API keys vs agents
The traditional way to let software trade for you is an exchange API key. It works, but the permission model is coarse, off-chain, and only as trustworthy as the key's storage.
In short
An API key is an off-chain credential whose scope depends on the exchange's settings and the operator's honesty in requesting them; a leaked key with withdrawal scope can drain an account. A Hyperliquid agent approval is an on-chain authorisation limited to trading actions by protocol design, and it is revocable directly from your wallet.
| Dimension | API-key bot | HyperMirror |
|---|---|---|
| Credential shared | Exchange API key held off-chain | On-chain agent approval, no key sharing |
| Scope of permission | Depends on key flags set by you | Trade-only at protocol level |
| Withdrawal risk | Present if withdrawal scope enabled | Structurally impossible |
| Revocation | Delete key in exchange settings | On-chain revoke from your wallet |
| Verifiability | Operator-reported | Public on-chain fills and positions |
With API keys, you choose scopes in an exchange dashboard and then trust that both the exchange and the bot respect them. Whether withdrawal permission was requested, and whether the key is stored encrypted, is not something you can independently confirm.
An agent approval's scope is enforced by the protocol: order actions are signable, transfers are not. There is no configuration mistake that turns a trading agent into a withdrawal credential.
Revoking an API key means logging into the exchange and hoping the bot has not already acted. Agent revocation is a signed action from your own wallet that takes effect at the protocol level.
Cross-venue strategies need credentials on venues that have no agent model at all. If your strategy spans several exchanges, API keys are unavoidable — the mitigation is strict scope and disciplined rotation, not avoidance.
A safer permission model does not make a strategy profitable. Any automated system can place losing trades, and leveraged positions can be liquidated.
Past performance is not indicative of future results. Perpetual futures are leveraged instruments and carry a substantial risk of loss, including the loss of your entire position.
Questions
No. Access is granted through Hyperliquid's native agent approval and a separate builder-fee approval.
Yes, from your own wallet, without our involvement.
They stay in your account and become yours to manage or close.
Score-weighted allocation across up to 10 elite Hyperliquid traders, each isolated in its own sub-account. Your funds never leave your account.
Non-custodial · Agent cannot withdraw · Cancel delegation anytime
