# Hyperliquid API wallet permissions | TradingAgentStack

> Hyperliquid API wallets: agent approval, the 180-day limit, and why not to reuse an agent address.

Canonical: https://tradingagentstack.com/exchange-api-key-safety/hyperliquid/

1. [Home](https://tradingagentstack.com/)

2. [API key safety](https://tradingagentstack.com/exchange-api-key-safety/)

3. Hyperliquid API wallet permissions

# Hyperliquid API wallet permissions

Hyperliquid does not use an exchange API key with a withdraw tick box. You approve an API wallet, also called an agent wallet, and it signs for the account.
Fake copies show up in Telegram DMs, search ads and lookalike domains. A real admin does not DM you first or ask for a seed phrase or private key.

## What an API wallet is

The nonces and API wallets page ([Nonces and API wallets](https://hyperliquid.gitbook.io/hyperliquid-docs/for-developers/api/nonces-and-api-wallets)) says API wallets are also called agent wallets. A master account approves them to sign for the master account or for sub-accounts. They are only used to sign. Querying a master or sub-account still uses that account's own address. Using the agent address for a query returns an empty result.

## How many, and how long

The approve-agent section of the exchange endpoint ([Exchange endpoint](https://hyperliquid.gitbook.io/hyperliquid-docs/for-developers/api/exchange-endpoint)) says an account can have 1 unnamed approved wallet and up to 3 named ones, plus 2 more named agents per sub-account. A custom expiration is set with valid_until after the name, at most 180 days ahead.

## Withdrawals

Approving an agent is a separate action from usdSend and from transfers between perp, spot and sub-accounts, which are their own requests on the exchange endpoint. The API-wallets page says the agent is only used to sign. It does not say to hand the main wallet's private key to a bot. Generate an agent, approve it, and keep the main key offline.

## How to revoke

The API-wallets page says an agent is pruned when it is deregistered (a new ApproveAgent for the unnamed slot, or a new ApproveAgent with the same name), when it expires, or when the registering account no longer has funds. Do not reuse that address. After deregistration the nonce state may be pruned, and Hyperliquid says to generate a new agent wallet next time so old signed actions are not replayed.

Use the app at [app.hyperliquid.xyz](https://app.hyperliquid.xyz). Our check recorded that as the official app URL.

Worst case for your money, and the safe setup: [Hyperliquid check](https://tradingagentstack.com/check/hyperliquid/).

Listing, with the safety facts we track: [Hyperliquid](https://tradingagentstack.com/tool/hyperliquid/).

Same rules, other exchanges: [API key safety](https://tradingagentstack.com/exchange-api-key-safety/). Exchange directory: [crypto exchanges for bots](https://tradingagentstack.com/crypto-exchanges-for-trading-bots/).

## More in this set
[Binance](https://tradingagentstack.com/exchange-api-key-safety/binance/)[Bybit](https://tradingagentstack.com/exchange-api-key-safety/bybit/)[OKX](https://tradingagentstack.com/exchange-api-key-safety/okx/)[Coinbase](https://tradingagentstack.com/exchange-api-key-safety/coinbase/)[Kraken](https://tradingagentstack.com/exchange-api-key-safety/kraken/)[KuCoin](https://tradingagentstack.com/exchange-api-key-safety/kucoin/)[Bitget](https://tradingagentstack.com/exchange-api-key-safety/bitget/)

## Questions

### What is a Hyperliquid API wallet?

An agent wallet you approve with approveAgent. It signs for the master account or a sub-account. Hyperliquid says API wallets are only used to sign.

### How long can a Hyperliquid API wallet last?

If you set valid_until, the expiration can be at most 180 days in the future. When it expires, or you replace it, generate a new address instead of reusing the old one.

Opened 2026-10-27. Not financial advice. See a wrong link? [Send a correction](https://tradingagentstack.com/submit/) with the vendor page.

## For agents

- [When to use this site, and the page index](https://tradingagentstack.com/llms.txt)
- [Sitemap](https://tradingagentstack.com/sitemap.xml)
- [Contact](https://tradingagentstack.com/contact/)
- [MCP server](https://tradingagentstack.com/mcp/)
- [MCP discovery](https://tradingagentstack.com/.well-known/mcp)