What you can build
Three market kinds, one engine.
Prediction markets, spot exchanges and price discovery for anything with a bid and an ask. Every kind runs the same price-time priority matching and the same ledger; what changes is what a position holds and how it settles.
Simulated five minute candles for the three markets in the book above, on a fixed seed: the same book, the same history, for everyone who opens this page. The clock runs at twenty times real, so a bar closes every fifteen seconds and the chart moves while you read it. The engine's measured numbers are on the performance page, and a live book is in the dashboard's demo.
| Kind | Built for | What a position holds | How it settles |
|---|---|---|---|
binary |
Prediction markets on yes or no outcomes. Prices are probabilities, from 0.01 to 0.99. | Fully collateralised. A buyer holds price x qty; a short seller holds (1.00 minus price) x qty. A cross mints contracts with exactly 1.00 per contract in escrow. | You declare the outcome. Winners receive 1.00 per contract from escrow, losers 0. Void refunds cost and reverses fees. |
scalar |
Markets on a number: a temperature, a vote share, a date, anything inside a stated range. | The same mechanics, with the payout normalised inside min_price and max_price. |
You declare the value. Positions pay out proportionally between the two bounds. |
pair |
Spot exchanges, game items, GPU hours, tickets: any asset quoted in another. | The asset itself. To sell it, you must hold it. Buyers hold the quote currency. | Never resolves. Each fill transfers base for quote, atomically, inside the ledger. |
Currencies are yours to define per environment, real or play-money, with the decimal scale you choose. Fees are basis points per market, maker and taker, and land in the ledger with the fill. The full rules are in the fundamentals and the API reference.
Determinism
One ordered log, one pure engine.
Replay reproduces state byte for byte. The same property is the failover story, the audit story and the test oracle.
The ledger is inside
Double entry, integer only, balanced at write time.
Balances, holds, fees and payouts move in the same state machine as the book. There is no reconciliation job because there is nothing to reconcile.
Checked, not asserted
Compared against a second engine.
Correctness is a comparison we did not write both sides of: a differential harness and a full Nasdaq day replayed against Nasdaq's own outcomes.
How it integrates
Four calls from nothing to a settled market.
Launch your market in fifteen minutes. REST for commands, WebSocket for everything that happens. Decimal strings at the boundary, integer arithmetic inside.
- 01
Define a currency and a market
Sandbox and production start empty. Set the currency's scale, then create a market with its tick size and settlement currency.
POST /v1/currencies,POST /v1/markets. - 02
Send orders from accounts
Limit or market, GTC, IOC, FOK or day, with an idempotency key. The response returns once the engine has processed the command, so it already carries any fills from entry.
- 03
Subscribe to the feed
A snapshot, then deltas. Every frame on a market carries
seqandprev, so a gap is detectable and a resync is one request. - 04
Resolve, and the ledger settles
Declare the outcome. Every position settles against escrow in one atomic step, and the balances channel tells each account what it received.
# 1. a market for anything with a price POST /v1/markets { "symbol": "WILL-IT-RAIN-BA", "kind": "binary", "tick_size": "0.01", "settlement_currency": "USDC" } # 2. a resting bid, from an account POST /v1/orders Clobber-Account: acc_2fRk8Wq4vNc6 Idempotency-Key: 7f3c1a90-bid-1 { "market": "WILL-IT-RAIN-BA", "side": "buy", "type": "limit", "price": "0.61", "qty": "250" } # 3. the fill, as the feed sees it WS wss://feed-sandbox.clobberhq.com <- { "channel": "orders", "event": "fill", "seq": 48212, "prev": 48211, "price": "0.61", "qty": "250" } # 4. the outcome, settled atomically POST /v1/markets/WILL-IT-RAIN-BA/resolve { "outcome": "yes" }
Request bodies as the API reference states them. Every amount is a decimal string, never a float; the engine converts once, at the edge.
Why trust it
The matching and the ledger are one state machine.
A pure, single-threaded engine over a totally ordered command log. No IO, no clock reads, no floats inside it. The timestamp is a field on the command, assigned before journaling.
Durable before it is true
Every command is appended and fsynced before the engine acts on it. The acknowledgement you receive already reflects durable state: there is no write-behind whose loss would need explaining.
Balanced on every command
The ledger is double entry and lives in engine state. The invariant, every entry per currency per tenant sums to zero, is asserted after every command in debug builds and after every snapshot in production.
Replayed against a second engine
A differential harness compares books level by level with an independent open source engine, and a full Nasdaq trading day runs through the engine against Nasdaq's own outcomes. The report is published with its conditions.
What matching costs inside the state machine. Ours to measure, and the number we are least interested in selling.
From the gateway receiving the command to the response, fsync included. Set by the storage the tier runs on, and quoted per tier.
Your network to the region the environment lives in. We do not quote it, because it is not ours to measure.
Every number traces to a run with its hardware and method on the page it links to. Sandbox and Basic sell uptime and correctness, never a latency figure; a latency number is quoted only on Pro, measured on the storage that plan runs on.
What stays yours
You run the market. We run the book.
A clean split of responsibilities is what makes a hosted engine safe to build on. This is the line.
You keep
- Your users and their moneyCustody, funding and withdrawal are your flow. Balances are credited to accounts through the API; nothing here holds funds on your behalf.
