| Agent-to-agent verification | Two AIs acting on the same wallet can verify each other's authority onchain. No platform in between. |
| Cross-app authorization | Any DEX, orderbook, or protocol can read whether an agent is authorized, without integrating with the specific wallet vendor. |
| A new class of agent services | Users hire AI agents through onchain employment contracts. Anyone can verify what an agent is allowed to do, and revoke is one transaction. |
Permissions without a middleman
Authorization rules live onchain, not in a vendor's database. Any protocol can verify whether an agent is allowed to act, with no integration required.
Policy enforced before every transaction
Spend caps, contract allowlists, and expiry windows are validated at the execution layer, not in application code that can be bypassed.
Self-custodial by architecture
The user signs. The user revokes. Altana never holds keys. Grant or revoke in one transaction, with no support ticket and no counterparty risk.
App developers
Ship agentic features with a wallet your users actually control. Give an agent a scoped key, not full custody, and let the chain enforce the limit.
AI agent builders
Equip your agent with a wallet and a capped, revocable session. The agent operates within the bounds the user set, and those bounds are publicly verifiable.
Protocols and integrators
Read agent authority from the chain before executing. Know exactly what an agent is allowed to do without trusting the agent's own claims.
{parts.map((part, i) => (
{part}
{i < parts.length - 1 && "0xYourContract"}
))}
{address}
)
}
createWallet, grantSession, execute, and revokeSession. },
{ label: "Prerequisites", value: <>SDK installed with a private key and BNB funds. See BNB Smart Chain to get set up. },
]}
/>
***
You own the wallet. The agent gets a scoped key: it can only call the contracts you allow, only up to the spend cap you set, and it expires automatically. You can cut access with one transaction at any time.
### Step 1: Create your wallet
This is your wallet. You're the admin. The agent never sees this key.
```ts
import { createClient, BNB, signerFromPrivateKey } from "@altananetwork/sdk";
const client = createClient({ chains: [BNB] });
const signer = signerFromPrivateKey(process.env.PRIVATE_KEY as `0x${string}`);
const wallet = await client.createWallet({ signer });
console.log(wallet.address);
```
**Fund `wallet.address` with BNB before step 2.**
### Step 2: Grant the agent a session
This is the policy. You define which contracts the agent can call, the daily spend cap, and when the key expires. `grantSession` writes that policy onchain and returns a session object to hand to your agent.
0xYourContract with your contract address.createPasskeyWallet, grantSession, execute, revokeSession. },
]}
/>
### How it works
You hold the admin key inside your device's secure hardware, backed by Face ID or Touch ID. The agent holds a separate, scoped session key with a spend cap, an expiry, and a contract allowlist. You can revoke it in one transaction.
The two roles never share a key:
| Role | Key type | Held by | Can be revoked? |
| ----------- | ------------------- | ------------- | --------------- |
| Admin (you) | Passkey (P-256) | Your device | No: it's yours |
| Agent | Session (secp256k1) | Agent process | Yes: one tx |
### Try it live
Run the complete flow right here — no setup, no code. Each button calls the Altana SDK against BNB. Your passkey stays on your device.
grantSession scoped to the DEX router with a spend cap and expiry, then execute to run the swap. },
{ label: "Prerequisites", value: <>An agentic wallet set up in Give an agent a wallet and a policy, funded on BNB with a stablecoin to trade. },
]}
/>
The example below uses **PancakeSwap** on BNB. Swap in any DEX router address to use a different exchange; the pattern is identical. The flow is three steps: connect to the chain, grant a session scoped to the DEX, then let the agent trade within it.
### Step 1: Connect and load your signer
Create a client for BNB Smart Chain and load the admin signer that owns the wallet.grantSession twice with complementary scopes, execute, the Keystore read for mutual verification, revokeSession. },
{ label: "Prerequisites", value: <>An agentic wallet set up in Give an agent a wallet and a policy, funded on BNB. },
]}
/>
Two agents share one wallet, each with its own scoped session. You grant them separately, they can verify each other, and you can revoke either one without touching the other.
### Step 1: Connect as the wallet admin
One shared wallet, and you hold the admin key.isValidKey plus a keccak256 of the public key. Free, unlimited, from any RPC. },
{ label: "Prerequisites", value: <>A wallet with an active agent session, granted in Give an agent a wallet and a policy. },
]}
/>
Anyone can run this. It is a plain read against the public Keystore, so it needs no admin key, no session, and nothing from Altana.
