Session Key
@symmio/session-key is the framework-agnostic runtime behind SYMMIO’s popup-free trading. It generates and manages a session key — a locally held EVM keypair the app signs trades with silently — so a trader authorizes their wallet once and then opens, closes, and adjusts positions with no wallet prompt on the trading hot path.
No React, no wagmi, no DOM globals. The same manager runs in browsers, web workers, and Node scripts. Storage and encryption are yours to provide; everything else is here.
Install
pnpm add @symmio/session-key viemviem is a peer dependency — the manager derives accounts and signs through it.
The problem it solves
Every user action in SYMMIO — open a position, close a position, set / edit / delete a TP or SL — is an EIP-712 signed message. Signed with the connected wallet, that means a popup on every action: one to open, one per TP tweak, five to bulk-close five positions. That is unusable for trading.
Session keys move signing off the wallet. The trader authorizes a session key once (grantDelegation, a single wallet popup), and every subsequent trade signs in the background with zero prompts. The wallet is only touched on connect, delegation, deposit, and withdraw. See How it works for the full flow.
Quickstart
import { createSessionKeyManager, type SessionKeyStorage } from "@symmio/session-key";
const storage: SessionKeyStorage = createAppStorage(); // you own this — see Security & storage
const manager = createSessionKeyManager({ storage });
const state = await manager.initialize(owner); // load an existing key, or generate + persist a new one
const { signature } = await manager.sign("hello");Never encrypted for you. The manager hands your storage adapter the raw private key as plaintext Hex.
@symmio/session-key encrypts nothing — you add it. Read Security & storage before
shipping.
Concepts
Start here — how session keys work, and what you own versus what the package handles.
Why session keys exist, the grantDelegation flow, the key lifecycle, and what this package does and doesn’t own.
The no-encryption contract, the SessionKeyStorage interface you implement, and your responsibilities as the
consumer.
Wiring the manager into SymmioProvider so SDK writes sign through the session key instead of the wallet.
API
The stateful runtime — initialize, sign, signTypedData, rotate, destroy, subscribe, and state.
createSessionKey and sessionKeyFromPrivateKey — raw keypairs with no manager, state, or persistence.
encodeSessionKeyTransferPayload / decodeSessionKeyTransferPayload — short-lived envelopes for device handoff.