A Legend connector can act only within its account permissions. Read access and trading access are different grants, and the host's available tools can further restrict what it can do.
Read access
Read permission lets an integration retrieve account information such as balances, positions, orders, fills, and operation status. In the MCP preview, order preparation can also produce a link to review a supported limit order in Legend. Preparing or opening that link does not submit the order.
Trading access
Trading permission enables supported execution actions, including placing, modifying, and canceling orders. Trades use real funds on Hyperliquid mainnet. The connector does not provide a paper-trading mode.
Neither read-only nor trading-enabled API keys can withdraw or transfer funds. Trading permission can still change your exposure and result in losses. Review the requested permissions when connecting and choose read-only access when execution is unnecessary.
Disconnecting and revoking
Disconnecting an assistant and revoking its underlying Legend credential are different actions. To stop future credential use, revoke the associated API key in Legend's Settings → Trading. Revocation does not cancel resting orders, close positions, or reverse completed trades. Review those separately in Legend.
Keep API keys out of chat messages, screenshots, and public logs. OAuth-based setup should take you to Legend to approve access, rather than ask you to give your wallet's private key to an assistant.
See the connector permissions guide, API authentication reference, and assistant setup FAQ.