What is a session key and how does it work in a smart wallet?

30 September 2026

A session key is a temporary cryptographic key that gives a pre-approved smart contract wallet permission to execute a limited set of actions for a defined period, without requiring the wallet owner's full signature each time. In a smart wallet - whether based on ERC-4337, native account abstraction, or a multisig structure - the session key acts as a delegated authority that can submit transactions on your behalf, subject to rules you set when you authorize it.

Why session keys exist

Smart wallets require a valid signature for every transaction, usually from your main private key or a multisig threshold. For frequent, low-risk actions - like approving a recurring payment, signing into a game, or interacting with a decentralized exchange repeatedly - this constant signing becomes impractical. Session keys solve that by letting you grant a secondary key limited power for a short time, so the wallet can act quickly without pestering you.

How a session key is set up

The process follows a standard pattern across most smart wallet implementations:

1. Generate a session key pair - The wallet app or a decentralized application (dApp) creates a new private-public key pair. The private key stays local on your device; the public key will be registered with your smart wallet contract.

2. Define the session policy - You specify what the session key is allowed to do. Common restrictions include:

3. Target contracts: Only certain smart contract addresses (e.g., a specific DEX or game).
4. Function selectors: Only specific functions (e.g., swap() but not withdraw()).
5. Value limits: A maximum amount of ether or tokens per transaction or total.
6. Time window: An expiry timestamp, often hours or days.

7. Frequency cap: How many calls the session key can make.

8. Authorize the session key - Your main wallet signs a message or transaction that registers the session key's public key and its policy in the wallet contract. This is the only step that requires your full signature.

9. Activate the session - Once the authorization is recorded on-chain, the session key is live. The dApp or wallet can now use the session's private key to sign transactions that the smart wallet will accept as valid.

How a session key transaction executes

When the session key signs a transaction, the smart wallet must verify it without requiring your main key. The verification logic varies by wallet architecture:

• In ERC-4337 wallets: The session key's signature is included in the UserOperation. The wallet's validation function checks that the session key is registered, that the action falls within its policy, and that the key hasn't expired. If valid, the UserOperation proceeds to execution as normal.

• In multisig wallets (like Safe): Session keys are often implemented as "allowance modules" or "delegates". The wallet's module system checks the session key's permissions before forwarding the transaction. The multisig threshold is bypassed for session-authorized actions.

• In native account abstraction (zkSync, Starknet): Session keys are built into the account contract's validation logic. The contract maintains a mapping of authorized session keys with their policies, checked during signature verification.

In all cases, the smart wallet contract stores the session key's public key and policy, so verification happens entirely on-chain or in the validation phase. The session key never replaces your main key - it only acts within its defined boundaries.

Security considerations

Session keys trade security for convenience, so their design matters:

• Expiry is critical: A session key without an expiration is a permanent backdoor. Most wallets enforce a maximum session duration, often 24 hours or less.
• Policy granularity: A session key that can call any function on any contract is essentially a full key. Good implementations restrict the key to specific contracts and functions.
• Revocation: You should be able to revoke a session key at any time by submitting a transaction from your main wallet. Revocation is immediate on-chain.
• Key storage: The session private key lives on the device where it was generated. If that device is compromised, the attacker can use the session until it expires or is revoked.
• Phishing risk: A malicious dApp could request a session key with broad permissions, then abuse it. Always review the policy before signing.

Common use cases

• Gaming: A session key lets you approve in-game actions (buying items, battling) without signing each click.
• Recurring payments: Authorize a subscription or streaming payment for a set period.
• DeFi automation: Allow a bot or strategy to execute trades within limits.
• Login and authentication: Sign into a dApp with a session key instead of your main wallet each time.

Limitations

Session keys do not replace multisig security. If your smart wallet requires 2-of-3 signatures, a single session key cannot authorize a transaction on its own - the wallet must still enforce the multisig rule for any action outside the session's policy. Some wallets allow session keys to be used alongside multisig, but the session key's actions are limited to those explicitly permitted.

Session keys also add complexity to wallet contract logic, which can increase gas costs for setup and verification. And if the session key's policy is too broad, it undermines the security advantages of a smart wallet.

Back to smart wallets