# Create Session Keys

> Documentation index: [llms.txt](https://namera.ai/llms.txt).

Source: https://namera.ai/docs/sdk/guides/accounts/create-session-keys

Register a managed or caller-held session signer.

Issue an API key with `session-key:create`, `session-key:read`, and `wallet:read`. You need an account ID in that workspace. Session custody is independent of account ownership: both signer types work with either account owner.

## Create a managed session [#create-a-managed-session]

The following example deliberately requests root authority for one hour on Sepolia, with message signatures disabled. Root sessions can control the account; select narrower onchain permissions for restricted agents.

```ts title="index.ts"
import { NameraClient } from "@namera-ai/sdk";

const namera = new NameraClient({ apiKey: process.env.NAMERA_API_KEY! });

const result = await namera.sessionKeys.create({
  namespace: "eip155",
  walletId: "0199dfe1-0000-7000-8000-000000000001",
  metadata: { version: 1, name: "Local agent" },
  signer: { custody: "namera-managed", provider: "1claw", algorithm: "secp256k1" },
  onchain: {
    installations: [
      {
        chainId: "eip155:11155111",
        validAfter: Math.floor(Date.now() / 1000),
        validUntil: Math.floor(Date.now() / 1000) + 3600,
        permissions: [{ type: "root" }],
        allowSignatures: false,
      },
    ],
  },
  policies: [],
});
if (!result.success) throw new Error(result.error.message);

console.log(result.data);
```

<div className="docs-response">

```json
{
  "id": "0199dfe1-0000-7000-8000-000000000003",
  "organizationId": "0199dfe1-0000-7000-8000-000000000006",
  "walletId": "0199dfe1-0000-7000-8000-000000000001",
  "signingKeyId": "0199dfe1-0000-7000-8000-000000000012",
  "namespace": "eip155",
  "metadata": {
    "version": 1,
    "name": "Local agent"
  },
  "policies": [],
  "policyHash": "9Z4ZzPfiQ4hIUpSXTY_nQ2E9-kjd2w_5wbLwIj7visI",
  "status": "pending",
  "revokedAt": null,
  "createdAt": "2026-10-15T02:39:05.307Z",
  "signer": {
    "custody": "namera-managed",
    "provider": "1claw",
    "algorithm": "secp256k1",
    "publicKey": "0x04e37a5065266fa599595e06a6968cdfe2d588cfbbbbb48f0d4c504048c53786a87ff061f472d579833ea98e99f425febabd2445a8760e225cb1e5b4a029cd18b8"
  },
  "wallet": {
    "id": "0199dfe1-0000-7000-8000-000000000001",
    "organizationId": "0199dfe1-0000-7000-8000-000000000006",
    "metadata": {
      "version": 1,
      "name": "Provisioned account"
    },
    "status": "active",
    "namespace": "eip155",
    "address": "0x3333333333333333333333333333333333333333",
    "owner": {
      "signingKeyId": "0199dfe1-0000-7000-8000-000000000008",
      "custody": "namera-managed",
      "provider": "1claw",
      "algorithm": "secp256k1"
    },
    "createdAt": "2026-10-15T02:39:05.250Z",
    "updatedAt": "2026-10-15T02:39:05.250Z",
    "implementation": "alchemy-modular-v2",
    "data": {
      "version": 1,
      "modularAccountVersion": "2.0.0",
      "validatorType": "ecdsa_secp256k1",
      "entryPointVersion": "0.7",
      "accountMode": "factory",
      "factoryVersion": "2.0.0",
      "implementationVersion": "v1.0.0",
      "ownerAddress": "0x52e7f17258368d7f9Ebd7bDf8d6869Bc4759aBA1",
      "salt": "0"
    }
  },
  "creator": {
    "type": "api-key",
    "actorId": "0199dfe1-0000-7000-8000-000000000009",
    "id": "0199dfe1-0000-7000-8000-000000000010",
    "metadata": {
      "version": 1,
      "name": "Workspace backend"
    }
  },
  "installations": [
    {
      "id": "0199dfe1-0000-7000-8000-000000000013",
      "chainId": "eip155:11155111",
      "status": "pending",
      "authorization": {
        "version": 1,
        "entityId": 142534698,
        "signerAddress": "0x7838CE7D0AC8943A2fAA4e8ab8ae901b05eA7A03",
        "permissions": [
          {
            "type": "root"
          }
        ],
        "allowSignatures": false,
        "validAfter": 1792031945,
        "validUntil": 1792035545
      },
      "installTransactionHash": null,
      "uninstallTransactionHash": null
    }
  ]
}
```

</div>

The SDK manages managed-provisioning idempotency internally. Namera returns public signer information only.

