> For the complete documentation index, see [llms.txt](https://chaincontext.gitbook.io/help-center/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://chaincontext.gitbook.io/help-center/automation/session-keys.md).

# Session Keys

Session keys give an agent scoped, time-bound, value-capped signing authority — without giving it your wallet's private key. The server signs transactions within the key's scope; the key auto-expires; revocable at any time.

> Session keys require **`projectMode: 'private'`**. The parent wallet must be yours. See [Project Modes](/help-center/project-modes.md).

## Two modes

### ERC-4337 (universal)

Works on any EVM chain with a bundler. ChainContext provides a shared bundler (ZeroDev) on the Builder+ plans; you can supply your own via `bundler_url_{chainId}` in project secrets.

### EIP-7702 (simpler, post-Pectra only)

Your EOA temporarily acts as a smart account for a single tx. No bundler required. Supported chains: Ethereum, Arbitrum, Optimism, Base, Polygon.

## Scope constraints

When provisioning a session key, you define:

```ts
{
  allowedTargets:   ['0xUniswap…', '0xAave…'],    // contracts the key can call
  allowedSelectors: ['0xa9059cbb', '0x095ea7b3'], // function selectors (e.g. transfer, approve)
  maxValueWei:      '1000000000000000000',         // max wei per call
  validUntil:       1735689600,                    // unix timestamp
}
```

Any call outside these constraints is rejected by the validator at runtime.

## Provisioning flow

1. Open project → **Session Keys** → **Provision new key**
2. Pick mode (ERC-4337 or EIP-7702) + parent wallet
3. Set scope (contracts, selectors, value cap, expiry)
4. Sign the authorization with your parent wallet (WalletConnect)
5. The encrypted session key is stored in `project_secrets` keyed by a `sessionKeyRef`

## Using in a tool

Add a `session_key_exec` block referencing the `sessionKeyRef`:

```ts
{
  type:          'session_key_exec',
  mode:          'erc4337',
  sessionKeyRef: 'trading_bot_key',
  target:        { source: 'tool_input', key: 'contract' },
  selector:      { source: 'static', value: '0xa9059cbb' },
  calldata:      { source: 'block_output', blockId: 'encoder', field: 'calldata' },
}
```

On tool call, the runtime decrypts the key, verifies scope, submits the UserOp (4337) or delegated tx (7702), and returns the tx hash.

## Revocation

From the Session Keys page, click **Revoke**. The `validUntil` field is set to `now`; subsequent tool calls reject.

## References

* [ERC-4337 spec](https://eips.ethereum.org/EIPS/eip-4337)
* [EIP-7702 spec](https://eips.ethereum.org/EIPS/eip-7702)
* [ZeroDev session keys](https://docs.zerodev.app/session-keys/intro)