Authorization: Bearer lg_trade_<64 hexadecimal characters>
Legend documentation
Create and revoke account-scoped trading credentials.
Authorization: Bearer lg_trade_<64 hexadecimal characters>
Treat the key as a secret. The API stores its SHA-256 hash. Read-only keys have trading:read; trading keys created in settings also have trading:write. The server checks current account ownership, key revocation, scopes, network, and feature availability.
Settings handles registration for most integrations. The low-level endpoints are documented under API key actions.
A wallet signs EIP-712 typed data with domain name Legend Trading API, version 1, and a salt equal to keccak256(UTF8("https://app.legend.trade/api/trading")). Use this exact audience for production registration and revocation, including requests sent to trading-api.legend.trade. The signing audience is stable and does not change with the API hostname.
TradingAccess contains these fields, in order:
| Field | Type | Value |
|---|---|---|
| account | string | Legend account UUID |
| network | string | hyperliquid_mainnet |
| keyHash | string | SHA-256 of the entire plaintext API key, lowercase hex without 0x |
| policy | string | JSON with the scopes array sorted lexicographically, without whitespace |
| issuedAt | uint256 | Current Unix time in milliseconds |
| expiresAt | uint256 | 0, meaning valid until revoked |
The JSON consent uses snake_case field names and expires_at: null (or omits that field). A signature must be registered within five minutes of issued_at. This freshness requirement applies to registration only; the created key does not expire.
The signed network, account, permissions, and audience cannot be changed. Create a new key to change permissions. Only main-account, mainnet grants are accepted. A key hash cannot be registered again, including after revocation.
Settings signs RevokeTradingAccess under the same domain, with account and keyHash as string fields. The owner signature is required; knowledge of a key hash alone cannot revoke a key. Revocation works even if trading is disabled. A revocation submitted before registration prevents later replay of that registration.
Revocation stops unsent slices of Legend TWAPs started with that key. If a slice was already sent, Legend records its result before it stops the job. Disabling API access also stops unsent API TWAP slices.
Native Hyperliquid TWAPs and resting venue orders remain active until you cancel them. Use the Legend app to cancel them when API access is disabled. Key revocation does not reverse a trade that already reached the venue.
You can have up to five active keys per user. Signed registration attempts are limited to ten per hour. Revocation remains available when those limits are reached.
Existing grants that explicitly authorized a finite expiry retain that signed restriction; they are not silently extended. Create a new key for access until revocation.