Published on: 31/07/2026
Automated Trading Bots for Prediction Markets, Explained
Kalshi and Polymarket both publish real, documented APIs, and neither one hides that people use them to trade without a human clicking the button. Automated trading bots for prediction markets range from simple scripts that rebalance a position on a schedule to latency-sensitive systems racing to price a headline before anyone else can read it. The APIs are genuinely open. What’s less advertised is who actually wins when a bot goes up against another trader’s order book, and what happens to your bot the moment a rate limit kicks in during the exact five seconds it needed to work.
Key takeaways
- Both Kalshi and Polymarket officially permit automated trading. Kalshi’s API runs under a Developer Agreement you accept just by connecting; Polymarket’s CLOB is built around wallet-signed requests with no separate bot ban in its terms.
- Neither platform’s API rules override the underlying market-conduct or geographic rules. Kalshi bots still answer to CFTC rules against wash trading and spoofing; Polymarket’s international CLOB still geoblocks dozens of jurisdictions regardless of who — or what — is sending the order.
- Real bot activity is already large. One analysis of Polymarket’s public leaderboard found 14 of its 20 most profitable wallets were bots, and a 2025 working paper estimated arbitrage bots extracted roughly $40 million from the platform in a single year.
- The four common strategy types are market making, cross-platform arbitrage, news-triggered execution, and simple rule-based rebalancing — each with a different risk profile and a different amount of infrastructure needed to actually compete.
- These are peer-to-peer order books, not a bookmaker’s price. A bug or a bad assumption doesn’t just cost you money to “the house” — it’s a direct transfer to whichever trader (or bot) was on the other side of the fill.

Do Kalshi and Polymarket actually let you run a bot?
Yes, and both document it rather than merely tolerating it. Kalshi’s API supports REST, WebSocket and FIX connections for its event-contract markets, plus a separate set of endpoints for its perpetual futures product, and using any of it binds you to Kalshi’s API Developer Agreement on connection. Polymarket runs three separate APIs instead — a public Gamma API for market data, a wallet-authenticated CLOB API for order placement and the live book, and a Data API for historical activity — with no login-style API key; every trading request is signed by your Polygon-network wallet.
The practical difference shows up in authentication and rate limiting. Kalshi ties every request to an RSA-signed key generated inside a verified account dashboard, then throttles order-writing endpoints (create, cancel, amend) more tightly than market-data reads through a tiered, account-level budget. Polymarket enforces its limits through Cloudflare on a sliding window and mostly queues excess requests rather than rejecting them outright — WebSocket traffic doesn’t count against the REST caps at all.
| Detail | Kalshi | Polymarket |
|---|---|---|
| API surface | REST, WebSocket and FIX (event contracts + a separate perpetuals API) | Gamma (public), CLOB (REST + WebSocket), Data API (public) |
| Authentication | API key ID + RSA-signed requests, tied to your verified account | Wallet-signed requests (EIP-712 / HMAC headers); no separate API key |
| Rate limiting | Tiered token budgets; order-writing endpoints throttled harder than market data | Cloudflare sliding-window throttling; requests queue rather than hard-reject |
| Official stance on bots | Explicitly permitted under the API Developer Agreement | Explicitly permitted; Builder and Market Maker programs support automated flow |
| Still bound by | CFTC market-conduct rules — no wash trading, spoofing or self-matching | Platform ToS bans manipulation; growing use of third-party surveillance tools |
| Account gate | Government-ID identity verification required before any trading, API or not | No blanket KYC on the international CLOB, but geoblocked by jurisdiction |
Both companies publish the raw specification files developers need — Kalshi ships downloadable OpenAPI and AsyncAPI YAML files, and Kalshi’s own API documentation lists client patterns directly. That’s an unusually open posture for a regulated exchange.
What automated strategies actually look like in practice
“Bot” covers a wide range of sophistication, from a cron job that checks a position twice a day to infrastructure racing in milliseconds. Four categories account for most of what’s actually running against these two order books. If the underlying mechanics of a Yes/No contract are still new to you, our prediction markets guide is worth reading before layering automation on top of them.
Market making: quoting both sides of the spread
A market-making bot posts a resting buy slightly below the current price and a resting sell slightly above it, earning the spread whenever both fills happen without the underlying probability actually moving. Both platforms formalize this: Polymarket runs Builder and Market Maker programs with published rebate and reward endpoints, and Kalshi runs its own liquidity-incentive structure to keep spreads tight on lower-volume contracts. The catch is inventory risk — if the market moves while one side sits unfilled, quoting both sides stops being free money and becomes a directional bet you didn’t choose to take.
Cross-platform arbitrage between Kalshi and Polymarket
The same real-world event is often listed on both exchanges, priced independently by two separate order books that don’t talk to each other. When a Kalshi contract and its Polymarket equivalent drift apart — or a single platform’s Yes and No prices no longer sum to roughly $1 — a bot can buy the cheap side and sell (or short) the expensive one, locking in a spread regardless of the outcome. This isn’t theoretical: a 2025 working paper, “Unravelling the Probabilistic Forest,” estimated arbitrage traders extracted roughly $40 million from Polymarket between April 2024 and April 2025 through exactly this kind of mispricing, and a 2026 report on automation in prediction markets found the edge came from speed, not better forecasting. These windows are real but short, often seconds — which is why the strategy rewards infrastructure spend over market insight. It also gets harder once either side lists something other than a plain binary — see our breakdown of exotic derivatives in prediction markets for how scalar and multi-outcome contracts complicate a simple price comparison.
