Agent wallet

A restricted API credential, also called an API wallet, that can place and manage orders on behalf of a Hyperliquid account but cannot withdraw funds. It lets bots and third-party tools trade without holding full account control.

Definition

An agent wallet is a separate key that your main account authorises to act for it, within limits the protocol enforces. It can sign trading actions. It cannot move money out of the account.

Why the separation matters

Automated trading needs a key that is available to software, which means a key sitting on a server, in a config file, or in a container image. That is a fundamentally more exposed place than a hardware wallet.

Splitting trading authority from withdrawal authority changes what a compromise costs. An attacker who obtains an agent key can trade your account, and can lose money doing it, but cannot transfer the balance to an address of their own. The worst case is bounded by the market rather than open-ended.

What it does not protect you from

Losses caused by the trading itself. An agent key can open positions, use leverage and close them at a loss, and every one of those actions is legitimate as far as the protocol is concerned.

It is also not a substitute for the ordinary care an API key deserves: keep it out of version control, rotate it when a machine is decommissioned, and revoke it when the strategy stops running.

Practical notes

Agent wallets are authorised from the main account, so they can also be revoked from it. Running one agent per bot rather than one shared across several makes it possible to cut off a single misbehaving process without stopping everything.

Where you will run into it

In the API section of Hyperliquid’s interface when connecting a bot or a third-party trading tool, and in SDK documentation, where the agent key is what the client signs with.