## Create a local session [#create-a-local-session]

Install `viem` alongside `@namera-ai/sdk`. Generate and securely persist your private key locally before registering its public key:

```ts title="index.ts"
import { NameraClient } from "@namera-ai/sdk";
import { generatePrivateKey, privateKeyToAccount } from "viem/accounts";

const namera = new NameraClient({ apiKey: process.env.NAMERA_API_KEY! });
const privateKey = generatePrivateKey();
const signer = privateKeyToAccount(privateKey);
// Persist the private key in your secure signer store before registration.
const now = Math.floor(Date.now() / 1000);
const result = await namera.sessionKeys.create({
  namespace: "eip155",
  walletId: "0199dfe1-0000-7000-8000-000000000001",
  metadata: { version: 1, name: "Local agent" },
  signer: { custody: "local", algorithm: "secp256k1", publicKey: signer.publicKey },
  onchain: {
    installations: [
      {
        chainId: "eip155:11155111",
        validAfter: now,
        validUntil: now + 3600,
        permissions: [{ type: "root" }],
        allowSignatures: false,
      },
    ],
  },
  policies: [],
});
if (!result.success) throw new Error(result.error.message);

console.log(result.data);
```

<div className="docs-response">

```json
{
  "id": "0199dfe1-0000-7000-8000-000000000002",
  "organizationId": "0199dfe1-0000-7000-8000-000000000006",
  "walletId": "0199dfe1-0000-7000-8000-000000000001",
  "signingKeyId": "0199dfe1-0000-7000-8000-000000000007",
  "namespace": "eip155",
  "metadata": {
    "version": 1,
    "name": "Local agent"
  },
  "policies": [],
  "policyHash": "9Z4ZzPfiQ4hIUpSXTY_nQ2E9-kjd2w_5wbLwIj7visI",
  "status": "pending",
  "revokedAt": null,
  "createdAt": "2026-10-15T02:39:05.274Z",
  "signer": {
    "custody": "local",
    "algorithm": "secp256k1",
    "publicKey": "0x04118cf91563c3c7b00440980e879331bdac649585ea668f5dfdb0d925ae6bc4bc2ce5449ea5eabee69642fa1b6df0dce03b2dc3e7ae4498878013772fdd155cb6"
  },
  "wallet": {
    "id": "0199dfe1-0000-7000-8000-000000000001",
    "organizationId": "0199dfe1-0000-7000-8000-000000000006",
    "metadata": {
      "version": 1,
      "name": "Provisioned account"
    },
    "status": "active",
    "namespace": "eip155",
    "address": "0x3333333333333333333333333333333333333333",
    "owner": {
      "signingKeyId": "0199dfe1-0000-7000-8000-000000000008",
      "custody": "namera-managed",
      "provider": "1claw",
      "algorithm": "secp256k1"
    },
    "createdAt": "2026-10-15T02:39:05.250Z",
    "updatedAt": "2026-10-15T02:39:05.250Z",
    "implementation": "alchemy-modular-v2",
    "data": {
      "version": 1,
      "modularAccountVersion": "2.0.0",
      "validatorType": "ecdsa_secp256k1",
      "entryPointVersion": "0.7",
      "accountMode": "factory",
      "factoryVersion": "2.0.0",
      "implementationVersion": "v1.0.0",
      "ownerAddress": "0x52e7f17258368d7f9Ebd7bDf8d6869Bc4759aBA1",
      "salt": "0"
    }
  },
  "creator": {
    "type": "api-key",
    "actorId": "0199dfe1-0000-7000-8000-000000000009",
    "id": "0199dfe1-0000-7000-8000-000000000010",
    "metadata": {
      "version": 1,
      "name": "Workspace backend"
    }
  },
  "installations": [
    {
      "id": "0199dfe1-0000-7000-8000-000000000011",
      "chainId": "eip155:11155111",
      "status": "pending",
      "authorization": {
        "version": 1,
        "entityId": 145278918,
        "signerAddress": "0xdA46572b24FF407Cb8979412281cEA774087E5d7",
        "permissions": [
          {
            "type": "root"
          }
        ],
        "allowSignatures": false,
        "validAfter": 1792031945,
        "validUntil": 1792035545
      },
      "installTransactionHash": null,
      "uninstallTransactionHash": null
    }
  ]
}
```

</div>

The private key never enters a Namera request. Public-key registration does not populate the SDK’s Node signer store. For execution, configure your trusted local signer binding or use the existing encrypted local-key import flow. Retain the signer after a lost registration response; do not generate a replacement key as a retry.

## Approve installation separately [#approve-installation-separately]

Creation grants the calling API-key actor access to the new session, but does not install it. Each installation starts pending. [Install the session](https://namera.ai/docs/sdk/guides/accounts/install-session-keys) before executing or signing.