I built in-app Polymarket copy trading with MetaMask EIP-712 — no private keys, no redirects, one click
I just shipped one-click copy trading on WhaleTrack — here's the architecture that makes it work without ever touching a private key. The Problem Polymarket's CLOB API needs two auth layers: EIP-712 order
I just shipped one-click copy trading on WhaleTrack — here's
the architecture that makes it work without ever touching a
private key.
The Problem
Polymarket's CLOB API needs two auth layers:
- EIP-712 order signing
- HMAC-SHA256 HTTP auth
Most tutorials store private keys server-side. That's a
security nightmare.
The Solution — Split Architecture
- Backend builds the unsigned order + fetches live price
- MetaMask signs EIP-712 typed data client-side
- Backend attaches HMAC headers and proxies to CLOB
The user's private key never leaves MetaMask. Ever.
The Flow
Step 1 — Fetch unsigned order params
\
const res = await fetch(`/api/trade-params?slug=${slug}
&outcome=${outcome}&amount=${amount}&address=${address}`);
const { domain, types, order } = await res.json();
\```
**Step 2 — MetaMask EIP-712 sign**
\
```js
const signature = await window.ethereum.request({
method: 'eth_signTypedData_v4',
params: [address, JSON.stringify({ domain, types,
primaryType: 'Order', message: order })]
});
\```
**Step 3 — Backend HMAC proxy**
\
```js
const message = timestamp + 'POST' + '/order' + body;
const secret = Buffer.from(apiSecret, 'base64');
const sig = crypto.createHmac('sha256', secret)
.update(message).digest('base64');
\```
## Result
See whale bet → click Copy Bet → sign in MetaMask →
order on Polymarket. Under 60 seconds.
Connect via MetaMask wallet or Polymarket API key.
👉 whaletrack.app — free, no signup
Would love feedback from devs on the architecture.
What would you do differently?
Originally published by Dev.to WebDev. Aggregated on AIWithGhost for educational purposes — full credit and traffic to the original publisher.