Session Key Manager

WHAT IT DOES

Session Key Manager gives developers and power users direct control over session key registrations on ERC-4337-compatible smart accounts and wallets. It reads live session key status, expiry timestamps, stored permissions, and ERC-20 allowances from the target contract. You can register a new session key with a configurable expiry (in seconds or as a Unix timestamp), revoke an existing session key, and manage token allowances for that session key or other spenders. The tool shows you in real time whether a session key is active, when it expires, and what permissions it holds—so you never have to guess or rely on event logs that only prove a registration happened at some point in the past.

HOW TO USE

Connect your EVM wallet. Enter the session key address you want to manage and the target contract (smart account or wallet) that enforces session key policies. Optionally provide a token address for ERC-20 allowance management. Set the amount for token approvals and an expiry value—either seconds from now (e.g., 3600 for one hour) or a Unix timestamp. Use "Check session" to see if the key is currently active and its expiry time. Click "Register session key" to approve a new session key with the specified expiry and empty permissions (extensible for custom use cases). Use "Revoke session key" to immediately invalidate a session key. The "Set token allowance" and "Revoke allowance" buttons manage ERC-20 approvals independently. Each action generates a transaction you review and sign in your wallet. After confirmation, the tool refreshes session status and allowances automatically.

TECHNICAL APPROACH

This tool queries live contract state using ethers v5.7.2, not historical event logs. It calls isSessionKeyActive() and getSessionKeyExpiry() directly on the target contract to confirm current status, avoiding the trap of assuming a registration event means the key is still valid. For token allowances, it reads allowance() directly from the token contract and converts amounts using decimals(). All RPC calls are wrapped in a robust error handler that extracts the actual failure reason from Ethers error objects—digging three levels deep to avoid showing "[object Object]" when a transaction reverts. For transaction costing, it uses receipt.effectiveGasPrice post-EIP-1559 rather than tx.gasPrice, which overstates actual spend. When computing expiry, the tool automatically detects whether you entered a relative seconds value (less than 10 billion) and converts it to an absolute Unix timestamp before sending the transaction, making it intuitive for developers.

WHAT IT CANNOT SEE

This tool cannot detect off-chain session key usage, intent, or compromise. It cannot verify whether a registered session key is actually being used by an authorized party or whether the key material has been exposed outside the blockchain. It cannot guarantee that a registered session key will be accepted by the target contract—that depends on the contract's own validation logic, permissions structure, and any additional off-chain checks. It does not simulate execution or test whether the session key has the specific permissions you expect beyond what is stored on-chain. It cannot see pending user operations that are not yet broadcast to the public mempool, nor can it detect rate limits, allowlists, or other policy constraints that the target contract may enforce off-chain.

PLEASE NOTE

This tool supports EVM‑compatible chains only (Ethereum, Goerli, Sepolia, Arbitrum, Optimism, Polygon). Solana, Tron, Starknet, SUI, TON, Aptos, Bitcoin, Cosmos, and XRP are not supported. This is a read‑write tool that requires signing transactions—always verify the session key address, target contract, and expiry before approving. No contract addresses are hardcoded; you paste the contract you are using, so you are responsible for verifying its safety and ensuring it implements the expected session key interface. The tool is free and open under the BotGentz PLAYBOOK‑C specification.