- Market creation and resolutionYou define the markets, the tick and lot sizes, the fees, and you declare the outcome that settles them.
- Product and interfaceThe app, the pricing display, the onboarding. The feed carries the data; the screen is yours.
- Licensing and complianceWhat you may offer, to whom and where is your call and your responsibility. The engine does not know what a contract means.
Clobber runs
- Order books and matchingPrice-time priority, order types, time in force, self-trade prevention, per market sequencing.
- The ledger, holds and settlementDouble entry, integer only, conserved on every command. Holds are placed at entry and released or converted at fill.
- Durability and failoverEvery command journaled and fsynced before it acts. Snapshots and segments shipped off the machine. Recovery is a replay.
- Feeds and historyWebSocket channels with snapshot and deltas, webhooks, and a queryable history of orders, fills and ledger entries.
Which plan
Your own engine, from the first paying environment.
Every paid environment runs alone on its own machine. Markets and accounts cost nothing; quotes and cancels are free within your plan; you pay per trade, the way your users pay you.
| Feature | Sandbox | Basic | Pro | Enterprise |
|---|---|---|---|---|
| Price | $0forever, no card |
$999per month |
$2,500per month, annual plans available |
Contact usannual contracts |
| Trades | Test markets only, full API and feeds | 250,000 per month included, then $1,000 per extra million | 2,000,000 per month included, then $500 per extra million | By contract |
| Rate | 50 orders per second | 250 orders per second, 15,000 a minute, measured with deploys running | 5,000 orders per second sustained, 300,000 a minute, on a box measured at 20,000. The plan rate rises as we measure | Unbounded: market shards |
| Infrastructure | Shared | Your own isolated engine on general-purpose storage | Your own isolated engine on local NVMe, with its own projection database | Your cloud or your region, deployed there and measured there. Quorum across datacenters |
| Uptime | No SLA | 99.9% monthly | 99.9% monthly, 99.99% with the standby add-on | Contractual, with restore drills you attend |
| Recovery | Best effort | Acknowledged orders survive process and machine death | Acknowledged orders survive process death; machine death is a restore from the shipped journal, seconds old at most. Cross-region backup and journal-fed replicas as add-ons | Recovery point zero across datacenters, contractual cross-region recovery, dedicated feed relays, on-chain settlement |
| Support | Community | Email, webhooks | Slack channel with the founder | Custom agreement |
| Request access | Go live | Talk to us | Talk to the founder |
Basic and Pro annual plans are twelve months upfront for the price of ten, with a data export guarantee written into the contract. Enterprise is annual only. Markets and accounts are never metered and never sold by the unit: what bounds them is the machine your environment runs on, and the environment's own limits are visible in the API and the dashboard. What each plan promises about an acknowledged order, failure by failure, is on the reliability page.
Questions
What teams ask before they build on it.
The short answers. The long ones are in the fundamentals, the whitepaper and the API reference.
What is Clobber?
A hosted central limit order book. You rent the matching engine, the double entry ledger, the durability and the failover, and spend your year on your market instead of on exchange plumbing. Commands go in over REST, and everything that happens comes back on a WebSocket feed.
What can I build on it?
Prediction markets on yes or no outcomes, scalar markets on any number inside a stated range, and spot pairs for anything quoted in something else: tokens, game items, GPU hours, tickets. One engine, three market kinds, the same price time priority matching and the same ledger.
Is this exchange as a service?
That is the shape of it. Matching, sequencing, holds, fees, settlement and market data are ours. Your users, their custody, your product and your licensing stay yours, and the line between the two is drawn on this page.
How long does it take to launch a market?
Four calls: define a currency and a market, send orders from accounts, subscribe to the feed, declare the outcome. About fifteen minutes from an empty sandbox environment to a market that has traded and settled.
How do I know the matching is correct?
The engine is deterministic: one ordered log, one pure state machine, and a replay that reproduces state byte for byte. On top of that a differential harness compares it with an independent open source engine, and a full Nasdaq trading day is replayed against Nasdaq's own outcomes. The integrity report publishes both, with what they do not prove.
Do you hold my users' money?
No. Funding, custody and withdrawal are your flow. The ledger inside the engine tracks balances, holds, fees and settlement for the accounts you create, double entry and integer only, and it is conserved on every command.
What do the market data feeds look like?
A WebSocket subscription returns a snapshot and then deltas. Every frame on a market carries a sequence number and the previous one, so a gap is detectable and a resync is one request. Webhooks and a queryable history of orders, fills and ledger entries come off the same stream.
What does it cost?
Sandbox is free and carries the full API and the feeds. Paid environments run alone on their own machine, priced per month with trades included and per trade past the bundle. The plans and their numbers are in the pricing table on this page.
How to start
Request access.
We are onboarding design partners now. Tell us what you are building and which tier fits, and we reply by email with a sandbox key or a call, whichever the answer needs.
- 1. A sandbox environment with your own key. Same engine as production, separate ledger, free.
- 2. The quickstart against it: a currency, a market, two accounts, a matched trade, a resolution.
- 3. Basic when your users show up, on a machine of your own. Migration is a replay, not a rebuild.
The book is open
Bring the market. The orders will match.
Design partners shape what ships first. Read the contract, then ask for a key.