News-triggered bots reacting faster than a human can read
Some bots skip prediction entirely and simply race the news. One widely cited example traded ultra-short crypto contracts by watching real-time prices on exchanges like Coinbase and Binance and buying the moment Polymarket’s own quote lagged behind them — a pure latency play with no forecasting involved. The same logic applies to text: scanning a headline, a court filing, or a data release the instant it posts, and buying before slower, manual traders finish reading it. It’s the highest-skill, highest-infrastructure category, and the one most linked to bots dominating Polymarket’s public leaderboard.
Simple rule-based bots: rebalancing and stop-loss logic
Not every bot chases an edge. The more common, lower-risk category just automates discipline a human trader already intends to follow: close a position automatically at a set loss threshold, rebalance a basket of related contracts back to target weights on a schedule, or cancel and re-quote an order if the book moves past a defined tolerance. Polymarket’s own GitHub organization publishes an open-source agent framework demonstrating exactly this pattern against its live API, and several independent, MIT-licensed projects extend similar logic across both platforms. A rule-based bot mainly automates a discipline problem rather than a forecasting one — exactly the territory our guide to behavioral biases in prediction markets covers on the human side. It still needs rules that are genuinely well thought out before they run unattended.
The real risks of running a bot on a peer-to-peer market
The mechanics that make these strategies possible are the same ones that make automated trading here riskier than it looks from the outside.
Liquidity compounds the problem. Most prediction-market contracts carry a fraction of the depth of a major currency pair or index future, so a bot large enough to matter moves the price against itself with its own orders — a backtest against yesterday’s book often looks profitable in a way that vanishes once your own size enters the simulation. Rate limits bite hardest at the worst time, too: order-writing endpoints on both platforms are throttled more tightly than market-data reads, and that’s exactly when a breaking headline sends order flow spiking — the bot most likely to be needed is also the one most likely stuck in a queue. The same failure modes show up in algorithmic FX and crypto trading, but shallower books here make each one bite sooner.
What Kalshi’s and Polymarket’s rules actually require
An open API is not the same thing as an unregulated one. Kalshi is a CFTC-designated contract market, so every account — human-operated or automated — needs government-ID verification before it can trade at all, and its Developer Agreement is explicit that API access doesn’t exempt anyone from the Commodity Exchange Act’s bans on wash trading, spoofing and self-matching. A bot that accidentally trades against your own resting order is still self-matching under those rules, regardless of intent.
Polymarket splits into two products with two rulebooks. Its original international CLOB runs on crypto wallets rather than KYC’d brokerage accounts and permits automated trading with no code-level restriction, but geoblocks roughly three dozen jurisdictions and explicitly bans using a VPN to route around that block. Since Polymarket’s roughly $112 million acquisition of the CFTC-licensed exchange QCEX and an amended CFTC order in November 2025, American users instead have a compliant path through the separate, CFTC-regulated “Polymarket US,” which behaves far more like Kalshi on compliance than the original CLOB does. Which rulebook applies to a given bot depends on which of the two products its key or wallet is pointed at, not just which brand name is on the page.

Our verdict: where a bot is worth building, and where it isn’t
If we were choosing where to start: skip the news-latency race first. That category is dominated by infrastructure most individual traders can’t match, and the “$300 into $400,000 in a month” stories are the visible survivors of a much larger pile of bots that never make headlines. A simple, rule-based bot enforcing a stop-loss and rebalancing a position you already intended to manage is the lowest-risk entry point — it automates a decision you’d have made anyway rather than inventing a new edge. Cross-platform arbitrage is genuinely real, backed by published research on actual dollars extracted, but windows are short and increasingly contested by faster competitors. Market making pays through each platform’s reward programs, but it ties up capital and hands you inventory risk the moment the market moves — read the mechanics of how Polymarket’s order book works before assuming quoting both sides is close to free money.
18+. Prediction markets involve real financial risk — contracts can expire worthless, and you should never trade with money you can’t afford to lose. If gambling or trading stops being fun, seek support from a problem-gambling helpline in your country.
Frequently asked questions
Yes. Kalshi’s API Developer Agreement explicitly governs programmatic trading rather than prohibiting it, and Polymarket’s terms carry no separate ban on bots — its CLOB is built around signed wallet requests rather than manual clicks in the first place.
REST, WebSocket and FIX access to its event-contract markets, plus a separate REST/WebSocket API for perpetual futures. Requests are authenticated with an API key ID and an RSA-signed request, and Kalshi publishes downloadable OpenAPI and AsyncAPI specification files for building a client.
Polymarket has no traditional API key — trading requests through its CLOB API are signed by your Polygon-network wallet instead. It also runs a separate public Gamma API for market data with no authentication at all, which most bots use for read-only scanning before signing a trade.
Cross-platform arbitrage and simple rule-based rebalancing are the two most accessible; market making and news-latency trading require considerably more infrastructure and capital to compete against the fastest existing bots.
Thin liquidity magnifying a bug or a bad assumption. Unlike a bookmaker absorbing a loss, Kalshi and Polymarket match your bot’s order directly against another trader’s, so a flawed strategy executed automatically and repeatedly transfers money straight to whoever is on the other side.
On Kalshi, yes — government-ID verification is required for every account before any trading, automated or manual. Polymarket’s international CLOB doesn’t require blanket KYC to trade, though it does geoblock dozens of jurisdictions; its separate, CFTC-regulated Polymarket US product for American users follows a more Kalshi-like verification process.
Only through Polymarket US, the separate CFTC-regulated product launched after Polymarket’s 2025 acquisition of the licensed exchange QCEX. The original international CLOB blocks US persons at the IP level and its terms explicitly prohibit using a VPN to bypass that restriction.