API wallet permissions and revocation

Your main wallet approves a separate key pair with an off-chain signature. It costs no gas. Orders signed by that key can then act on your account.

Can

Place and cancel orders, change leverage and margin mode, and adjust isolated margin.

Cannot

Withdraw, transfer, approve another API wallet or approve builder fees. These need your main wallet.

Approvals can last up to 180 days. When one expires, its actions fail until a new approval.

An account allows one unnamed and up to three named API wallets. If those slots are used, remove an old one at app.hyperliquid.xyz → More → API.

Remove the key on Hyperliquid’s API page. The app loses permission to act. Check open orders and positions on Hyperliquid and manage them there; do not rely on the app to cancel or close them after revocation. Use a fresh key for a new approval.

• The key can lose money by trading even though it cannot withdraw. There is no cancel-only permission.
• No legitimate app needs your main wallet’s private key or seed phrase.
• For a login signature, check the site domain. For a trading-key approval, check the key address and requested action separately.