What is a session key?
- Author
- CRYPTO PORT Editorial
- Published
- Updated
- Reading time
- 5 min
In short
A session key is a temporary signing key limited in scope and lifetime, used where actions come in rapid succession — games, for instance — so the user is not prompted every time. The convenience has a cost: once issued, anything within scope executes automatically, so a bad scope can move funds unnoticed.
Key points
- A temporary signing key with a limited scope and expiry
- Removes the prompt on every repeated action
- Anything inside the scope runs without confirmation
- A broad scope is as dangerous as the main key
Definition
A signing key issued alongside the main key but restricted by target contract, callable functions, spending cap and expiry. Used with contract-based accounts.
On-chain games and trading apps become unusable if a wallet prompt appears for every action, yet handing over unconditional signing authority is not acceptable either. The middle path is a temporarily issued key that can only do a narrow set of things, and signs automatically within that set.
The limits run along several axes: which contract addresses can be called, which functions, a per-action or cumulative spending cap, and an expiry. The tighter these are, the smaller the damage if the key leaks. A key granting every function on a contract with no expiry is effectively the main key.
Note that issuing one is itself a signature. The issuing prompt states which contract gets which powers and until when. Approve it without reading, and every asset movement afterwards proceeds with no further confirmation.
Watch out for
- · Issuing one is itself granting permission to move assets — read the scope and expiry
- · Reject any request that sets no spending cap and no expiry
- · Revoke a session key when you are done rather than waiting for it to lapse