A session key is a temporary key that a smart account accepts for a limited set of actions. The user approves once, for example "this game may make moves for the next two hours" or "this bot may swap up to 500 USDC per day on this exchange", and the application can then sign those actions itself, without a wallet popup each time. The limits are enforced by the account's contract on-chain, so a leaked session key can do only what it was allowed to do.
What a Session Key Can Be Limited To
- Time: valid from and until a set moment.
- Contracts and functions: only specific contracts, and only certain functions on them.
- Amounts: maximum value per transaction, per day or in total.
- Parameters: for example only swaps where the recipient is the account itself.
- Number of uses, and the possibility to revoke it at any time.
Where Session Keys Are Used
- Games: in-game actions without confirming every move.
- Trading and DeFi automation: bots and keepers that can rebalance or protect positions but never withdraw funds. See DeFi position management.
- Subscriptions and recurring payments within an agreed limit.
- Social and consumer apps where frequent small actions must feel instant.
How We Implement Them
Session keys are installed as a validator or permission module on the smart account, using standards such as ERC-7579 or ERC-6900, or the built-in support of the account you use. On the client, the session key is generated and stored so it cannot be exported, for example as a non-extractable browser key. Combined with a paymaster, actions are both popup-free and gasless. The permissions are shown to the user in plain language when they grant them, using EIP-712.
Frequently Asked Questions
What happens if a session key is stolen?
The attacker can only do what the key allows, within its time and amount limits, and the user or application can revoke it immediately.
Do session keys need ERC-4337?
They need a smart account. Most run on ERC-4337 accounts; with EIP-7702, regular addresses can use them too.
Do users have to understand session keys?
No. They see a clear request such as "allow this app to do X until Y", and approve it once.
Who owns the code?
Ownership of the source code is set out in the contract, and the code can be fully yours, including documentation and tests.
Part of our account abstraction work. See also gasless transactions.
Remove the Popups
Tell us which actions your users repeat most. We will design session permissions that make them instant and keep them safe.