How to Revoke a Session Key Before It Expires

03 November 2026

Revoking wallets/what-is-a-session-key-and-how-does-it-work-in-a-smart-wallet/">a session key before its expiration date is a straightforward on-chain action: you call the removeSessionKey function on your smart wallet contract, which immediately invalidates the key for all future operations. The key itself remains in your wallet's storage until the expiry timestamp passes, but it becomes cryptographically useless for signing new transaction intents the moment the removal is confirmed. If you are using a wallet that abstracts this behind a mobile app or web interface, the same operation is typically exposed as a "revoke" or "logout" button, but knowing what happens under the hood helps you verify the action actually worked.

Why you might need to revoke early

Session keys are designed to be temporary. They let you authorize a dapp or device to submit transactions on your behalf without exposing your full wallet key. But "temporary" can mean anything from 15 minutes to 90 days, depending on what you configured when you created the session. Situations where early revocation matters include:

• The device holding the session key is lost or stolen.
• The dapp that requested the key turns out to be malicious or compromised.
• You simply changed your mind about trusting that particular session.
• The session key was generated with a very long expiry and you want to reduce your exposure after a phishing attempt, even if you did not click anything.

In all these cases, waiting for the natural expiry is dangerous. A session key that is still valid is a standing authorization. Revocation is the only way to take it back.

What revocation actually does

When you revoke a session key, the smart wallet contract updates its internal mapping of valid signers. The key is marked as invalid for future isValidSignature calls and for ERC-4337 UserOperation validation. Critically, this happens at the contract level, not on the device that holds the key. The session key itself does not need to be online, and the device does not need to "agree" to the revocation. You can revoke a session key from a different device entirely, as long as you hold a signer with sufficient authority (typically the owner key or a threshold of owners, depending on your wallet's configuration).

One important subtlety: revocation is not retroactive for transactions that were already submitted and pending at the time you revoke. If a UserOperation was already broadcast to the mempool with your session key's signature, and the entry point has not yet executed it, there is a race condition. The entry point checks the session key's validity at execution time, not at submission time. So if you revoke before the bundler includes the operation in a block, the operation will fail validation. If the operation was already included, it stands. In practice, the window is seconds to a minute, but if you are revoking because the key is compromised, you should assume an attacker who holds the key might try to front-run your revocation with a pending operation.

Step-by-step: revoking via a wallet interface

Most smart wallet apps (Argent, Safe, Biconomy, and others) expose session key management inside their settings or security menus. The exact labels vary, but the flow is usually:

1. Open the wallet app or web interface and navigate to the settings page.
2. Find the section labelled "Session Keys," "Active Sessions," "Connected Devices," or similar.
3. Locate the session you want to revoke. The list should show the dapp or device name, the expiry date, and possibly the last activity.
4. Select the session and choose "Revoke," "Remove," or "Log Out."
5. Confirm the transaction in the wallet. This is a state-changing operation, so it will require a gas fee and, if your wallet uses ERC-4337 with a paymaster, it may be sponsored. Confirm the fee before signing.
6. Wait for the transaction to confirm. The session key is now dead.

Step-by-step: revoking with a direct contract call

If your wallet does not expose a session management UI, or if you prefer to do it manually, you can call the contract directly. The exact function name depends on the wallet implementation, but the ERC-4337 reference and most major wallet contracts implement removeSessionKey(bytes32 key) or removeOwner(bytes32 key). For a Safe wallet, session keys are not a native primitive; they are typically implemented via a module or a fallback handler. In that case, you may need to call a module-specific function. Check your wallet's contract ABI to be sure.

The general procedure:

1. Get your wallet's contract address and ABI from a block explorer or the wallet's documentation.
2. Use a tool like Etherscan's "Write Contract" interface, or use a script with ethers.js or viem.
3. Connect the signer that has authority to manage session keys. This is usually the wallet owner, or the threshold number of owners for multisig wallets.
4. Call removeSessionKey with the session key's public address as the argument.
5. Sign and broadcast the transaction.
6. Wait for confirmation.

After the transaction confirms, verify the revocation by calling isSessionKeyEnabled or isOwner (whichever your wallet exposes) with the revoked key. It should return false.

What about the expiry timestamp?

The session key's expiry timestamp is not cleared on revocation. It stays in the contract's storage until the block timestamp passes that value. This is mostly a gas optimization - it costs less to leave stale data than to zero it out - but it can be confusing if you inspect the contract state directly. A revoked key will still show an expiry in the future, but the "enabled" flag will be false. Always check the enabled flag, not the expiry, to determine whether a key is currently valid.

Revoking from a hardware signer or cold wallet

If your smart wallet uses a hardware signer as the owner (or as one of several owners in a multisig), you can revoke a session key using that hardware device, just as you would for any other transaction. The session key does not have access to the hardware signer; it is only authorized to sign for the smart wallet under the specific rules you set. So the revocation transaction must be signed by the hardware device, and the session key cannot block it.

What happens to the dapp's pending transactions?

If a dapp holds a session key you revoke, its ability to submit new transactions ends immediately. Any UserOperation it submits after the revocation block will fail validation at the entry point. However, the dapp may still hold a valid session key object locally, and it might display errors when it tries to use it. That is expected. The dapp does not need to be notified; the contract enforces the invalidation.

A note on gas and paymasters

Revoking a session key is a normal state-changing transaction. If your wallet uses ERC-4337 and a paymaster, the revocation may be sponsored, depending on the paymaster's policies. Some paymasters only sponsor specific operations, and a session-key revocation might not qualify. If you are revoking because you suspect the session key is compromised, be prepared to pay the gas yourself. The cost is typically small - a few tens of thousands of gas - but it varies by network and wallet implementation.

When you should not rely on revocation

Revocation only works if the contract is correctly implemented and if you have a valid signer available. If the attacker who stole your session key also has access to your owner key, they can simply add a new session key before you revoke the old one. In that case, you have a bigger problem than session management, and you should treat the wallet as compromised and move funds out immediately.

Also, if your wallet uses a module that caches session key state off-chain, or if the dapp uses a relay that submits operations on your behalf, there is a small chance the relay has already queued an operation signed by the revoked key. You cannot recall a queued operation. The best you can do is revoke as soon as you suspect a problem, and accept that a small window of risk exists between the moment you decide to revoke and the moment the revocation is mined.

Back to smart wallets