Hyperliquid is an on-chain exchange, so it doesn't do API keys the way a centralized venue does. Instead it uses API wallets (also called agent wallets) — a separate signing key that can place orders on behalf of your account but cannot withdraw funds. That design makes Hyperliquid API access unusually safe by default. Here's how it works.
Why Hyperliquid uses API wallets
On a centralized exchange, an API key is a username/password pair the exchange checks. On Hyperliquid, actions are signed cryptographically. An API wallet is a fresh keypair you authorize to act as an "agent" for your main account. The critical property: an agent wallet can trade but can never move your money off the exchange. Even a fully compromised agent key can't withdraw — only your main wallet can.
If you don't have an account yet, you can start on Hyperliquid by connecting a wallet — no KYC required — and our link carries a fee benefit.
Step 1: Open the API section
In the Hyperliquid app, open your account menu and find the API page. This is where you generate and manage agent wallets.
Step 2: Generate an API wallet
Click to create a new API wallet. Hyperliquid generates a private key for the agent. Optionally give it a name (e.g. "bot-1"). You then approve the agent from your main wallet — a one-time signature that authorizes it. Some setups let you set an expiry after which the agent is automatically deauthorized.
Step 3: Save the agent private key
Copy the agent wallet's private key into your bot's config or your password manager. As with any key, it's shown for signing purposes — store it securely. Because it can't withdraw, the blast radius of a leak is limited to unwanted trades, but that's still worth avoiding.
Step 4: Fund and trade
Your margin stays in your main account. The agent simply signs orders against it. Point your bot or tool at the Hyperliquid API endpoint using the agent key, and confirm it can read your positions before letting it trade.
What API wallets can and can't do
- Can: place and cancel orders, query positions, balances and fills.
- Cannot: withdraw or transfer funds off the exchange.
- Best practice: use a separate agent wallet per bot/app, set an expiry where possible, and revoke agents you no longer use from the API page.
A note on read-only tracking
If you only want to *track* a Hyperliquid account (for a journal or dashboard), you often don't need an agent wallet at all — Hyperliquid's public info API can return a given address's state. That's the safest option of all: no key to leak.
With access set up, keep an eye on the numbers that decide your PnL: Hyperliquid's hourly funding is easy to underestimate. Compare it live against other venues on our funding rates page, and model carry costs with the funding calculator.