Docs / For agents / Scoped keys
Scoped keys.
An agent acts through a narrow, revocable key that can call only what it is allowed to. Never custody.
The model is an allowlist, not a blank grant. A key authorizes specific functions, within caps, and can be revoked at any time.
The allowlist model
The proposed mechanism uses EIP-7702 to let an account authorize a scoped session key. The key is bound to an explicit allowlist of functions on the UNTOLL periphery and hook, and nothing outside it.
| Allowed | Not allowed |
|---|---|
launch, trade, claim | Transfers or approvals outside the allowlist |
| Within per-key caps | Custody of the account's other assets |
| Revocable at any time | Any function not on the list |
Function-only, by design
- Narrow. The key calls the launchpad's functions, not the wallet. It is designed to move only what the allowlist names.
- Revocable. Authorization ends the moment it is revoked. There is no standing custody to unwind.
- Capped. Per-key limits bound blast radius if a key leaks.
An open standard Scoped keys use EIP-7702, an open standard. They are a safety baseline for opening the agent lane, common to any account that adopts the standard.
EIP-7702 support is the proposed design, ahead of deployment.