AI & Agent Policy

Authenticate with an Agent API Key

If you are an autonomous or AI-powered client doing anything beyond reading public marketing pages, authenticate with an Agent API Key. Session scraping from a headless browser is challenged by bot detection and is not a supported access pattern.

Agent API Keys are prefixed ptk_ and must be sent as Authorization: Bearer ptk_…. Scopes (signals:read, trade:execute, agent:scan, agent:full) are listed in the API docs.

Automation-safe lanes

Static discovery paths are anonymous: /api/openapi.json, /llms.txt, /skill.md, /robots.txt, /sitemap.xml, and the GET /api/mcp health probe.

Programmatic data and tool lanes avoid browser bot challenges but still enforce their own authentication: /api/public/** and MCP POST or event requests require an eligible Agent API Key; direct /api/webhooks/** management requires a signed-in session or Supabase access-token JWT. Agent API Key clients can manage webhooks through the agent:full MCP tools.

Third-party inbound webhook paths (for example, payment and on-chain data providers) validate their own signatures — do not send requests there without a valid payload.

Rate limits

All authenticated endpoints are rate-limited per user, per Agent API Key, and per IP. Rate-limit tiers, 429 response shapes, and the Idempotency-Key contract for /api/trade/execute are documented in the API docs.

Respect Retry-After headers. Requests that continuously ignore 429 responses will be blocked at the firewall level.

Verified crawlers

We allowlist Vercel-verified crawlers (GPTBot, ClaudeBot, PerplexityBot, Googlebot, Bingbot, and others) to index our public pages unimpeded. That allowlist does not extend to custom agents built on the OpenAI or Anthropic SDKs — those must authenticate with an Agent API Key.

Training & crawling policy

Public marketing pages (e.g. /, /pricing, /docs, /docs/api, /what-is-copy-trading, /polymarket-mock-trading-api, and our other Polymarket guide pages) may be crawled and cited.

Dashboard pages, user data, and anything behind a session are off-limits for training corpora.

Do not scrape Polymarket data through our session endpoints. Use the Agent API Key lane and the documented endpoints instead.

Machine-readable version

A concise machine-readable entry point for AI agents and automated clients is available at /llms.txt. The OpenAPI contract is the source of truth for REST endpoints and request or response shapes; /docs/api is canonical for authentication, tier, and rate-limit guidance.

Contact

Questions about automated access, Agent API Key scopes, or abuse reports: support@polytrackers.com.