I built in-app Polymarket copy trading with MetaMask EIP-712 — no private keys, no redirects, one click

I just shipped one-click copy trading on WhaleTrack — here's
the architecture that makes it work without ever touching a
private key.

The problem: Polymarket's CLOB API needs two auth layers:

1. EIP-712 order signing
2. HMAC-SHA256 HTTP auth

Most tutorials store private keys server-side. That's a security
nightmare.

My solution — split architecture:

• Frontend fetches unsigned order params from backend
• MetaMask signs the EIP-712 typed data client-side
• Backend attaches HMAC headers and proxies to CLOB

The user's private key never leaves MetaMask. Ever.

The flow:
GET /api/trade-params → unsigned order struct
↓
MetaMask eth_signTypedData_v4
↓
POST /api/trade → HMAC proxy → clob.polymarket.com/order

Built on Vercel serverless + Upstash KV for credential storage.

Full writeup + code breakdown in the comments.

👉 whaletrack.app — live and free