I built in-app Polymarket copy trading with MetaMask EIP-712 — no private keys, no redirects, one click

I just shipped one-click copy trading on WhaleTrack — here's
the architecture that makes it work without ever touching a
private key.

The Problem

Polymarket's CLOB API needs two auth layers:

1. EIP-712 order signing
2. HMAC-SHA256 HTTP auth

Most tutorials store private keys server-side. That's a
security nightmare.

The Solution — Split Architecture

• Backend builds the unsigned order + fetches live price
• MetaMask signs EIP-712 typed data client-side
• Backend attaches HMAC headers and proxies to CLOB

The user's private key never leaves MetaMask. Ever.

The Flow

Step 1 — Fetch unsigned order params
\

const res = await fetch(`/api/trade-params?slug=${slug}
  &outcome=${outcome}&amount=${amount}&address=${address}`);
const { domain, types, order } = await res.json();
\```



**Step 2 — MetaMask EIP-712 sign**
\

```js
const signature = await window.ethereum.request({
  method: 'eth_signTypedData_v4',
  params: [address, JSON.stringify({ domain, types, 
    primaryType: 'Order', message: order })]
});
\```



**Step 3 — Backend HMAC proxy**
\

```js
const message = timestamp + 'POST' + '/order' + body;
const secret  = Buffer.from(apiSecret, 'base64');
const sig     = crypto.createHmac('sha256', secret)
                      .update(message).digest('base64');
\```



## Result

See whale bet → click Copy Bet → sign in MetaMask → 
order on Polymarket. Under 60 seconds.

Connect via MetaMask wallet or Polymarket API key.

👉 whaletrack.app — free, no signup

Would love feedback from devs on the architecture. 
What would you do differently?