### Step 1: Set up a public read client
You only need a read client pointed at the chain. No admin key and no session.
```ts
import { createPublicClient, http, keccak256 } from "viem";
import { BNB } from "@altananetwork/sdk";
const client = createPublicClient({
chain: BNB.chain,
transport: http(BNB.publicRpcUrl),
});
```
### Step 2: Derive the agent's key id
Keystore identifies a key by its **key id**, the `keccak256` hash of the SEC1-encoded public key. Hash the agent's session public key to get the value you will ask about.
```ts
const keyId = keccak256(sessionPublicKey);
```
### Step 3: Ask the Keystore whether that key is authorized
Call `isValidKey` on the Keystore for the wallet you care about.grantSession on L1, ensureKeyCached to mirror, then verify from L2. },
{ label: "Prerequisites", value: <>A wallet with an active agent session, granted in Give an agent a wallet and a policy. },
]}
/>
### How it works
Sessions are granted on L1 (Ethereum, the Keystore source of truth). An L2 cache on Base can verify that same session via a storage proof against L1 state, without any bridge message or re-granting.
`ensureKeyCached` handles the proof:
1. Reads the L2 cache. If the key is already there, returns immediately (`cache-hit`).
2. Polls the L2's `L1Block` predeploy until it anchors past the relevant L1 block (`waiting-for-anchor`, typically 1–3 min)
3. Fetches an `eth_getProof` from L1 and submits it to the L2 cache (`submitting-proof`)
4. Returns once the cache confirms the key is live (`done`)
After step 4, any tool on Base can call `isValidKey` on the cache, for free, from any RPC.
The three steps below follow the flow above: grant on L1, mirror to the L2 cache, then verify on L2.
### Step 1: Grant the session on Ethereum (L1)
Sessions are granted on L1, the Keystore source of truth. This is the same `grantSession` you have already used, pointed at Ethereum.
```ts
import {
createClient,
ensureKeyCached,
ETHEREUM,
BASE,
signerFromPrivateKey,
} from "@altananetwork/sdk";
import { createPublicClient, createWalletClient, http } from "viem";
import { mainnet, base } from "viem/chains";
import { privateKeyToAccount } from "viem/accounts";
// 1. Grant the session on Ethereum (L1, source of truth).
const client = createClient({ chains: [ETHEREUM] });
const signer = signerFromPrivateKey(process.env.PRIVATE_KEY as `0x${string}`);
const wallet = await client.createWallet({ signer });
const session = await client.grantSession({
wallet,
signer,
permissions: {
calls: [{ to: "0xSomeContract..." }],
spend: [{ limit: 50_000_000_000_000_000n, period: "day" }],
},
expiry: Math.floor(Date.now() / 1000) + 7 * 24 * 60 * 60,
});
```
### Step 2: Mirror the session to the Base L2 cache
`ensureKeyCached` proves the L1 authorization into an L2 cache. It waits for Base to anchor past the L1 block, submits the storage proof, and returns once the key is live. Any funded account can pay the L2 gas.
```ts
// 2. Mirror the session key to the Base L2 cache.
const l1Client = createPublicClient({ chain: mainnet, transport: http(ETHEREUM.publicRpcUrl) });
const l2Client = createPublicClient({ chain: base, transport: http(BASE.publicRpcUrl) });
// The L2 wallet client pays L2 gas to submit the proof.
// Any funded account works — your own EOA, a backend relayer, etc.
const l2WalletClient = createWalletClient({
account: privateKeyToAccount(process.env.RELAYER_KEY as `0x${string}`),
chain: base,
transport: http(BASE.publicRpcUrl),
});
await ensureKeyCached({
l1Client,
l2Client,
l2WalletClient,
l1KeyStore: ETHEREUM.keyStore,
l2Cache: BASE.keyStoreCache,
user: session.walletAddress,
publicKey: session.publicKey,
onStatus: (s) => console.log(s), // cache-hit | waiting-for-anchor | submitting-proof | done
});
```
### Step 3: Verify the session from Base
Once cached, any tool on Base can confirm the session with a single free read, with no L1 round trip.
