It can trade. It can't withdraw.
Mirror's trading key is a Hyperliquid agent wallet. It can place and cancel orders on your account, and nothing else.
Last updated 2026-10-25
- Place orders on perpetual and spot markets for your account
- Cancel and modify those orders
- Change leverage and margin mode on a market
- Withdraw funds from Hyperliquid
- Send USDC or tokens to any other address
- Move funds between your spot and perp balances. Your main wallet signs those.
- Approve other trading keys, or change builder-fee approvals
- Access your main wallet or its seed phrase
What it is
To place copied trades without asking you to sign every order, Mirror uses a Hyperliquid agent wallet, which we call the trading key. It is a fresh key pair created in your browser. You authorise it once by signing an approveAgent message with your main wallet. Hyperliquid then accepts trading actions signed by that key on behalf of your account.
Where it lives
You choose one of two execution modes when you start a copy, and can change it later on the trading setup page.
- Mirror's server (24/7, default): you sign one message with your main wallet authorising Mirror to hold the trading key. The key is uploaded once, stored encrypted (AES-256-GCM) and decrypted only to sign an order. Mirror's server then mirrors your leaders whether or not you are online, on any device. The key still cannot withdraw. You can switch back at any time; the server wipes its copy.
- This browser only: the private key is generated and stored in this browser's local storage, on this device only. It is never sent to Mirror's servers; orders are signed in your browser and only the signed order is relayed to Hyperliquid. Copying runs only while Mirror is open with the key available. Closing the tab pauses your copies. You can pick this instead when you start a copy.
The real risk
The trading key cannot move your funds out, but anyone who gets hold of it can trade your account. A malicious browser extension or malware on your device could use it to open reckless positions, or to trade against themselves in a thin market to drain value from your account. Only use Mirror on a device and browser you trust, and remove the key if you think it has been exposed.
What server-side copying adds
In server mode you are trusting Mirror's infrastructure with the same key. A compromise of Mirror's server or its encryption secret would expose your trading key, with the same trading-only blast radius as above. In exchange, copies no longer depend on your device: leader trades are mirrored within seconds, around the clock, and stop-and-flatten works from any device. If you stop trusting the server, switch back to browser mode (the server wipes the key) and approve a new agent on Hyperliquid, which invalidates the old one.
Removing or revoking it
Remove from Mirror: on the trading setup page. This deletes the key from this browser, so Mirror can no longer trade for you from here.
Revoke on Hyperliquid: removing the key in Mirror does not revoke Hyperliquid's authorisation. To fully revoke it, remove the agent from the API wallets page on Hyperliquid, or approve a new agent under the same name, which replaces the old one.