What are Session Keys?

Session keys are temporary signing keys that authorize VordCore to execute trades on your behalf. Your main wallet stays safe — it never signs trade transactions directly. This is the same model used by Hyperliquid.

How it works

Go to the Portfolio page and click Enable Trading
Your wallet produces one EIP-712 signature (no gas, no on-chain tx) authorizing the session key, which is POSTed to the VordCore session API
The session key is stored in your browser (localStorage)
All subsequent trades are signed by the session key, not your main wallet
Sessions expire after a set duration (currently up to 30 days)

Security

Session keys can only execute trades — they cannot withdraw funds or transfer ownership. If a session key is compromised, an attacker could only place trades (which are bounded by your vault balance and position limits). You can revoke a session at any time from the Portfolio page.

VordCore Session API

Sessions are native VordCore state (no on-chain contract, no gas). The owner signs an EIP-712 SessionCreate message; the signature is submitted to the session API, which routes it through consensus. The API is proxied at rpc.vordium.com/session/* and served natively on each validator's port 9001.

`# Create session — owner-signed EIP-712 (see typed data below) POST https://rpc.vordium.com/session/create Body: { "owner": "0x...", "session_key": "0x...", "expires_at": 1699999999, "nonce": 1, "signature": "0x..." }

invalid)

Revoke the active session for an owner (owner-signed)

POST https://rpc.vordium.com/session/revoke Body: { "owner": "0x...", "nonce": 2, "signature": "0x..." }

Check session validity / read the active session

GET https://rpc.vordium.com/session/valid?owner=0x...&session_key=0x... # -> {"valid":true|false} GET https://rpc.vordium.com/session/get?owner=0x...`

EIP-712 typed data The SessionCreate message is signed under the shared VordCore domain. Signatures are 64-byte r‖s (the v byte is stripped; the verifier brute-forces the recovery id).