```ts
// 3. Verify the session from Base — free, from any RPC.
const { keccak256 } = await import("viem");
const CACHE_ABI = [{
name: "isValidKey", type: "function", stateMutability: "view",
inputs: [
{ name: "user", type: "address" },
{ name: "keyId", type: "bytes32" },
],
outputs: [{ type: "bool" }],
}] as const;
const keyId = keccak256(session.publicKey);
const isValid = await l2Client.readContract({
address: BASE.keyStoreCache,
abi: CACHE_ABI,
functionName: "isValidKey",
args: [session.walletAddress, keyId],
});
console.log("Session valid on Base:", isValid); // true
```
:::info[L2 execution]
The current SDK supports wallet execution on BNB and Ethereum. Cross-chain **verification** from Base is available today via `ensureKeyCached` + `isValidKey`; additional L2 execution support will be added as it ships.
:::
### Why it is different
Authorization crosses chains by storage proof, permissionlessly, with no bridge message and no per-chain re-granting. The first cross-chain action pays the proof cost once; after that, the L2 cache serves reads locally without L1 round-trips.
### What's next
[Browse all guides](/use-cases): see the full map of what you can build with Altana.
import { Eyebrow } from '../../components/Eyebrow'
{code.split(/(0x[A-Z][a-zA-Z]+)/g).map((part, i) =>
/^0x[A-Z][a-zA-Z]+$/.test(part)
? {part}
: part
)}
{url}
)
}
export function ToolSelector() {
const [tool, setTool] = useState('claude')
const tabs = [
{ id: 'claude', label: 'Claude' },
{ id: 'codex', label: 'Codex' },
{ id: 'other', label: 'Other AI' },
]
const tabStyle = (id) => ({
padding: '0.5rem 1.4rem',
border: '1px solid var(--vocs-color_border)',
borderRadius: '6px',
background: tool === id ? 'var(--vocs-color_backgroundDark)' : 'transparent',
color: 'inherit',
cursor: 'pointer',
fontWeight: tool === id ? '600' : '400',
fontSize: '0.95rem',
transition: 'background 0.15s',
})
return (
No code. Add the Altana MCP server to Claude Code and create wallets, grant sessions, and send transactions through chat or slash commands.
Then in Claude Code:
/altana-agentic-wallet:create-wallet/altana-agentic-wallet:grant-session/altana-agentic-wallet:send-tx/altana-agentic-wallet:revoke-sessionSee the MCP Server docs for the full tool reference.
Drop the skill into your project and Claude writes against the SDK correctly inside Cursor or Claude Code: correct function signatures, the right API surface, no hallucinated methods.
See the Claude Skill page for details.
Codex reads AGENTS.md files in your project for instructions and context. Download the Altana skill file and append it so Codex writes against the SDK correctly.
After this, ask Codex to scaffold a wallet, grant a session, or build a trading agent. It will use the correct SDK surface and createClient API.
Codex CLI supports MCP servers. Add the Altana server to your Codex config:
Then prompt Codex to create a wallet, grant a session, or send a transaction using the Altana tools. See the MCP Server docs for the full tool list.
Any AI tool that can read a context or rules file works. Download the Altana skill file and add it wherever your tool reads project instructions.
Common destinations by tool:
.cursor/rules/ or paste into the AI rules panel.windsurfrulesGEMINI.mdFor a richer context, use the docs' machine-readable file. Paste this URL into your AI or feed it as a context file:
Then try:
Which admin key type?
Best for consumer apps where a person approves with Face ID or Touch ID.
Biometric authentication run in the browser through WebAuthn. The private key is created inside your device's secure hardware and never leaves it.
Best for autonomous agents, backend services, and scripts.
A key your own code holds, in an env var, OS keychain, or encrypted file. Altana never sees it. No API key and no hosted backend.
| Agent-to-agent verification | Two AIs acting on the same wallet can verify each other's authority onchain. No platform in between. |
| Cross-app authorization | A DEX, lending protocol, or orderbook can check whether a key is allowed to act on a wallet, without integrating with any wallet vendor. |
| One-tx revocation | Pulling a key from the registry is a single transaction, effective immediately on that chain, with no off-chain coordination required. L2 caches need a post-revocation proof before they agree. |
| A new class of agent services | Users hire AI agents through onchain employment contracts. Anyone can verify what an agent is allowed to do, and revoke takes one tx. |