Market signal
Polymarket CLOB credential boundary
Evergreen NOVA operator education for guarded Polymarket BTC signal execution.
View market source →Polymarket automation starts with a credential boundary. If that boundary is loose, every other control becomes weaker.
NOVA uses Polymarket CLOB API credentials plus a dedicated limited-wallet signing key for execution setup. It does not need a wallet seed phrase, main wallet key, or unrestricted wallet access. That line matters because CLOB credentials are made for trading requests, while seed phrases and main wallet keys control more than this setup should touch.
The boundary is not just a security preference. It is part of the product design. A guarded BTC automation setup should use the narrowest access that can support the approved task.
The difference operators should care about
The CLOB is Polymarket's central limit order book. CLOB credentials let software make authenticated trading requests when the account is configured for that use. They are not the same thing as giving away the wallet's root control.
For NOVA, the credential handoff is only one part of setup. The system still needs payment verification, risk settings, and a no-submit check before any live automation is considered. A valid credential does not mean a live order should happen.
Operators should separate these layers:
- TradingView script access.
- Alert or webhook delivery.
- Venue credential validation.
- No-submit execution preview.
- Live order approval.
One layer passing does not approve the next layer automatically.
What NOVA asks for
NOVA asks for the information needed to check and use the Polymarket CLOB path for the approved setup. The exact fields can change as Polymarket updates its API, but the principle does not change: use the narrowest trading credential that supports the task.
The setup flow should confirm:
- The account is the account the operator intends to use.
- The API credential can be checked without placing an order.
- The configured risk cap matches the operator's approved amount.
- The first run can stay in no-submit mode until the operator is ready.
- The operator can revoke or rotate access later.
- The system can log credential check status without logging secrets.
NOVA should never store private keys, wallet seed phrases, or decrypted venue credentials in source, fixtures, browser storage, or public files. The setup should prove access without turning secret handling into a support shortcut.
What NOVA never asks for
Do not paste a seed phrase into a setup form. Do not send a signing key in chat. Do not give a tool broader wallet control than it needs.
If a trading tool asks for the keys that control the whole wallet, pause. That may be normal for a self-custody script you write and run yourself, but it is not the boundary NOVA uses for managed setup.
Also avoid sending credentials through chat, screenshots, or email. A credential flow should have a defined form, vault, or review path. Informal credential handoffs are how small setup tasks become large security problems.
Why this matters for BTC 15-minute windows
Short market windows create pressure. Pressure is where sloppy credential handling happens. A trader sees a window forming, wants automation live fast, and skips the boring checks.
NOVA is built to slow that part down. The setup can move quickly after the facts are clear, but credentials, payment, and risk caps still need to pass before live mode.
That matters because a valid key does not prove the next order is safe. The system still has to confirm the market window, side, size, stale-signal rules, and cap. Credential safety and execution safety work together.
Credential review checklist
Before approving a bot or managed setup, confirm:
- The tool explains exactly why each credential is needed.
- The tool does not ask for a seed phrase.
- The tool does not ask for a main wallet key in chat.
- The setup can validate access without placing an order.
- No-submit mode runs before live mode.
- The operator knows how to revoke access.
- Logs avoid secret values.
If the product cannot pass this checklist, keep it in alert-only mode.
The operator takeaway
Treat API credentials as a scoped tool, not a trust shortcut. NOVA's job is to help create a guarded path from signal to execution. The credential boundary is where that path starts.
The safest automation pitch is not "give us everything and we will handle it." It is "here is the narrow access needed, here is how we test it, and here is where live orders remain blocked until approved."