Skip to main content
Every time you deposit, withdraw, or rebalance through Tapioca, an on-chain transaction needs to be authorized. Without session keys, you would have to manually approve each of those transactions with a signature — which is both slow and friction-heavy. Session keys solve this by giving you a way to pre-authorize a defined set of actions for a limited period. Think of a session key as a valet key for your smart account: it can only be used for specific actions, with specific limits, and it expires automatically when the session ends.

​
How session keys work

Session keys are built on the EIP-7702 delegate call mechanism. When you create a session key, you are authorizing a scoped permission that lets the Tapioca app execute transactions on your behalf — but only within the bounds you define. Each session key specifies:
  • Allowed contracts — the session key can only interact with the specific contracts you approve (e.g., the Tapioca deposit contract). It cannot touch any other contract or asset in your wallet.
  • Allowed actions — the key is scoped to specific function calls (e.g., deposit, withdraw). It cannot execute arbitrary transactions.
  • Spending limits — you can set a maximum amount per transaction or per session, so the key cannot move more than you’ve authorized.
  • Expiration time — every session key has a hard expiry. Once it expires, it becomes invalid and cannot be used, regardless of what permissions it held.

​
The security model

Session keys cannot drain your wallet. Because each key is strictly scoped to specific contracts and amounts, a compromised or leaked session key can only be used for the exact actions it was authorized for — and only until it expires. Your main smart account signing key remains entirely separate and is never shared with Tapioca.
Revoke any session keys you are no longer actively using. Even though session keys are scoped and time-limited, keeping unnecessary active keys open is not good security hygiene. If you suspect a session key has been compromised, revoke it immediately from Settings > Session Keys.

​
Creating a session key

When you first connect to Tapioca or start a new interaction, the app may prompt you to create a session key if one isn’t already active. You can also create one manually:
1

Open settings

In the Tapioca app, click your account icon and navigate to Settings > Session Keys.
2

Create a new key

Click New Session Key. Review the permissions scope shown — this lists the contracts, actions, and spending limits the key will be authorized for.
3

Set expiry

Choose an expiration time for the session key. Shorter sessions are more secure; longer sessions reduce how often you need to re-authorize.
4

Confirm with your wallet

Sign the authorization request with your Privy embedded wallet. This is the only signature required for the entire session.

​
Viewing active session keys

All your active session keys are visible at Settings > Session Keys. For each key, you can see:
  • The contracts and actions it is authorized for
  • The spending limits in place
  • The expiration date and time
  • The date it was created

​
Revoking a session key

You can revoke any session key at any time, even before it expires:
  1. Go to Settings > Session Keys.
  2. Find the key you want to revoke.
  3. Click Revoke and confirm the action.
Revocation is immediate and on-chain. Once revoked, the key cannot be used for any further transactions.
Session keys that have already expired are shown in a separate Expired section for your records. You do not need to revoke expired keys — they are already inactive.

​
Frequently asked questions

No. Each session key is created with explicit spending limits. If a session key is authorized for a maximum of 500 USDC, it cannot move more than 500 USDC regardless of your total balance. The scope is enforced at the smart contract level — it is not just an app-side restriction.
An expired session key becomes permanently inactive. The Tapioca app will prompt you to create a new session key the next time you initiate an action that requires one. Your funds are unaffected by a session key expiring.
No. Session keys are only required for on-chain write actions — deposits, withdrawals, and rebalancing. Viewing your portfolio, balance, and yield history does not require any active session key.
EIP-7702 is an Ethereum standard that introduces a delegate call mechanism, allowing smart accounts to authorize scoped, time-limited permissions for external callers. Tapioca uses EIP-7702 to implement session keys in a standardized way that is auditable and compatible with Base’s infrastructure, rather than using a custom or proprietary authorization scheme.