Hyperliquid API wallet permissions
Hyperliquid does not use an exchange API key with a withdraw tick box. You approve an API wallet, also called an agent wallet, and it signs for the account.
What an API wallet is
The nonces and API wallets page (Nonces and API wallets) says API wallets are also called agent wallets. A master account approves them to sign for the master account or for sub-accounts. They are only used to sign. Querying a master or sub-account still uses that account's own address. Using the agent address for a query returns an empty result.
How many, and how long
The approve-agent section of the exchange endpoint (Exchange endpoint) says an account can have 1 unnamed approved wallet and up to 3 named ones, plus 2 more named agents per sub-account. A custom expiration is set with valid_until after the name, at most 180 days ahead.
Withdrawals
Approving an agent is a separate action from usdSend and from transfers between perp, spot and sub-accounts, which are their own requests on the exchange endpoint. The API-wallets page says the agent is only used to sign. It does not say to hand the main wallet's private key to a bot. Generate an agent, approve it, and keep the main key offline.
How to revoke
The API-wallets page says an agent is pruned when it is deregistered (a new ApproveAgent for the unnamed slot, or a new ApproveAgent with the same name), when it expires, or when the registering account no longer has funds. Do not reuse that address. After deregistration the nonce state may be pruned, and Hyperliquid says to generate a new agent wallet next time so old signed actions are not replayed.
Use the app at app.hyperliquid.xyz. Our check recorded that as the official app URL.
Worst case for your money, and the safe setup: Hyperliquid check.
Listing, with the safety facts we track: Hyperliquid.
Same rules, other exchanges: API key safety. Exchange directory: crypto exchanges for bots.
More in this set
Questions
What is a Hyperliquid API wallet?
An agent wallet you approve with approveAgent. It signs for the master account or a sub-account. Hyperliquid says API wallets are only used to sign.
How long can a Hyperliquid API wallet last?
If you set valid_until, the expiration can be at most 180 days in the future. When it expires, or you replace it, generate a new address instead of reusing the old one.