Build a trading bot

npm i @kashdao/sdk
export KASH_API_KEY="kash_test_…"        # staging key
export KASH_WEBHOOK_SECRET="whsec_…"     # from the webapp, for step 4

import { KashClient } from '@kashdao/sdk';

const kash = new KashClient({ apiKey: process.env.KASH_API_KEY! });
// kash_test_* → https://api-staging.kash.bot/v1  (Base Sepolia)
// kash_live_* → https://api.kash.bot/v1

const { data: markets } = await kash.markets.list({ status: 'active' });
const market = markets[0];

const quote = await kash.quotes.buy({
  marketId: market.id,
  outcomeIndex: 0,
  amountUsdcAtomic: 10_000_000n,   // 10 USDC into outcome 0
});

// quote.amountOut = outcome tokens you'd receive; quote.pricesAfterWad = post-trade prices
console.log('would receive', quote.amountOut, 'tokens');

import { randomUUID } from 'node:crypto';

const trade = await kash.trades.create(
  { marketId: market.id, outcomeIndex: 0, side: 'buy', amount: '10' },
  { idempotencyKey: randomUUID() },
);

console.log(trade.id, trade.status, trade.idempotent ? '(replayed)' : '(new)');

if (trade.confirmation) {
  // trade.confirmation = { token, expiresAt } — the token is shown once, here.
  await kash.trades.confirm(trade.id, { token: trade.confirmation.token });
}

import express from 'express';

const app = express();

// IMPORTANT: verify against the RAW body, so capture bytes, don't pre-JSON-parse.
app.post('/webhooks/kash', express.raw({ type: 'application/json' }), async (req, res) => {
  const raw = req.body.toString('utf8');
  const signature = req.header('X-Kash-Signature') ?? '';
  const eventId = req.header('X-Kash-Event-Id') ?? '';

  let event;
  try {
    // Verifies the HMAC signature + timestamp, then parses. Throws on a bad signature.
    event = await kash.webhooks.constructEvent(raw, signature, process.env.KASH_WEBHOOK_SECRET!);
  } catch (err) {
    return res.status(400).send('invalid signature');
  }

  if (alreadyProcessed(eventId)) return res.status(200).send('dup');  // your idempotency store

  switch (event.type) {
    case 'trade.completed': /* position is live */ break;
    case 'trade.failed':
    case 'trade.rejected': /* surface + retry policy */ break;
    case 'trade.confirmation-required': /* call kash.trades.confirm */ break;
  }
  res.status(200).send('ok');   // 2xx fast; do slow work out of band
});

const settled = await kash.trades.waitForCompletion(trade.id);
console.log(settled.status);   // 'completed' | 'failed' | 'rejected'

const summary = await kash.portfolio.get();                       // account-wide
const { data: positions } = await kash.portfolio.positions({ marketId: market.id });

const res = await fetch('https://api-staging.kash.bot/v1/redemptions', {
  method: 'POST',
  headers: { 'X-API-Key': process.env.KASH_API_KEY!, 'Content-Type': 'application/json' },
  body: JSON.stringify({ marketId: market.id, outcomeIndex: 0 }),
});
// 201 new claim · 200 duplicate (original returned) · 409 POSITION_NOT_CLAIMABLE
// · 404 REDEMPTIONS_NOT_ENABLED (feature off for your org)
const redemption = await res.json();

import {
  KashRateLimitError,
  KashAuthorizationError,
  KashValidationError,
  KashConflictError,
} from '@kashdao/sdk';

try {
  await kash.trades.create(/* … */);
} catch (err) {
  if (err instanceof KashRateLimitError) {
    await sleep(err.retryAfterSeconds * 1000);   // seconds, honour it
  } else if (err instanceof KashConflictError) {
    // e.g. duplicate idempotency key with a different body, or already-claimed
  } else if (err instanceof KashAuthorizationError) {
    // missing scope / IP not allowed — fix the key, don't retry
  } else if (err instanceof KashValidationError) {
    // 400 — bad input; inspect err and fix the request
  } else {
    throw err;
  }
}