Hyperliquid exposes two public APIs: an info endpoint for read-only market data and an exchange endpoint for signed trading actions. Most tools — bots, dashboards, backtesters — only ever need the info endpoint, and it requires no API key at all.
The info endpoint
Everything reads through a single POST endpoint: https://api.hyperliquid.xyz/info. The request body’s type field selects what you get back — meta for the asset universe, metaAndAssetCtxs for live prices and funding, predictedFundings for cross-exchange funding comparisons, l2Book for order book snapshots via WebSocket. No auth headers, no API key — it’s fully public.
curl -s -X POST https://api.hyperliquid.xyz/info
-H "Content-Type: application/json"
-d '{"type":"metaAndAssetCtxs"}'Rate limits — the part that trips people up
Hyperliquid enforces rate limits per IP, and the response headers tell you exactly where you stand — but the header names and reset semantics aren’t always obvious on first read. Getting this wrong means either wasting request budget with overly conservative polling, or hitting 429s in production at the worst possible moment.
HIP-3 and the dex parameter
Hyperliquid’s synthetic markets — equities, commodities, FX, indices, even pre-IPO companies — don’t live in the default asset universe. They’re deployed as separate “perpDexs” (query {"type":"perpDexs"} to list them), and you need to pass an explicit dex parameter to metaAndAssetCtxs to see them. Miss this and you’ll only ever see the 200+ native crypto perps.
WebSocket for anything real-time
The REST info endpoint is fine for polling, but order book depth, live trades, and fills need the WebSocket at wss://api.hyperliquid.xyz/ws. Subscribe per-coin to channels like l2Book — each message is a full snapshot, not a diff, which simplifies client logic considerably compared to most exchange WebSocket APIs.
Summary
Start with the info endpoint for anything read-only — no auth needed. Watch the dex parameter if you need HIP-3 synthetic markets. Use the WebSocket, not polling, for anything latency-sensitive. And decode your rate-limit headers correctly before you ship, or you’ll find out the hard way in production.