ColdfrontHow to use a Keystone on Hyperliquid without connecting it every time
Authorize a Hyperliquid API wallet with your Keystone once, then store that API key in Coldfront, a free Chrome extension. Coldfront gives the API key to the official Hyperliquid app while it's unlocked, so you trade from your Keystone's account without connecting the Keystone. Withdrawals still need the Keystone.
Hyperliquid's own Enable Trading approval expires after 14 days, so without this your Keystone has to sign again every two weeks. An API wallet can last up to 180 days. Why the 14 days.
This works with the Keystone Keystone 3 Pro, and with any Keystone that can sign for an Ethereum account.
Connect your Keystone to Hyperliquid
Keystone usually signs by scanning QR codes, so it stays air-gapped. In MetaMask or Rabby, add it as a QR-based hardware wallet by scanning the sync code on the Keystone. Then open app.hyperliquid.xyz, press Connect, and pick that browser wallet.
Every Keystone signature is two QR scans: one from your screen to the Keystone and one back. That's why signing less often on the trading side helps most with a Keystone.
Why the Keystone has to be connected in the first place
Hyperliquid runs in the browser, so the Keystone reaches it through a browser wallet. The app asks the Keystone to sign when you enable trading, when you enable trading again in another browser, and when you withdraw or move funds. That keeps your funds safe, but it also means a browser wallet connected to a trading site and the device close by. A connected wallet is also what fake sites go after: a connect prompt and one signature.
Trade without connecting the Keystone
- Authorize an API wallet with your Keystone. Open app.hyperliquid.xyz/API with the Keystone connected. Enter a name, press Generate and copy the private key it shows: that's the API key, and it's shown once. Press Authorize and confirm on the Keystone.
- Store the API key in Coldfront. Install Coldfront, paste the API key, and pick a passphrase. Add Touch ID (passkey) if you like. Coldfront shows the API wallet address it worked out from the API key, so you can check it matches the API page.
- Disconnect the Keystone and trade. Disconnect the browser wallet from Hyperliquid and put the Keystone away. Unlock Coldfront, open app.hyperliquid.xyz, and trade as usual. The official app shows your Keystone's account and signs orders with the API key.
Coldfront locks after the time you choose, when your computer goes idle, or when you close the last Hyperliquid tab. Locking reloads every Hyperliquid tab, so the app forgets the API key.
What the Keystone still signs
- Authorizing the API wallet, and renewing it (it lasts up to 180 days).
- Withdrawals.
- Moving funds between accounts.
Before you start
Coldfront is free and works with Hyperliquid accounts that joined with Hyperliquid referral code COLDFRONT, which takes 4% off your trading fees. If your Keystone account has never used a referral code, Coldfront adds COLDFRONT during setup when you press Apply code. If it already uses another code, add a second account on the Keystone and follow the new account guide.
Questions
Can I use a Keystone on Hyperliquid?
Yes. Connect the Keystone through a browser wallet such as MetaMask or Rabby and it controls a normal Hyperliquid account. To trade without connecting it every time, authorize an API wallet with it once and use Coldfront.
Do I have to sign with my Keystone for every trade on Hyperliquid?
No. When you press Enable Trading, the Keystone signs once and Hyperliquid's app keeps a trading key in the browser, so orders don't need the device. That key lasts 14 days, so the Keystone has to sign again every two weeks, and again when you enable trading in another browser. An API wallet that you authorize yourself can last up to 180 days. Coldfront gives that API key to the official app, so the Keystone signs about twice a year.
Does the Keystone need to be connected while I trade?
Not with Coldfront. The Keystone signs once to authorize an API wallet. After that, Coldfront gives the API key to the official Hyperliquid app while it's unlocked, and the Keystone can stay disconnected until you withdraw or renew the API wallet.
Can Coldfront withdraw from my Keystone's account?
No. The API key Coldfront holds can place, change and cancel orders. Hyperliquid doesn't let an API wallet withdraw, send, transfer or approve other wallets, so those still need your Keystone.
What if I lose my Keystone?
Your Hyperliquid account belongs to the address, not the device. Restore your recovery phrase on a new Keystone (or another wallet) and you have the account back. The API wallet keeps working until it expires or you revoke it, but withdrawals need the restored wallet.