Skip to main content
Use one owner account for custody and a separate EOA for delegated trading. Grant only the needed permissions. The permission values and authorization methods are in Signer Reference.

​
Separate nonce domains

Read wallet-local storage at the delegated EOA, not at the shared implementation. Immediate order nonces must increase strictly; they do not have to increase by exactly one.

​
Allocating immediate nonces

Date.now() alone is not an allocator: concurrent requests can receive the same millisecond value. Maintain an atomic allocator per trading EOA, shared by every worker using it. For each allocation:
  1. Read the latest observed onchain nonce and the highest durably allocated local nonce.
  2. Choose the maximum of the current millisecond timestamp, the chain nonce plus one, and the locally allocated nonce plus one.
  3. Verify it is within the contract’s future-skew bound and the hosted Relay’s admitted nonce window.
  4. Persist the reservation before signing or handing the intent to another worker.
The contract’s maxFutureNonceSkewMillis() bounds the nonce relative to block time. If the clock or allocation sequence is too far ahead, wait and reconcile; do not keep incrementing rejected values. Handle Relay nonce and deadline errors using the error reference.

​
Submission ordering

Unique increasing nonces do not guarantee execution order. If a higher nonce executes first, a lower outstanding nonce can become invalid. For an initial integration, submit and confirm one immediate action at a time for each trading wallet. A higher-throughput integration needs explicit ordering and reconciliation across workers and connections. A reconnect does not reset the onchain nonce. Preserve pending intents and the allocator’s durable high-water mark across restarts.

​
Refresh authorization state

Signer grants and revocations advance the root authorization epoch, invalidating older intents across the family, including other signers’ intents. Creating a child does not advance the epoch. After a permission change, read the new nonce and rebuild affected intents. Confirm both live permission and expiry at execution time.

​
Rotation and retirement

  1. Stop the old signer from creating instructions.
  2. Reconcile submitted transactions. Cancel orders or remove liquidity if the strategy is stopping; do not assume revocation performs cleanup.
  3. Revoke the old signer using the owner or a live administrator.
  4. Confirm the receipt and verify isAuthorizedAccountSignerById is false.
  5. Authorize and onboard the replacement signer, then read the latest account authorization nonce.
  6. Resume with new signatures and the replacement wallet’s own nonce state.
If the old key is compromised, revoke promptly; do not wait for the old signer to cooperate. Handle resting orders using the owner’s authority. Separately remove hosted-service access through the operator’s admission process. JWT expiry ends a Relay session. It does not revoke AccountCore permissions or remove EIP-7702 delegation.