Three Polymarket CLOB gotchas: 401, "invalid signature", and a cancel that does nothing

Automating Polymarket with py-clob-client, I lost an embarrassing amount of time

to three failures that aren't clearly documented anywhere. Here they are with the

exact fixes, so you don't.

1. Your cancel returns 404 — because the endpoint isn't what you'd guess

The intuitive DELETE /order/{id} returns 404 and your order silently stays open.

The real endpoint is:

DELETE /order

body: {"orderID": "0x..."}      # and the body is part of the signature

Sign request_path = "/order" together with that body, then send the exact body.

Miss this and your "canceled" orders keep resting on the book.

2. 401 Unauthorized that "should work"

Authenticated calls need L2 HMAC headers, and the most common silent mistake is

POLY_ADDRESS: it must be your wallet address, not the api_key. The reliable

move is to let py-clob-client build the headers via create_level_2_headers from

correctly-formed RequestArgs (method, request_path, body, serialized_body) — and

make sure the serialized body you sign is byte-for-byte the body you send.

3. invalid signature = SignatureType / funder mismatch

Nine times out of ten this is the SignatureType not matching how your wallet holds

funds:

0 = EOA               funder = your own wallet (holds USDC)

1 = POLY_PROXY        funder = the proxy address (email/magic wallet)

2 = POLY_GNOSIS_SAFE  funder = the safe address

Signing as an EOA while pointing funder at a proxy (or vice-versa) yields

invalid signature with no further hint.

Bonus: the fill you read is wrong

For a BUY, the shares you got are in takingAmount; for a SELL, they're in

makingAmount (takingAmount is the USDC). Read the wrong field and your accounting

drifts, which then triggers resubmits and balance errors.

I packaged the cancel/auth/fill helpers as a small MIT library:

https://github.com/BlueWhale-Quant-Lab/polymarket-401-invalid-signature-cancel-order

(For the harder production bits — reading /data/trades for reconciliation, where

the field is match_time and the response is paged; and timeout-idempotency so an

aiohttp timeout doesn't double-fill — there's a PRO build linked from the repo. But

the free helpers above clear the three errors most people hit first.)

This is request/response plumbing and public-data reconciliation — not order

placement advice or any profit claim.