Implementing Session Keys for Mobile Crypto App
Signing every transaction with main key + biometry — correct but unbearable in games, DeFi sessions, payment streaming. Session Keys solve this: temporary limited-rights key with TTL signs transactions without confirmation until expiration or limit reached.
Architecture: ERC-4337 + EIP-7715
Session Keys implemented at smart account level (Account Abstraction). Mobile works with userop instead of direct transactions. Stack:
-
permissionless.jsor@zerodev/sdkfor smart account creation -
@zerodev/session-keyfor session management - Bundler (Pimlico, Stackup) for UserOperation sending
Session key — ephemeral keypair (secp256k1) generated on device. Private part stored in Keychain/KeyStore. Public key + permissions policy registered in smart contract via enableSessionKey UserOperation, signed by main key (once, with biometry).
Permission Policy
Session key not all-powerful — this is main advantage. Policy fixes:
const sessionKeyData = await kernelClient.createSessionKey({
sessionKey: sessionKeyWalletClient,
validAfter: Math.floor(Date.now() / 1000),
validUntil: Math.floor(Date.now() / 1000) + 3600, // 1 hour
permissions: [
{
target: GAME_CONTRACT_ADDRESS,
functionName: "playRound",
valueLimit: parseEther("0.01"), // max 0.01 ETH per transaction
}
]
})
Contract rejects any UserOperation exceeding policy. Even if session key compromised — attacker can't withdraw all funds.
Storage and Lifecycle on Mobile
Session private key lives in Keychain with kSecAttrAccessibleWhenUnlockedThisDeviceOnly — no biometry needed because it's policy-limited. Session TTL displayed: "Session active 45 min of 60". Manual revoke — via revokeSessionKey UserOperation, signed by main key.
On app close session key in memory zeroed, but in Keychain remains until TTL expires or explicit revoke.
Important Considerations
Bundler fees: UserOperation via Bundler costs gas. For frequent transaction sessions use Paymaster — smart contract paying gas for user. Integration with Pimlico Verifying Paymaster or Biconomy — standard task.
Can't create session key without internet — need to send enableSessionKey to network. Cache sessionKeyData locally and reuse until TTL expires without network request.
Timeline — 3–5 days: ERC-4337 smart account (if missing), session keypair, permission policy, Bundler/Paymaster integration, session management UI. If smart account exists — 2–3 days.