# ERC-7715: Session Keys

Source: https://www.eipsfordesigners.com/standards/ERC-7715
Agent brief: https://www.eipsfordesigners.com/standards/ERC-7715/agent.md
Machine-readable JSON: https://www.eipsfordesigners.com/api/standards/ERC-7715
Last reviewed: 2026-05-25
Last updated: 2026-05-25

| Field | Value |
| --- | --- |
| Status | Draft |
| Chain | both |
| Category | Transaction Friction |
| Journey stages | Approving & Permissioning, Executing Transactions |
| Detailed guide | Yes |
| Official specification | https://eips.ethereum.org/EIPS/erc-7715 |
| Discussion search | https://ethereum-magicians.org/search?q=ERC-7715 |

## UX Impact

Users pre-authorize a scope of actions so they don't sign every interaction — 'approve once, interact freely' for gaming, trading, and social apps. Design implications: design session key creation flows with clear scope display (which actions, spending limits, duration), show active session indicators, add session revocation UI, display remaining session budget/time. Design decisions: balance between permissiveness (fewer prompts) and security (tighter scopes), how to visualize session boundaries to users, whether to auto-expire sessions or require manual revocation. Primary solution to Signing Fatigue (High severity). MetaMask Delegation Toolkit and Viem implementing.

## Summary

Users pre-authorize a scope of actions so they don't sign every interaction — 'approve once, interact freely' for gaming, trading, and social apps.

## For Designers

- You can show session scope as a plain-language permission card before approval.
- Your app can display active session badge with remaining budget and time.
- You can offer one-tap revoke-all in settings for peace of mind.

## Applicability

### When to Use

- High-frequency interactions cause signing fatigue.
- Actions fit clear scopes like in-game moves or limit orders.
- Users understand upfront what the app can do without prompts.

### When to Avoid

- Every action is high-value and needs individual confirmation.
- Wallet or chain lacks session key support.
- Scopes cannot be explained simply to non-technical users.

## Problems It Solves

### Inconsistent behavior across apps

Impact: high

Old way: Each team reinvents copy and edge cases

New way: Shared standard gives predictable UX patterns

### Users surprised by on-chain rules

Impact: high

Old way: Generic transfer UI fails at submit time

New way: Standard-aware UI sets expectations upfront

### Support burden from opaque errors

Impact: medium

Old way: Raw revert reasons in toasts

New way: Mapped states explain what to do next

## Anti-Patterns

### Hiding standard-imposed restrictions until submit

Severity: critical

Users feel tricked when actions fail at the last step

Instead: Show eligibility and badges before the primary CTA

### Protocol jargon in user-facing copy

Severity: high

Non-technical users cannot consent informedly

Instead: Use outcome language with optional technical disclosure

### No fallback when wallet lacks support

Severity: high

Dead-end flows increase churn

Instead: Explain limitation and offer alternate path or network

## Design Decisions

### How much protocol detail do users see?

Recommendation: Lead with outcomes; tuck identifiers behind review.

Rationale: Users decide on consequences, not function selectors.

### What happens when support is missing?

Recommendation: Block with explanation and fallback path.

Rationale: Silent failure feels like a broken product.

### How do you label restricted assets?

Recommendation: Use persistent badges for non-transferable, locked, or expiring states.

Rationale: Hidden restrictions cause rage-quits at transfer time.

## States to Design

### Ready

Trigger: Prerequisites met.

User need: Understand what happens next.

Design response: Enable primary action with plain-language preview.

### Awaiting signature

Trigger: Wallet prompt open.

User need: Know what they are approving.

Design response: Mirror human-readable summary in app and wallet.

### Pending

Trigger: Transaction submitted.

User need: Confidence it is progressing.

Design response: Show status strip with explorer link.

### Succeeded

Trigger: On-chain confirmation.

User need: See updated ownership or balance.

Design response: Celebrate outcome and show new state clearly.

### Failed or reverted

Trigger: Validation or execution failed.

User need: Fix or retry without guessing.

Design response: Name the failed constraint and offer a concrete next step.

## Vocabulary

- Use "Your balance / Your item" instead of "Token ID / Token contract": Ownership language matches mental models.

- Use "Cannot transfer yet" instead of "Transfer reverted": Explain restriction without EVM vocabulary.

- Use "Confirm in wallet" instead of "Sign transaction": Matches wallet UX users already know.

## What to Prototype First

### Primary happy path

Prove the core user promise before edge cases.

Covers: Success state, Clear outcome copy

- Primary CTA
- Confirmation feedback
- Next step

### Blocked or unsupported state

Users discover limits when wallets or chains lack support.

Covers: Unsupported wallet, Wrong network

- Plain-language reason
- Fallback action

### Failure recovery

Trust breaks when errors look like bugs.

Covers: User rejection, Transaction revert

- Retry path
- Support context

### Advanced disclosure

Power users need technical detail without cluttering the default path.

Covers: Contract address, Token ID, Raw status

- Expandable section
- Copy buttons
- Explorer link

## Mental Model

### Scope request

The app asks for a bounded permission: allowed actions, spend cap, and duration. Frame it like app permissions, not cryptographic jargon.

### User approval

One signature creates a session key within those limits. The permission card must list every capability in plain language.

### Silent actions

Within scope, the app executes without per-action wallet popups. Show an active session badge so silent actions never feel hidden.

### Limit enforcement

When spend or time limits are hit, the app must re-prompt or stop. Never let the UI imply unlimited authority.

### Revoke

Users can end the session from settings or the badge. Revoke all should be one tap for peace of mind.

## Seen in the Wild

- MetaMask Delegation Toolkit: Session key implementation reference for wallet teams. (https://docs.metamask.io/delegation-toolkit/)

- Viem: Developer tooling for session permission patterns. (https://viem.sh/)

- Parallel: Games benefit from reduced signing friction during gameplay. (https://parallel.life/)

## On Monad

### Confirmation speed

Ethereum: Multi-step flows can feel slow between signatures

Monad: Sub-second finality tightens feedback loops

Design implication: Prefer inline status over long pending modals on Monad.

### Transaction cost

Ethereum: Gas can discourage exploratory actions

Monad: Lower fees enable lighter-weight interactions

Design implication: Safe to offer preview retries and social actions more freely.

## UX Patterns

### Session Permission Card

Plain-language scope before one-time approval.

Components: ScopeList, SpendCap, ExpiryTimer

User flow:

- App requests session
- User reviews scope
- Approves once
- Actions proceed silently within limits

Mockup registry key: `concept/permit-approval` (React UI on the live standard page).

### Active Session Badge

Persistent indicator of ongoing authorization.

Components: SessionBadge, RevokeButton

User flow:

- Session active
- Badge shows limits
- User can revoke anytime
- App returns to per-action signing

Mockup registry key: `eip-7702/session-permissions` (React UI on the live standard page).

## Related Standards

- EIP-7702: EOA delegation enables session patterns

- ERC-4337: Smart accounts can hold session keys

## Technical Notes

ERC-7715 session keys require clear scope UI — balance permissiveness with security.