Environment Variables¶

Configuration via environment variables.

Required Variables¶

Polymarket¶

Variable	Description	Example
`POLY_PRIVATE_KEY`	Ethereum private key (hex, no 0x prefix)	`abc123...`
`POLY_API_KEY`	CLOB API key	`pk_...`
`POLY_API_SECRET`	CLOB API secret	`sk_...`
`POLY_API_PASSPHRASE`	CLOB API passphrase	`passphrase123`

Kalshi (Production)¶

Variable	Description	Example
`KALSHI_KEY_ID`	API key identifier	`key_abc123`
`KALSHI_PRIVATE_KEY`	RSA private key (PEM format)	See below

Kalshi (Demo)¶

For testing with Kalshi's demo environment (mock funds, no real money):

Variable	Description	Example
`KALSHI_DEMO_KEY_ID`	Demo API key identifier	`demo_key_abc123`
`KALSHI_DEMO_PRIVATE_KEY`	Demo RSA private key (PEM format)	See below

Use with --kalshi-demo flag. See Kalshi Demo Environment to create demo credentials.

RSA Key Format¶

The KALSHI_PRIVATE_KEY must be in PEM format:

-----BEGIN RSA PRIVATE KEY-----
MIIEpAIBAAKCAQEA...
...
-----END RSA PRIVATE KEY-----

When setting in shell, use quotes to preserve newlines:

export KALSHI_PRIVATE_KEY="-----BEGIN RSA PRIVATE KEY-----
MIIEpAIBAAKCAQEA...
-----END RSA PRIVATE KEY-----"

Or use a file:

export KALSHI_PRIVATE_KEY="$(cat /path/to/key.pem)"

Optional Variables¶

Variable	Description	Default
`RUST_LOG`	Log level	`info`

Security Best Practices¶

Never commit credentials

Add .env to .gitignore
Use secret management in production (AWS Secrets Manager, Vault, etc.)
Rotate keys regularly

Using .env Files¶

For local development, create a .env file:

# .env (DO NOT COMMIT)
POLY_PRIVATE_KEY=your_key_here
POLY_API_KEY=your_key_here
POLY_API_SECRET=your_secret_here
POLY_API_PASSPHRASE=your_passphrase_here
KALSHI_KEY_ID=your_key_id_here
KALSHI_PRIVATE_KEY="-----BEGIN RSA PRIVATE KEY-----
...
-----END RSA PRIVATE KEY-----"

Production¶

In production environments:

Use environment-native secret management
Inject secrets at runtime
Avoid writing secrets to disk
Use IAM roles where possible

Verification¶

Verify your configuration with:

cargo run --manifest-path arbiter-engine/Cargo.toml -- --check-connectivity

This validates credentials without starting the trading loop.