Yes, through the API and an agent key
Yes: Hyperliquid's exchange endpoint accepts a signed action from any program, so an AI agent that can sign and send an HTTP request can trade there. It does not need the account's own key, because a master account can approve an API wallet to sign on behalf of the master account or any of its sub-accounts.
Nothing at the venue tells an order placed by a model from one placed by a person: both arrive at https://api.hyperliquid.xyz/exchange as the same signed action. The difference is entirely on your side of the wire: who decided, and what checked the decision before it was sent.
What an AI agent needs
Three things, and nothing beyond them.
- Data. The info endpoint at
https://api.hyperliquid.xyz/infoanswers mid prices, the order book (l2Book), candles, funding history and an account's state. The websocket atwss://api.hyperliquid.xyz/wsstreams them instead of being polled. - A key it may use. An API wallet, approved once by the account with
approveAgent. It exists to sign: to read an account you pass that account's real address, and passing the agent's gives an empty result, which the docs name as a common pitfall. - Limits that are not its own. Size, leverage, markets, the count of orders a day, checked by code the model cannot rewrite. A model asked nicely to respect a limit is not a limit.
The first two are Hyperliquid's and documented. The third is nobody's work but yours, and it bounds what a wrong decision costs.
What it should never hold
The account's own key. It can withdraw, send, approve another agent, approve a fee and sign a transfer, and a model holding it can do any of that by accident or because something in its input said to.
An approved agent key is narrower, and the bound was measured rather than assumed. On Hyperliquid mainnet on 28 September 2026 a fresh agent key signed each fund action for far more than the test account held, so nothing could move and only the refusal mattered.
| Action signed by the agent key | Hyperliquid's answer |
|---|---|
| Place, modify and cancel orders, set leverage | accepted |
withdraw3, usdSend, spotSend, sendAsset, usdClassTransfer | refused |
approveAgent (approving a second agent), approveBuilderFee | refused |
vaultTransfer (depositing the account into a Hyperliquid vault) | accepted |
The same measurement found one movement of funds the agent key is allowed: vaultTransfer was accepted, and 5 USDC reached HLP on the agent's signature alone. So a stolen agent key can push the account into a vault someone else runs, and it can lose the money by trading badly against an accomplice. The bound that holds is a dedicated account, funded with what you are ready to lose.
How Locker Protocol Agentic does it
Three places, one rule: the key that owns the money never reaches the agent. The account's key stays in your wallet, Locker Vault first, an app that stays offline and signs by QR code, or the extension or mobile wallet you chose; it signs the agent's approval, the deposits, the withdrawals and the mandate. The computer holds only the agent key, sealed under a password and expiring on its own after 180 days at most, the longest Hyperliquid allows.
A background process, the guardian, holds that key in memory, checks every order against a local policy a second time and against the mandate you signed, and signs a closed list of trading actions. The AI agent that calls lpa, in a shell or through the MCP server, never sees the password or the key.
What it does not do: it promises no profit, and it cannot stop a thief holding both the sealed key file and its password. A limit widened by a program takes effect only when you type that password again, which is deliberate. Simulation is the default, on Hyperliquid's real book with the real fees and funding.
What this does not settle
That a model can place an order says nothing about whether its ideas make money. Perpetuals are leveraged: a position is liquidated once the account's equity falls below the maintenance margin, and the whole deposit can go. Everything above is about who can sign what, the part that can be measured.