# Signatures and trading sessions

> What your wallet signs, your trading key, trading sessions and how to revoke them.

Source: https://docs.botradix.com/sessions/

BotRadix asks your wallet for two kinds of approval, and it is worth knowing which is which.

| Free signatures (no gas, no transaction) | Wallet transactions (gas in ETH) |
|---|---|
| Accepting the Terms of Use and the Privacy Policy | Withdrawing collateral (classic withdrawal) |
| Downloading your PDF agreement again | |
| Authorizing your trading key | Depositing BAQ |
| Depositing USDC with a permit | Depositing USDC with approval + deposit |
| Starting a trading session (fallback) | Revoking authorizations from your wallet |
| Developer session for API keys | Exit actions from BaseScan (see [Exit without BotRadix](https://docs.botradix.com/exit/)) |
| Granting or revoking the execution permission | |
| Withdrawing collateral by signature (the protocol submits it; the funds go to your wallet) | |

## Your trading key

To trade without a wallet pop-up for every order, the terminal creates a **trading key** in your browser and your wallet authorizes it once with an EIP-712 signature (a "DexAgent" grant).

| | |
|---|---|
| Can | Open, close and invert positions; set and edit TP/SL; cancel and replace orders; add or withdraw isolated margin and change its leverage |
| Cannot | Withdraw or move funds outside the DEX. It can only move margin between your account and your own isolated positions. With a cross market in a closed session it can bring USDC from your wallet into the margin of an isolated position of yours only if your wallet co-signs that specific action (a free signature binding the amount, the position, the trading key and a 2-minute window), plus the USDC permit for that exact amount; never more (see [Orders and positions](https://docs.botradix.com/orders/)) |
| Who submits its actions | Only the protocol's executors, which also pay the gas |
| Validity | 180 days by default in the terminal (the contract allows grants up to 2,000 days; bot keys use up to 1,999 days) |
| Per action | Each signed action must execute before its deadline and no more than 120 seconds after it is signed; the contract rejects deadlines beyond 10 minutes. The terminal prepares a 90-second lifetime by default |
| Rate limits | 30 actions per minute and 300 per hour per wallet (configurable backend controls, not contract limits) |

If your wallet is a contract (smart wallet), every action re-checks the grant against your wallet's current signer: if you change it, the old grant stops working and the terminal asks you to sign it again.

The key is stored only in that browser. On a shared or untrusted computer, revoke it when you finish.

**Revoking.** You can revoke one trading key or all of them at any time from the terminal (a wallet transaction). Revoking an API key also retires its trading key. After revoking, the next trade asks for a new authorization.

## Trading sessions (fallback)

If a trading key is not available, the terminal can use a **trading session** of 8, 24 or 72 hours: a signature that lets the protocol relay your orders during that time (the 24- and 72-hour options carry a 15-minute allowance). A session cannot withdraw funds, expires after at most 3 days (a limit the administrator can set between 1 hour and 30 days), uses the same leverage tiers as the trading key (up to 100x), and its executions carry a small network-cost charge in USDC, shown before you confirm.

A session **cannot bring USDC from your wallet**. If an operation needs margin from your wallet (a cross market in a closed session), the terminal does not use the session: your wallet signs that specific operation, even with an active session.

> [!NOTE]
> A session signs the fingerprint of the contract code it authorizes. When an upgrade changes that code (such as the version 2.2 upgrade or the October 2026 wallet-authorization improvement), sessions created before it stop working and the terminal tells you and asks you once to sign a new one. Trading keys and bots are not affected.

## Terms and risk guide

- Before your first action, the terminal shows a **risk guide** (also every fifth visit, and on demand from **DEX settings**).
- You accept the **complete BotRadix Terms of Use** (sections 1 to 26, including the DEX sections) and the **Privacy Policy** (current version 2026-10-12.2) with three confirmations and a free signature, valid for your wallet. The message you sign includes the SHA-256 fingerprint of the exact text of both documents, the same one the legal pages show. When the texts change, the terminal asks you to accept the new version once; earlier acceptances remain valid for their version. Choosing "Not now" disconnects the wallet.
- Right after signing, your **BotRadix User Agreement in PDF** is downloaded: three pages: English and Spanish with the key clauses quoted, the exact message you signed, the signature and how to verify it without relying on BotRadix, and a third, bilingual **User Safeguards** page that summarizes, with their sections, the protections described in the Terms (exit without the website, your wallet authorizes your money, public record on Base, planned sealing and contact). Copies issued before this page keep their two pages. Its only personal data are your wallet and your signature. You can download it again with **Download again** or from **DEX settings → My agreement (PDF)**: your wallet signs a free one-use message and you only ever receive your own agreement.

## Good practice

- Always check that you are on **app.botradix.com** before connecting or signing.
- Read what your wallet asks you to sign. BotRadix never asks for your seed phrase or for the private key of your main wallet (the only private key it accepts is that of a dedicated Hyperliquid agent wallet, if you connect Hyperliquid).
- A trading key or session can lose money through trades and, under the code in force, cannot withdraw your collateral or bring USDC from your wallet without your wallet's signature for that operation. During the open phase the administrator can change this logic without mandatory advance notice (0 hours).
- If you suspect your browser or computer is compromised, revoke all trading keys and API keys immediately.