Authentication

Browser login requests nansen:api for API-key-equivalent account API permissions; existing OAuth/MCP nansen:read semantics and separate wallet authorization are unchanged.

Before any research command or loop, require an explicitly selected API key or saved browser session. Run nansen auth status first. Its cached/unverified metadata does not prove credential validity or unlocked storage. Cached access-token expiry alone does not mean the session is unusable: the CLI normally renews a selected session automatically during an already-authorized research task, without another consent request or a separate account check. Stop on anonymous selection, invalid authentication state, blocked or uncertain renewal/cleanup, or an actual authentication failure, including rejected or expired refresh authority. Follow the CLI error guidance; use the free nansen account check when troubleshooting calls for it. Do not unset a failed key, erase a session or switch to anonymous access to retry.

Use nansen login for fresh browser approval when server admission and the supported platform cohort are enabled, or configure a conventional API key. NANSEN_API_KEY overrides the saved session. OpenClaw's optional primaryEnv mapping preserves configured API-key injection; it is not a required-key gate or proof of authentication. Normal credits and entitlements apply. Login does not purchase credits. Browser rollout acceptance is still pending.

Anonymous x402 is a separate paid workflow: without a selected credential, the CLI can automatically spend funds from its configured wallet on a supported 402 challenge, once per call, including calls in loops. Do not run this research workflow anonymously. Anonymous payment requires separate explicit user intent and payment setup; it is never a fallback for failed authentication.

PM Suspicious Wallet Scanner

Answers: "Are there wallets with suspicious trading patterns in this Polymarket market?"

# 1. Find the resolved market
nansen research prediction-market market-screener --query "<market name>" --status closed --limit 5
# → market_id, question, volume, last_trade_price

# 2. Get top winners (positive PnL) — paginate if needed, keep per_page <= 10
MID=<market_id>
nansen research prediction-market pnl-by-market --market-id $MID --limit 10
# → address (proxy), owner_address (wallet), side_held, net_buy_cost_usd, total_pnl_usd

# 3. For each top winner, run these three calls (use proxy address for PM, owner for profiler):
PROXY=<address_from_pnl>
nansen research prediction-market trades-by-address --address $PROXY --limit 100
# → market_id, market_question, side, price, size, usdc_value, taker_action, timestamp

OWNER=<owner_address_from_pnl>
nansen research profiler historical-balances --address $OWNER --chain polygon --days 365 --sort block_timestamp:asc --limit 100
# → block_timestamp, value_usd, token_symbol — first non-zero value_usd = wallet funding date

nansen research profiler labels --address $OWNER --chain polygon
# → label, category

For each winner, compute ROI = total_pnl_usd / net_buy_cost_usd * 100 (skip ROI flags if net_buy_cost_usd <= 0), then score (0–13). Within each tier group, apply only the highest matching flag:

Flagged at score >= 3. High risk at >= 7. High-confidence suspicious pattern: NEW_WALLET + SINGLE_MARKET + EXTREME_ROI (score 9+).

If owner_address is invalid (e.g. "0x"), use the proxy address for profiler calls too. If historical-balances returns no records with value_usd > 0, the wallet may predate the 365-day window — treat wallet age as unknown and skip NEW_WALLET / YOUNG_WALLET flags. Pause ~1.5s between wallets to avoid rate limits. Skip wallets that error and continue scanning.