Session Key

A session key is a temporary signing key an account grants to an application so it can submit transactions on the owner's behalf without a confirmation prompt each time. The point is that the grant is bounded: a session is issued for a set period, for named contracts or functions, and often up to a value ceiling, so an application that needs many small actions — a game, a trading interface, a subscription — stops interrupting the user without gaining general authority over the account. It requires a smart contract account, because the rules that limit the key have to be enforced by code rather than by the application's good behaviour. The risks follow from the same design. A session key lives on a device or in a browser, so it is exposed the way any hot key is, and the account is only protected by whatever limits the grant actually carries. Read those limits before approving one, and revoke sessions you no longer use.