Hypertake is an independent web interface for Hyperliquid's HIP-4 prediction markets (outcomes) and perpetual futures. You connect your own wallet; every order is placed, matched and settled on Hyperliquid, and your money stays in your own Hyperliquid account. Hypertake is not affiliated with or endorsed by Hyperliquid. Markdown of this page: https://hypertake.net/docs/security/trading-key.md. Full documentation index: https://hypertake.net/llms.txt
Security · Keys and approvals
The trading key (one-tap trading)
How Hypertake's trading key (a Hyperliquid API wallet) is made, stored encrypted in your browser, what it signs and how to turn it off
The trading key is a key your browser makes and your wallet approves as a Hyperliquid API wallet (an "agent"), so your orders go through without a wallet pop-up. It signs orders, cancels and leverage or margin changes. Withdrawals and transfers are actions Hyperliquid requires your main wallet to sign.
Hypertake calls this one-tap trading. Without it, every order would need a confirmation in your wallet; with it, a desktop order is one click and a phone order is two taps on the button.
How it's made
You press Turn on one-tap trading
From a market's ticket, the perps order form, Portfolio's One-tap trading card or, on the phone, Account → One-tap trading.
Your browser makes a new private key
A random key, generated on your device. Hypertake's server never sees it.
Your wallet approves it
One
ApproveAgentsignature names the key's address, a name for this browser and an expiry 179 days away. (On mainnet, the builder fee approval comes first if your account hasn't approved it yet.)ResultHyperliquid records the key as an approved API wallet of your account.
Hypertake stores it, encrypted
The key is saved in this browser and read back from Hyperliquid to confirm its expiry.
ResultOne-tap trading shows On, and orders now go through without a wallet pop-up.
Where it's stored
- Place
- Your browser's IndexedDB, in a database named
hypertake, one key per network and wallet address. - Encryption
- AES-GCM (256-bit), under a WebCrypto key marked non-extractable, stored alongside it. The key can't be read out of storage as plain text.
- What that doesn't protect against
- Code running on hypertake.net can still use the key; that's how it signs your orders. Encryption at rest protects against the key being copied out of your browser's files, not against the site itself.
- Never sent anywhere
- The private key isn't sent to Hypertake's server or anyone else. Only signed orders leave your browser, straight to Hyperliquid.
- Deleted when
- You turn it off, or clear this site's data in your browser. On an iPhone, Safari and the Home Screen app keep separate storage, so each has its own key.
One key per browser
Each browser makes and approves its own key, under its own name: Hypertake w plus a 4-character id on a computer, Hypertake p plus an id on a phone (16 characters, Hyperliquid's maximum for a name). Nothing syncs between devices, so a new browser asks for its own approval. The builder fee is approved per account, so a second browser asks for only one signature.
Hyperliquid allows an account "1 unnamed approved wallet and up to 3 named ones" (Nonces and API wallets). When your account is full, Hypertake reuses the oldest slot held by its own apps, which turns one-tap trading off on that other device. It never replaces another app's key; if every slot belongs to other apps, it asks you to remove one on Hyperliquid first.
What it signs
| Action | When | Wallet prompt? |
|---|---|---|
| Orders: outcome buys and sells, take profits, perps market and limit orders, take profit and stop loss | Only when you press the order button | No |
| Cancels: a take profit, a perps order | When you press Cancel | No |
Leverage changes (updateLeverage) | When you change leverage on a perps market | No |
Isolated margin added or removed (updateIsolatedMargin) | When you change a position's margin | No |
Switching your account to one balance (agentSetAbstraction) | Once, automatically, right after one-tap trading turns on, and only if your account keeps spot and perps apart | No; a notice says "Your account now uses one balance" and nothing is moved |
What it can't do
Hyperliquid has two kinds of signed actions (Signing). Trading actions can be signed by an API wallet. Withdrawals (withdraw3), transfers (usdSend, usdClassTransfer), approving a builder fee and approving another API wallet are user-signed actions: they need an EIP-712 signature from your main wallet. Hyperliquid's builder-codes page states the fee rule explicitly: ApproveBuilderFee "must be signed by the user's main wallet, not an agent/API wallet" (Builder codes).
So the trading key can't withdraw your money, send it to another address, raise Hypertake's fee or approve more keys. Hypertake's withdrawal screen asks your wallet every time, for the same reason.
Expiry
Hypertake approves each key for 179 days; Hyperliquid allows at most 180. The date comes from Hyperliquid itself and shows on Portfolio's One-tap trading card (Expires) and, on the phone, in Account → Trading key. After it passes, one-tap trading reads Off and the next order asks you to approve a new key. A failed check (a network error, a busy API) never turns it off; only Hyperliquid saying the key expired or was replaced does.
Turning it off
Hyperliquid has no action that revokes an API wallet. So Turn off approves a throwaway key under this browser's name, valid for 60 seconds, which replaces the real one, and then deletes the real key from this browser. That's one wallet signature, with no gas and no money moved.
Desktop
Open Portfolio, find the One-tap trading card and press Turn off, then confirm in your wallet.
Phone
Open Account (your wallet button at the top), then One-tap trading → Turn off one-tap trading, and confirm with Turn off in MetaMask (or your wallet's name).
Result"One-tap trading off". The next trade asks you to approve again.
- OffNo key in this browser, or the key expired or was replaced. Orders can't be placed.
- ApprovingWaiting for your signatures in the wallet.
- OnA valid key is here and Hypertake's fee is approved. Orders go through without pop-ups.
- Off, waiting for the feeA key is approved but the builder fee isn't. Turning on asks only for the fee.
Last updated