Are bots allowed on Polymarket? What the rules, the API and the geo-blocks actually say

The short answer

Yes. Polymarket's order book — the CLOB — is designed to be traded by software. It has a documented REST API, WebSocket feeds for live prices and your own fills, official client libraries, and Polymarket itself publishes an open-source framework for building AI agents that trade on it. Nothing about running a bot is against the rules.

What the rules care about is what the bot does. The rest of this guide is about that, and about the part most people get wrong: where the bot is allowed to trade from.

What is not allowed

Polymarket's terms of use read like any exchange's, and a bot is bound by them exactly as you are. The conduct that gets accounts restricted and positions frozen:

• Market manipulation. Spoofing (placing orders you intend to cancel to move the price), layering, painting a price into resolution. A market-making bot that quotes honestly is fine; a bot that flashes size to bait copiers is not.
• Wash trading. Trading with yourself across wallets to fake volume, farm rewards or climb a leaderboard. Copy-trading leaderboards make this tempting, which is why the people who run them look for it.
• Trading on information you should not have. The insider-trading cases of 2025 — accounts that bet on outcomes they had private knowledge of — are the reason prediction markets now get regulatory attention. The CFTC-regulated US venue runs exchange-grade surveillance; the international venue is watched by its own compliance team and by a very attentive community of on-chain sleuths.
• Evading restrictions. Multiple accounts to get around a limit, or a VPN to get around a geo-block.
• Abusing the infrastructure. Hammering endpoints past the rate limits, or scraping in ways that degrade the service for everyone.

None of these are bot-specific. A bot just makes them easier to do at scale — and easier to detect, because software leaves patterns.

Rate limits are rules too

The API is free to call, and it is throttled twice over. At the edge, per IP, limits apply in ten-second windows — the order-book and price endpoints each allow 1,500 requests per window, the Gamma market list 300, order placement 5,000 in a burst — and a client that exceeds them gets throttled or refused. Since July 2026 there is a second layer, per signing key: token buckets for placing and cancelling orders that refill at a rate set by your 30-day trading volume, with 429 responses that now carry Retry-After and remaining-budget headers when you run dry.

Practically, that means a polite bot does three things: it subscribes to the WebSocket market channel instead of polling the book, it batches orders where the API allows (up to fifteen per request), and it backs off on 429 for as long as the headers say rather than retrying in a tight loop. A bot that ignores this is not breaking a law; it is writing itself out of the market for the next ten seconds, usually at the worst time. The API guide has the current shape of the limits and where to read the exact numbers.

Where bots are allowed to trade

This is the part that matters most and gets skipped most. The international Polymarket order book — the one every bot in this catalog is built for — will not accept new orders from more than thirty jurisdictions, the United States, the United Kingdom, France, Germany, Australia, Brazil, several Canadian provinces and Russia among them. In those places accounts are close-only: you can exit positions but not open new ones. A handful of sanctioned territories are blocked outright. Reading market data is open everywhere; placing orders is not. A bot does not change that: it talks to the same API from the same IP under the same terms — and Polymarket publishes a geoblock endpoint on polymarket.com that returns whether the calling IP may trade, which a well-built bot checks before it sends its first order.

Separately, Polymarket US opened on 3 December 2025 as a CFTC-regulated designated contract market operated by QCX LLC, after the CFTC approved Polymarket's return in November 2025. It is the only Polymarket product a US resident can lawfully use, it requires identity verification, and — as of this writing — it is not available in every state. It is a different venue with a different rulebook, and software built for the international CLOB does not simply point at it.

So "is my bot allowed" has two answers: the bot is fine, and whether you may trade at all depends on where you sit. Every listing here that mentions the US does so in the pricing note, and the honest ones say it plainly: Polymarket geo-blocks several jurisdictions, including the US.

Hosted bots and managed trading

One more distinction. A bot you run yourself is your trading. A vendor that runs a bot on your behalf, holding your keys or your funds, is offering a service — and depending on where they and you are, that service may be regulated activity, or it may be the kind of arrangement where the vendor disappears with the funds. That is not a legal opinion, because this is not legal advice; it is the reason the catalog notes, for every listing, whether the bot is self-hosted and non-custodial.

A practical checklist

1. You are in a jurisdiction where trading on the venue is permitted, without a VPN.
2. The bot trades one account — yours — and does not coordinate with others.
3. It does not spoof, layer or trade against itself.
4. It respects rate limits: WebSocket feeds, batched orders, back-off on 429.
5. Its keys are yours to revoke, and the wallet holds only what you are prepared to lose.
6. You keep your own records; taxes on prediction-market gains are your problem in every jurisdiction we know of.

Do those six and the question "is it allowed" stops being interesting — which is exactly how it should be.