How your keys are protected and what hypr() can and cannot do.
However you sign up, hypr() connects to the same thing: a trade-only API wallet on your Hyperliquid account, authorized by a single approveAgent signature. It can place and cancel orders. It cannot withdraw, transfer, or take custody of your funds.
Connect a wallet - MetaMask, Rabby, Phantom, or any self-custody wallet. You sign approveAgent in your own wallet app; hypr() never sees your seed phrase or private key. Connecting alone shares only your public address and authorizes nothing.
Hyperliquid email account - you paste API keys you generated on Hyperliquid, or get guided through creating them. You control the permissions; trade-only, no withdrawals.
Email signup - hypr() provisions a self-custodial wallet for you through Privy. The wallet is yours and exportable; hypr() holds no key. See Your Wallet & Keys below.
The resulting API key is immediately encrypted using Fernet symmetric encryption (AES-128-CBC with HMAC-SHA256 authentication) before being stored. The encrypted key lives on the server so webhooks and stops can execute trades 24/7, without your phone being online.
Your keys are encrypted at rest on the server. They are never written to disk in plaintext.
Keys are decrypted only at the moment a trade executes, held in memory for the duration of the API call, then discarded.
Withdrawal permissions are never required. hypr() can place and cancel trades but cannot move funds out of your Hyperliquid account.
The encryption key is stored separately as an environment variable, not in the database.
Cannot withdraw funds from your account. The API wallet does not have withdrawal permission.
Cannot see your keys in plaintext at rest. They exist only as encrypted data.
Cannot access your account beyond the permissions you granted.
Pasting your own API keys? Keep them trade-only. Do not enable withdrawal permissions when generating an API wallet on Hyperliquid. Wallet-connect and email signups never handle a key; there is nothing to save.
Save pasted keys in your password manager or iOS Keychain. Hyperliquid shows an API key once and cannot recover it; if lost, generate a new API wallet.
Check the signature before you sign. The approveAgent request names the agent it authorizes. Sign it only on hypr.run.
hypr() executes trades around the clock. When TradingView fires an alert at 3am, the server needs to authenticate with Hyperliquid. This requires your encrypted key server-side. We don't pretend otherwise.
Your keys are on the server, encrypted at rest, decrypted only during execution, and scoped to trade-only permissions. The blast radius is limited by design; even in a worst case, an attacker cannot withdraw your funds.
This is a deliberate tradeoff: 24/7 automated execution in exchange for server-side key storage with strong encryption and minimal permissions.
Hyperliquid caps API wallets at roughly 180 days. hypr() tracks the expiry, warns you in the app ahead of time, and re-authorizes with one tap - a fresh approveAgent signature, no re-onboarding, no gap in your automation or stops.
hypr() uses passkeys (WebAuthn) for account access. When you sign in, your device authenticates with Face ID, Touch ID, or your device PIN. No passwords.
Your passkey is bound to hypr.run. It cannot be phished or reused on other sites. The private key never leaves your device.
The server stores only your public key. Even if the database is compromised, an attacker cannot impersonate you; the public key alone is useless without your biometric.
Cross-device sync is automatic. Apple devices sync passkeys via iCloud Keychain. Android syncs via Google Password Manager. Register once, sign in anywhere.
If you signed up with just an email, hypr() created a self-custodial wallet for you through Privy, the same wallet infrastructure Hyperliquid uses for email accounts. It is yours: reveal your private key or recovery phrase and load it into MetaMask, Phantom, or any wallet whenever you want.
Only you can ever see the key. When you export, the key is assembled in an isolated Privy window on a separate origin. Neither hypr() nor Privy can read it; you are the only party with access.
hypr() cannot recover it for you. Because only you hold the key, no one here can reset, recover, or access it. Save it in your password manager before you store serious funds.
Trading is separate. Trades run on the trade-only API wallet that cannot withdraw your funds. Exporting your wallet does not touch your trades or stops.
Your webhook token is a unique secret used only for TradingView automation. When TradingView fires an alert, it sends the token to authenticate the request. This token is separate from your passkey and visible only inside the app.
Keep your webhook token private. Anyone with this token can send trade signals to your account. Treat it like a password.
Do not share your webhook URL. It contains your token. If compromised, delete your account and create a new one to generate a fresh token.