[kartojal]

Adds server-only Platform API Key attribution and a browser-compatible challenge proxy on top of Predictions routing.

platformApiKey keeps X-API-Key on gateway requests. remotePlatformApiKey calls the complete configured challenge URL, and the SDK signs and completes login directly. Refresh and logout use session credentials without another application key exchange. Existing builder and submission authorization remains available through the optional submissionApiKey adapter.

Gasless actions (wallet deployment, gasless transactions, collateral return and session-key revocation) still require a builder or relayer API key, passed directly or as submissionApiKey. The relayer does not list the Gateway Access Token as a /submit credential, so a bearer session alone does not unlock them. The four actions reject a missing key with UserInputError before any signing.

Saved L2 credentials migrate directly through /v1/auth/migrate, even with a remote challenge adapter, without proxying the proof or asking for a new wallet signature. Remote challenge configuration adds no attribution to that migration. Use a server platformApiKey when platform attribution is required. All public session credentials remain plain bearer pairs.

Requests that carry credentials have them redacted from errors, and submission SigningError failures keep their type while untrusted causes are removed. Requests without credentials keep their original response and failure cause. The protected transport reads the global fetch per request, so a later patch of fetch (MSW, tracing) still applies. The adapter factories export PlatformApiKeyError and RemotePlatformApiKeyError.

Rebased onto the current #463 head, including its credential-family signing scope. Gateway headers wrap the scoped API-key headers.

Inherits #437's setup-failure session revocation and deferred new-session credential notifications.

Stack: #442 → #481 → #437 → #463 → #438 → #441.

Validation on 2026-11-03: build, lint and workspace typecheck pass, and 1,128 client tests pass. The live integration suites for public reads pass against production, except the three base-branch failures noted in #463. Live production checks on the previous head covered signed login, automatic saved-L2 migration, authenticated reads, bearer restoration and refresh, and logout with rejected refresh reuse. No trading, transfers, approvals or wallet deployment were performed.

Human approval and outstanding review threads have not been resolved automatically.

---

Note

Medium Risk
Changes authentication header wiring, challenge routing, and error redaction on gateway and secure clients; mistakes could leak keys or break login, though behavior is heavily tested and builder adapters are unchanged.

Overview
Adds Platform API Key support so apps can bind gateway sessions to server-issued application identity without exposing secrets in the browser.

Server: platformApiKey (from @polymarket/client/node) sends X-API-Key on Predictions gateway traffic (challenge, login, migrate, authenticated routes) while refresh and logout stay bearer-only. Browser: remotePlatformApiKey POSTs only signer / optional wallet fields to a configured challenge URL; login, refresh, and logout still hit the gateway directly. createPlatformChallenge on the node entry supports backend challenge routes.

The apiKey slot can now carry a platform adapter; existing builderApiKey / relayerApiKey / remoteBuilderSigning remain via optional submissionApiKey. Gasless paths (deploy, gasless txs, collateral return, session-key revoke) still require submission credentials—platform attribution alone does not enable gasless.

Login uses requestOwnershipChallenge (gateway or proxy createChallenge) instead of hard-coded challenge POSTs. Gateway headers are merged through authorizeGateway on public and secure Predictions clients. Credential redaction and generic auth transport errors are tightened in protectRequestErrors (including SigningError propagation through ServiceClient); requests without secrets pass through unchanged.

New docs (platform-api-keys.md) and binding types for ownership challenge requests; extensive contract tests and browser/node export boundaries.

^{Reviewed by Cursor Bugbot for commit 7a19092. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 4106448. Configure here.}