# Authentication (/authentication)



Public market data does not require authentication. Add credentials only when you need MMT data, private account state, or live execution.

## Commands [#commands]

```bash
mlab auth status
mlab auth set <provider>
mlab auth remove <provider>
```

| Provider    | Command                     | Required for                                   |
| ----------- | --------------------------- | ---------------------------------------------- |
| MMT         | `mlab auth set mmt`         | MMT market data                                |
| BULK        | `mlab auth set bulk`        | BULK account data and execution                |
| Hyperliquid | `mlab auth set hyperliquid` | Hyperliquid account data and execution         |
| HyperLink   | `mlab auth set hyperlink`   | HyperLink mainnet Spot and perpetual execution |

## MMT [#mmt]

Get an API key from [mmt.gg](https://mmt.gg/api), then store it:

```bash
mlab auth set mmt
mlab auth status
```

For CI or an ephemeral environment, use an environment variable instead:

```bash
MMT_API_KEY=<key> mlab health --provider mmt
```

Remove the stored key:

```bash
mlab auth remove mmt
```

MMT provides market data only. It is not an execution venue.

## BULK [#bulk]

Authorize a BULK mainnet trading agent:

```bash
mlab auth set bulk
```

Market Lab generates the agent locally and asks for the main wallet private key through a hidden prompt. The main key approves the agent and is not stored.

If registration is interrupted, run the same command again. Market Lab reuses the pending agent:

```bash
mlab auth set bulk
```

Authorize the same local agent on public testnet separately:

```bash
mlab auth set bulk --testnet
```

Use `--reauthorize` with the network you need to replace:

```bash
mlab auth set bulk --reauthorize
mlab auth set bulk --testnet --reauthorize
```

Revoke the agent and remove its local credential:

```bash
mlab auth remove bulk
```

BULK uses mainnet by default. Authentication uses `bulk`, while market data and execution use `bulkf`:

```bash
mlab trade long BTC --venue bulkf --margin 100 --leverage 5 --dry-run
```

Add `--testnet` to use the public testnet. Mainnet and testnet account state are independent.

## Hyperliquid [#hyperliquid]

Authorize Hyperliquid:

```bash
mlab auth set hyperliquid
```

One hidden prompt approves separate mainnet and testnet API agents for the same master account. The master private key is not stored.

The credential is shared by Hyperliquid Spot, core perpetuals, HIP-3 DEXs, and outcome markets. Mainnet is the default. Add `--testnet` when needed.

Replace both agents:

```bash
mlab auth set hyperliquid --reauthorize
```

Remove the credential:

```bash
mlab auth remove hyperliquid
```

## HyperLink [#hyperlink]

[HyperLink](https://www.hyperlink.xyz/) is a separate mainnet execution provider for Hyperliquid Spot, core perpetuals, and HIP-3 perpetuals. It requires its own API-wallet approval:

```bash
mlab auth set hyperlink
```

The main wallet private key is used only to approve the HyperLink agent and is not stored.

Replace the agent:

```bash
mlab auth set hyperlink --reauthorize
```

Remove it:

```bash
mlab auth remove hyperlink
```

The same credential is used by `hyperlink` for Spot and `hyperlinkf` for core or HIP-3 perpetuals. HyperLink has no public testnet, so neither venue accepts `--testnet`. Live trading access may require approval from HyperLink. See the [HyperLink API documentation](https://docs.hyperlink.xyz/).

## Named Subaccounts [#named-subaccounts]

Configure the main account first, then create a named execution subaccount:

```bash
mlab auth set hyperliquid --subaccount trading-2
mlab auth set bulk --subaccount trading-2
mlab auth set bulk --subaccount trading-2 --testnet
```

Hyperliquid creates the same name on mainnet and testnet. BULK creates the name only on the selected network. The main wallet key is requested only to create the subaccount and is not stored.

`main` remains the default account. Named subaccounts are currently available for BULK and Hyperliquid execution only through [Python Scripting V2](/scripting-v2/execution#named-subaccounts). HyperLink does not support Market Lab named subaccounts. CLI trades, bots, strategies, and JavaScript Scripting V1 continue using the main account.

## Credential Files [#credential-files]

Credentials are stored under:

```text
~/.market-lab/credentials/
```

The directory is owner-only (`0700`) and credential files are owner-only (`0600`). Market Lab rejects symlinked, foreign-owned, or broadly readable credential files.

Delegated agent keys are stored unencrypted so `mlabd` can restart unattended on a VPS. Root and processes running as the same operating-system user can read them. Protect the machine and revoke agents if it is compromised.

Never put an API key or private key in `marketlab.toml`, a script, or a command-line argument.

## SSH Targets [#ssh-targets]

Credentials belong to the installation handling the command. Configure an SSH target through an interactive session:

```bash
ssh -t user@SERVER_IP mlab auth set hyperliquid
```

Market Lab does not copy credentials between machines. See [SSH Transport](/transport/ssh).