Security and custody

What you approve

Hyperliquid lets a wallet approve agent keys, also called API wallets. An agent key can sign trading actions for your account. It cannot sign withdrawals, transfers to other addresses, or new approvals. Those always need your own wallet.

• Trading key. Lets the terminal place orders in one click. It lives in your browser.
• Guardian key. Only if you turn Guardian on. Held by the keeper service, encrypted at rest, used only to add margin and manage the idle pot.
• Builder fee approval. For wallets without $BASTION, a one-time approval of a 0.01% maximum builder fee. It cannot be raised without a new signature from you.

Keys expire every 180 days

Hyperliquid caps an agent key's life at 180 days. The app shows a countdown on each key, and we remind you by email and in the app 14 days before it runs out. If a key expires, trading falls back to wallet signatures and Guardian stops until you approve a new one.

How to revoke

Hyperliquid has no separate revoke button for agents. You revoke a key by replacing it, which takes effect immediately:

• In Bastion, open Settings, then Keys, and choose Revoke. Your wallet signs an approval that replaces the key with a fresh one Bastion does not hold.
• Without Bastion, go to app.hyperliquid.xyz, open More, then API, and approve a new key under the same name, or remove the agent there.
• Letting a key reach its expiry date also ends it.

A replaced key cannot sign anything again. Your positions and balances are untouched by revoking.

How the keeper is built

• Guardian keys are encrypted at rest with a key that never leaves the keeper service.
• The keeper runs isolated from the website, with rate limits on every action.
• A global kill switch stops every keeper action at once.
• Every action is written to an append-only audit log, and published without addresses on the ledger.

What we will never do

• Ask for your seed phrase or private key.
• Ask you to send funds to an address.
• Message you first on X, Telegram or Discord about your account.

Only trust links on bastion.trade. Report a security issue to hello@bastion.trade.