Identify the account that holds the assets
Start with the public account-wallet address shown by the official Polymarket interface and the network. The address that signs an instruction may be different from the smart wallet holding positions. A browser-extension account and a Polymarket account wallet should not be treated as interchangeable merely because the same person controls them.
Polymarket currently documents Deposit Wallets and legacy Proxy and Safe wallets. Available authorization flows depend on the wallet type. Ask a tool to identify the supported model instead of following a generic tutorial that assumes every account has the same signing or approval setup.
Separate four kinds of access
A read-only address does not need your recovery phrase. Conversely, an approval can remain active after a website is disconnected. A tool calling itself non-custodial does not tell you which of these permissions it receives or what damage misuse could cause.
| Layer | What to inspect | How to verify access ended |
|---|---|---|
| Website connection | Connected site and disclosed public account | Remove the connection; inspect other layers separately |
| API authentication | Credential owner and accessible account records | Follow the provider’s supported credential revocation flow |
| Delegated signer or session | Authorized signer, scope, expiry and wallet type | Verify the signer is inactive and check outstanding work |
| Token approval | Network, token contract, spender/operator and allowance | Read the confirmed allowance or operator status |
A software spending limit may not be a wallet limit
Imagine a fictional bot interface with a $10 daily limit. That number could be only a setting enforced by the bot process. It does not prove the wallet or contract rejects an eleventh dollar. Ask where the limit is checked, which actor can change it and whether a compromised worker could bypass it.
ERC-20 allowances and ERC-1155 operator approvals also express different authority. Standard ERC-1155 operator approval is broad within that token contract; it is not a per-order dollar cap. Inspect the exact transaction or signature request, including the network and recipient contract, instead of inferring a limit from a button label.
Treat session access as a specific feature, not a slogan
Polymarket’s current Session Keys feature is in beta and applies to Deposit Wallets. Its documentation describes a separate trading signer with venue scope and no withdrawal ability. This does not make delegated trading harmless: unwanted trades can still create losses.
Check the documented expiry and revocation behavior rather than assuming the tool supports a custom duration. At review time, the documentation describes a fixed 180-day authorization and says shorter configurable expirations are not supported. Ending access earlier requires revocation. This is Polymarket documentation, not a claim that SharkRule has shipped Session Keys integration.
Verify a shutdown across all active layers
The current session revocation flow can return after registry access ends while cancellation and on-chain work continue asynchronously. Therefore, a successful revocation response is not the whole shutdown report. Keep separate entries for permission state and order state. Never respond to a suspicious signature request simply because it is labeled “revoke.”
- Stop the automation process so it cannot create new work.
- Review open orders and already filled positions under the submitting account scope.
- Use the official, supported flow to revoke the relevant session or credentials.
- Check whether any remaining token approvals need separate revocation; verify the right wallet, network and contract.
- Wait for the appropriate confirmation and inspect current permission state.
- Refresh outstanding orders, trades and positions before declaring the shutdown complete.
Keep useful evidence without creating another secret leak
Keep the tool’s official domain, public wallet and signer addresses, permission scope, relevant transaction identifiers and time checked. Do not paste a seed phrase, private key, API secret, full authentication header or reusable signature into a spreadsheet, chat or issue report. Public blockchain activity can still reveal personal patterns when combined with other information.
If you suspect a seed phrase or owner key has been exposed, disconnecting a site or revoking one allowance does not repair that key. Stop using the suspected tool and consult the wallet provider’s official incident guidance from a trusted route. The public SharkRule waitlist asks for no wallet credentials and performs no revocations or trades.
Custody, permissions and eligibility
Non-custodial means funds remain in a user-controlled wallet; it does not remove trading permissions, smart-contract risk or the possibility of loss. SharkRule is independent from Polymarket, with no affiliation or endorsement implied. This is software education, not financial or investment advice. Trading eligibility follows current Polymarket geographic restrictions.
Check current geographic restrictionsFrequently asked questions
Does disconnecting the site remove token approvals?
No. The website connection and on-chain approval are separate. Inspect and revoke the relevant approval through a supported flow when appropriate.
Does non-custodial mean a bot cannot lose my money?
No. Trading permissions can create unwanted positions or losses even when the tool cannot withdraw funds.
Can this guide revoke a permission for me?
No. It provides an inventory and verification sequence. Use official tools appropriate to your actual account and network; this page never connects a wallet.
Your working worksheet
Save a copy and fill in the fields locally. Use public identifiers only; never include passwords, private keys, seed phrases or API secrets. This is a planning document, not an account connection or trading tool.
Download the worksheet (.txt)Sources and further reading
How this guide was prepared
Prepared with AI assistance using the official sources linked above. The numerical examples and decision boundaries were checked with local, deterministic test fixtures. No live trades, performance backtest or independent expert review was conducted. Documentation was checked on 12 September 2026; check the linked provider guidance for later changes.