# Spend Permissions
Spend permissions let a connected Tempo account approve a scoped access key once, then use that key for repeat activity that stays inside the approved policy.
Use them when an app needs to make the same kind of payment more than once: checkouts, metered APIs, recurring actions, or any flow where asking for a confirmation prompt on every transfer would be noisy. The user still approves the boundary up front: token, amount, allowed call targets, optional recipients, and expiry.
## Demo
By the end of this guide you'll configure a bounded spend permission: the user signs in, approves the policy once, then matching transfers can be signed locally without another Tempo Wallet prompt.
} className="flex flex-col gap-3" wagmiConfig="spendPermissions">
} />
## Walkthrough
::::steps
### Connect an Account
Follow the [Connect Accounts](/docs/guides/connect-accounts) guide to set up Wagmi with a Tempo signing adapter and let the user sign in. This guide uses Tempo Wallet because the example is hosted there, but the `authorizeAccessKey` shape is the same for adapters that support access key authorization.
### Define the Spend Policy
Add `authorizeAccessKey` to the connector. The object describes the permission the user will approve when a matching local key is not already available. Pass a function instead when the policy needs to be computed dynamically.
```tsx twoslash [src/config.ts]
// @noErrors
import { Expiry } from 'accounts'
import { parseUnits } from 'viem'
import { createConfig, http } from 'wagmi'
import { tempo, tempoModerato } from 'wagmi/chains'
import { tempoWallet } from 'wagmi/connectors'
const pathUsd = '0x20c0000000000000000000000000000000000000' as const
export const config = createConfig({
chains: [tempoModerato, tempo],
connectors: [
tempoWallet({
testnet: true,
authorizeAccessKey: { // [!code focus]
expiry: Expiry.days(1), // [!code focus]
limits: [ // [!code focus]
{ token: pathUsd, limit: parseUnits('100', 6) }, // [!code focus]
], // [!code focus]
scopes: [ // [!code focus]
{ address: pathUsd, selector: 'transfer(address,uint256)' }, // [!code focus]
], // [!code focus]
reuse: { // [!code focus]
minExpiry: Expiry.hours(1), // [!code focus]
minLimits: [ // [!code focus]
{ token: pathUsd, limit: parseUnits('10', 6) }, // [!code focus]
], // [!code focus]
}, // [!code focus]
}, // [!code focus]
}),
],
multiInjectedProviderDiscovery: false,
transports: {
[tempo.id]: http(),
[tempoModerato.id]: http(),
},
})
```
:::warning\[Bound permissions are required]
Tempo Wallet approval pages require at least one `limits` entry and one `scopes` entry. `limits` define how much the access key can spend, while `scopes` define which calls it can make. Without both, the approval would be too broad for a user to review safely.
Local adapters may accept broader keys, but production apps should keep the same bounded policy everywhere.
:::
### Sign In with the Policy
Use the same sign-in button from the Connect Accounts guide. If the SDK already has a stored access key that matches the scopes and optional `reuse` policy, sign-in continues without a new access key prompt. Otherwise Tempo Wallet signs the access key authorization returned by `authorizeAccessKey`.
```tsx twoslash [src/Connect.tsx]
// @noErrors
import { useConnect, useConnectors } from 'wagmi'
export function Connect() {
const connect = useConnect()
const [connector] = useConnectors()
return (
)
}
```
### Send Within the Permission
Submit calls that match the approved scopes. The SDK selects the access key when the transfer fits the spend policy; otherwise it falls back to the connected account's normal signing path.
If no matching key exists at send time, the SDK checks whether the configured `authorizeAccessKey` scopes would cover the transaction. When they do, it requests the access key first, stores it, then sends the transaction with that key. When they do not, it skips the access key request and uses the normal signing path.
```tsx twoslash [src/Transfer.tsx]
// @noErrors
import { Hooks } from 'wagmi/tempo'
export function Transfer() {
const transfer = Hooks.wallet.useTransfer()
return (
)
}
```
::::
## Best Practices
### Pair Limits with Scopes
Use `limits` for how much the key may spend, and `scopes` for what calls it may make. A transfer permission should usually include `transfer(address, uint256)` for the token you intend to support.
```tsx twoslash [src/config.ts]
// @noErrors
import { Expiry } from 'accounts'
import { parseUnits } from 'viem'
const pathUsd = '0x20c0000000000000000000000000000000000000' as const
const spendPermission = {
expiry: Expiry.days(1),
limits: [{ token: pathUsd, limit: parseUnits('100', 6) }],
scopes: [
{ address: pathUsd, selector: 'transfer(address,uint256)' },
],
reuse: {
minExpiry: Expiry.hours(1),
minLimits: [{ token: pathUsd, limit: parseUnits('10', 6) }],
},
}
```
The top-level `expiry`, `limits`, and `scopes` define the new key to create when needed. `reuse.minExpiry` and `reuse.minLimits` only decide whether an existing stored key is acceptable to reuse.
### Keep Expiry Short
Start with a short expiry and ask the user to renew when the workflow needs more time. The access key example uses `Expiry.days(1)`, which is a good default for checkout and metered usage flows.
```ts twoslash
import { Expiry } from 'accounts'
const expiry = Expiry.days(1)
```
### Use Recipient Scopes
If your app always pays one recipient, include `recipients` on the scope. Only omit it when the recipient is truly user-selected at transfer time.
```ts twoslash
// @noErrors
const pathUsd = '0x20c0000000000000000000000000000000000000' as const
const scopes = [
{
address: pathUsd,
selector: 'transfer(address,uint256)',
recipients: ['0x0000000000000000000000000000000000000001'],
},
]
```
### Match Token Decimals
Build limits with `parseUnits` and the token's real decimal count. pathUSD uses 6 decimals, so `parseUnits('100', 6)` means a 100 pathUSD cap.
```ts twoslash
import { parseUnits } from 'viem'
const limit = parseUnits('100', 6)
```
## Next Steps