Hyperliquid agent wallets: why a trading key can't withdraw

A Hyperliquid API wallet, also called an agent wallet, is a separate key that your main wallet authorizes to sign trading actions for your account. It can place, change and cancel orders and adjust leverage. It cannot withdraw or transfer funds: a withdrawal on Hyperliquid has to be signed by the wallet that owns the account. That split is what lets apps and bots trade for you without being able to take your money. This guide explains how the approval works, its limits, the realistic worst case if a key leaks, and how to revoke one.

How an agent wallet is created

1. An app (or you) generates a fresh key pair. Its address is the agent address.
2. Your main wallet signs an approveAgent action naming that address, and optionally a name and an expiry. This is a signature, not a transaction: no network fee, and no funds move.
3. From then on, the agent key signs orders for your account. Hyperliquid checks the signature against your list of approved agents.

The private key of the agent never needs your main wallet's key, and your main wallet's key never leaves your wallet.

What it can and cannot do

Withdrawals, transfers out and approvals stay with the main wallet. The same goes for approving an app's builder fee, which Hyperliquid requires to be signed by the main wallet, not an agent. See Hyperliquid builder fees.

Limits worth knowing

Expiry. An agent can be given a validity date. Keys can be approved for at most 180 days. After that, Hyperliquid stops accepting them and you approve a new one.

How many. An account can have one unnamed agent and a small number of named ones. Prow's own docs and the apps we checked work with three named API wallets per account. If all slots are taken, you replace one: approving a new agent with an existing name removes the old one at once.

Don't reuse an agent address. Hyperliquid's docs warn that once an agent is removed or expires, its record of used nonces may be pruned, so actions signed earlier could be replayed. Apps should generate a fresh key every time rather than re-approve an old address.

Querying data. An agent signs, it does not own anything. Account data (positions, balances, fills) is read with the main account's address, not the agent's.

What happens if an agent key leaks

Be precise about the worst case. Someone holding your agent key cannot withdraw or move funds out. They can trade on your account until the key is revoked or expires. In practice that means they could:

• close your positions, or open new ones at high leverage,
• trade into a thin market at bad prices, possibly against their own orders on the other side,
• cancel your stop losses.

So a leaked key is not harmless. It is a trading risk, not a custody risk. Treat agent keys as sensitive, keep their number small, and revoke the ones you no longer use.

How to revoke an agent wallet

1. Open app.hyperliquid.xyz/API and connect the main wallet that owns the account.
2. Find the agent by its name (apps usually name them after the device or the service).
3. Remove it. Your wallet signs once, with no network fee.

Removing an agent does not touch your balance, open positions or open orders. They stay on Hyperliquid. Orders the agent already placed keep working until you cancel them.

If you lost a device, revoke its key from any other device. Revoking inside an app only removes that app's copy of a key if the app also asks Hyperliquid to remove it with your main wallet's signature. The Prow revoke guide walks through both cases.

Aster's API wallets

Aster uses the same idea. An app asks your wallet to approve an API wallet, signing on BNB Chain (no network fee). The signed message includes the key's permissions, and you can see Withdraw: false in it before you sign. A key approved that way can trade but cannot withdraw. One difference: an Aster key can move funds between your own spot and futures balances inside the same account. It can't send them anywhere else. You manage keys on Aster's API wallet page at asterdex.com.

How Prow uses trading keys

Prow creates a trading key in your browser when you connect Hyperliquid, Aster or Lighter. Your wallet approves it once. The key is encrypted and stays on your device. Prow's servers never receive it, and each device has its own key, named after the device (for example Prow iPhone k3f on Hyperliquid), so you can tell them apart on the venue's API page. Keys last up to 180 days, and from 14 days before expiry Prow shows a Renew key warning in Portfolio. On Aster, Prow approves keys with withdraw off, and if Aster ever reports that a Prow key can withdraw, Prow tells you to revoke it. On Lighter the key is an API key in a numbered slot. It cannot withdraw and does not expire; you revoke it from Settings. See How trading keys work and What you sign.

Bots are different: they run on Prow's servers, so they use a separate Prow Bots key that Prow creates and stores encrypted on its bot servers. It can't withdraw or transfer either, expires after 30 days, and Prow's servers refuse any bot order outside the limits you sign for each bot. Those limits are checked by Prow's servers, not by the venue. See The Prow Bots key.

A checklist before you connect any app or bot

• Does it ask for an agent approval, or for your main wallet's private key or seed phrase? Never give the second.
• Does the agent address on screen match the one in your wallet prompt?
• Where does the key live: on your device, or on the app's servers? A server-held key can trade whenever those servers can.
• Does it set an expiry, and does it remind you to renew?
• Can you see and remove it on the venue's API page by name?
• Is a builder fee part of the approval, and what is the maximum?

Frequently asked questions

Can a Hyperliquid API wallet withdraw funds?

No. An API (agent) wallet can sign trading actions such as orders, cancels and leverage changes. Withdrawals and transfers must be signed by the main wallet that owns the account.

How long does a Hyperliquid agent wallet last?

Up to 180 days, if the approval sets a validity date. After it expires, the venue stops accepting it and you approve a new key.

What can someone do with a stolen agent key?

Trade on your account: open, close or cancel orders, including at bad prices. They cannot withdraw or send funds elsewhere. Revoke the key on Hyperliquid's API page to stop it.

Does revoking an agent wallet close my positions?

No. Your balance, positions and open orders stay on Hyperliquid. Only new actions signed by that key stop working.

Sources

Checked October 5, 2026:

• Hyperliquid docs: Nonces and API wallets, Builder codes
• Prow docs: How trading keys work, Disconnect a venue, What you sign, Connect Hyperliquid