Session Keys

Enable gasless transactions with temporary session keys in Ephemeral Rollups

Session Keys

Session Keys enable gasless transactions by allowing users to create temporary keypairs with limited permissions. This advanced pattern is essential for providing smooth, wallet-free experiences in games and applications built on Ephemeral Rollups.

What Are Session Keys?

Session Keys are temporary keypairs that users can create and grant limited permissions to interact with their accounts. They enable:

• Gasless transactions: Users don’t need to approve every transaction
• Improved UX: No wallet popups during gameplay
• Time-limited access: Sessions expire automatically
• Scoped permissions: Sessions can only access specific accounts/programs

Session Keys are particularly powerful in Ephemeral Rollups because they enable continuous, low-latency interactions without wallet approval friction.

How It Works

Counter Account with Authority

Notice the counter includes an authority field:

programs/anchor-counter-session/src/lib.rs

#[account]
pub struct Counter {
    pub authority: Pubkey,
    pub count: u64,
}

pub fn initialize(ctx: Context<Initialize>) -> Result<()> {
    let counter = &mut ctx.accounts.counter;
    counter.count = 0;
    counter.authority = *ctx.accounts.user.key;
    msg!("PDA {} count: {}", counter.key(), counter.count);
    Ok()
}

This authority is checked by the #[session_auth_or] macro to validate session tokens.

Session Token PDA

The session token PDA is derived from:

tests/anchor-counter-session.ts

const SESSION_TOKEN_SEED = "session_token";
const sessionTokenPDA = web3.PublicKey.findProgramAddressSync([
  Buffer.from(SESSION_TOKEN_SEED),
  program.programId.toBytes(),
  sessionKeypair.publicKey.toBytes(),
  provider.wallet.publicKey.toBytes(),
], sessionTokenManager.program.programId)[0];

What Makes This Advanced?

Session Keys demonstrate advanced patterns:

1. Dual Authorization: Support both direct authority and delegated session access
2. Time-Limited Security: Sessions expire automatically for safety
3. Funded Sessions: Can pre-fund sessions to cover gas costs
4. Macro-Based Validation: Use #[session_auth_or] for clean, declarative auth logic
5. ER Integration: Works seamlessly with delegation and commitment flows

Complete Flow Example

On Base Layer

// 1. Create session
await createSession(validFor1Hour, fundWithSOL);

// 2. Initialize counter (with main wallet)
await program.methods.initialize().accounts({...}).rpc();

// 3. Delegate to ER using session key
await program.methods.delegate()
  .accounts({ payer: sessionKeypair.publicKey, ... })
  .signers([sessionKeypair])
  .rpc();

Security Considerations

Important Security Practices:

• Always set expiration times on session tokens
• Store session keypairs securely in the browser (e.g., encrypted localStorage)
• Limit session scope to specific programs/accounts
• Revoke sessions when the user logs out
• Monitor session token balances to prevent fund depletion

Use Cases

Session Keys are essential for:

• Gaming: Players can make rapid moves without wallet approvals
• Social Apps: Continuous interactions without friction
• Trading Bots: Automated trading with limited permissions
• Mobile Apps: Better UX without constant wallet popups

Benefits in Ephemeral Rollups

Combining Session Keys with ERs provides:

• Ultra-low latency + No wallet popups = Best possible UX
• Gasless ER transactions funded by the session
• Automatic state commitment using the session key
• Secure time-limited access to delegated accounts

Next Steps

• Explore Magic Actions to trigger base layer handlers on commit
• Learn about Cranks for automated execution
• Check the full source code