HTX trading API vs Hyperliquid

HTX trading API 15

No machine payment protocol (0). The fee schedule at htx.com/fee is drawn by script and answered no text, so no price is recorded first-hand (0 of 20, unchecked). Public market data needs no key, card or account; trading needs a verified and funded account. Judgement call (15 of 20). A person must sign up in a browser and pass identity checks (0). 0 + 0 + 15 + 0 = 15.

Hyperliquid 55

No machine payment protocol (0). Fees published per tier without login (20). No card anywhere; public info endpoints are free and the testnet faucet gives 1,000 mock USDC, though only to an address that has deposited on mainnet (15 of 20). No signup; an agent with a funded EVM wallet deposits USDC on a bridged chain and trades, subject to the unread terms (20). Total 55.

HTX trading API 57

Read as a closed service. The readable changelog ends on 24 June 2022, but the official contract SDKs were pushed on 21 October 2026 and the spot SDKs in April and July 2026, so the API surface is still being maintained; judgement call (20 of 30). SDK pushes on 30 July, 23 August and 21 October 2026 are commits, not releases (10 of 20). A Telegram group for API support and a support centre, neither tested; GitHub issues not read (8 of 15). Official SDKs in five languages (15). No CI seen, dependencies not checked (4 of 10). 20 + 10 + 8 + 15 + 4 = 57.

Hyperliquid 39

Read as a closed hosted service with open SDKs. The API has no dated changelog, so the last dated change is the Python SDK's 0.24.0 on 4 June 2026, 152 days before this check; the node repository was pushed on 10 August 2026 and the docs describe newer actions (HIP-4 outcome markets, borrow and lend) without dates. Judgement call (10 of 30). No three dated releases in 90 days (0). Support through Discord and the docs' FAQ, 112 open issues on the SDK whose replies couldn't be read (8 of 25). Official Python and Rust SDKs, the Rust one last pushed 21 October 2025; no MCP registry entry (15). CI on Python 3.9 and 3.13 with Poetry, Dependabot badge, a lock file (6 of 10). Total 39.

HTX trading API 51

HMAC-signed keys with Read, Trade and Withdraw permissions, sub-user keys without Withdraw, up to 20 bound IPs, revocation in the account and a 90-day expiry without IP binding. The AccessKeyId and the HMAC signature travel as query parameters; the secret does not, so no deduction for a secret in the URL (24 of 30). Read-only keys and withdraw-free keys exist; no server-side confirmation for orders or withdrawals (14 of 20). The API returns the exchange's own data, no untrusted content (10). No per-call log or key-use history found for the operator (3 of 15). No security.txt, disclosure policy or certification found on the pages that loaded (0 of 20). 24 + 14 + 10 + 3 + 0 = 51.

Hyperliquid 64

No shared secrets. Actions are signed by the wallet key or by an API wallet the master approves with a name and optional expiry; API wallets can only sign, withdrawals and external sends are user-signed, and approving a new wallet deregisters the old. No IP allow-list or address allow-list (24 of 30). An API wallet is a trading-only credential and info needs no key, but nothing limits order size or marks an action as needing approval (10 of 20). The API returns no untrusted content (10). Fills, historical orders, userRole and nonces are queryable per account; no per-wallet action log (8 of 15). A bug bounty run by the Hyper Foundation with rewards up to under 1 million USDC, a Zellic audit of the bridge contract, a SECURITY.md on the SDK; no security.txt (403), no SOC 2 (12 of 20). Total 64.