Connecting a wallet
Connect any EVM wallet — Rabby, MetaMask, Frame, a hardware wallet behind one. There is nothing to install and no account to create on our side.
The two approvals
Section titled “The two approvals”You sign twice, for two different things. They are independent, and you can have one without the other.
1. A trading key
Section titled “1. A trading key”Authorises a key we hold to place, modify and cancel orders on your exchange account. Hyperliquid calls this an API wallet; Lighter calls it an API key. Both support it natively — it is the venue’s own mechanism, not something we invented.
The key cannot withdraw or transfer funds. That limit is enforced by the exchange, not by our code, which is the only kind of limit worth relying on.
2. A platform fee
Section titled “2. A platform fee”Authorises a per-order fee, up to a ceiling you choose. It is a maximum, not a fixed charge. On Hyperliquid this is a builder code; on Lighter it is an integrator approval.
If you approve trading but not the fee, your positions are still managed. We just do not get paid. That trade-off is deliberate: your money is at risk in the market, and withholding execution to protect our revenue would be the wrong call made automatically at the worst possible time.
What a compromise would mean
Section titled “What a compromise would mean”Stated plainly, because a vague security claim is worth nothing:
If pnl.xyz were entirely compromised, an attacker could trade your margin badly. They could not take it.
Funds never leave your own exchange account. There is no deposit, no vault, no wallet created on your behalf, and no embedded-wallet provider holding a key for you.
Approvals expire
Section titled “Approvals expire”Both venues time-limit trading approvals — Hyperliquid’s lapse after roughly 180 days, Lighter’s on an explicit timestamp.
We check before every rebalance and prompt you a week ahead, because re-signing needs your wallet connected and you present. Being told at the moment trading stops is being told too late.
If an approval does lapse, your positions stop being managed while your account still looks active. That is the failure the early prompt exists to prevent.
Revoking
Section titled “Revoking”From the exchange, at any time, without asking us. Hyperliquid and Lighter both list authorised keys in their own interfaces. Revoking stops us placing orders immediately; it does not close positions you already hold.