens | No |
Where Keys Are Stored
Your session keys are stored in your browser’s local storage. This means:- Predicade never sees your keys - They exist only on your device
- Keys don’t sync across devices - You need to create new keys on each device
- Clearing browser data removes them - You’ll need to sync again
When You Need to Re-Sync
You’ll see a “Sync Trading Session” prompt when:- You’re using a new browser or device
- You cleared your browser data
- Your session expired (security rotation)
- You previously disconnected
Security Model
Predicade uses the same authentication system as Polymarket itself through the Builder Program:Non-Custodial
Your funds stay in your Gnosis Safe. Neither Predicade nor Polymarket can access them.
Signature Required
Every trade requires your wallet’s cryptographic signature.
Local Storage
API keys never leave your browser or get sent to Predicade servers.
Revocable
Disconnect anytime to invalidate your session.