> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rhinestone.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Create a session with a custom setup

> Install the session-key validator and define its permissions.

## Installing the validation

You can install the validator during account deployment:

Examples on this page use `@rhinestone/sdk`, where `rhinestone` is the `RhinestoneSDK` instance from the [custom signer quickstart](/wallets/custom-signer/quickstart).

```ts {6-8} theme={null}
const rhinestoneAccount = await rhinestone.createAccount({
  owners: {
    type: "ecdsa",
    accounts: [ownerAccount],
  },
  sessions: {
    enabled: true,
  },
});
```

You can also install it when the account is already deployed:

```ts theme={null}
import { enable } from "@rhinestone/sdk/actions/smart-sessions";

const transaction = await rhinestoneAccount.prepareTransaction({
  chain: base,
  calls: [enable()],
});
```

To uninstall the validator:

```ts theme={null}
import { disable } from "@rhinestone/sdk/actions/smart-sessions";

const transaction = await rhinestoneAccount.prepareTransaction({
  chain: base,
  calls: [disable()],
});
```

## Creating sessions

To create a session, use `RhinestoneSDK.createSession`:

```ts theme={null}
const session = await rhinestone.createSession({
  chain: base,
  owners: {
    type: "ecdsa",
    accounts: [sessionOwnerAccount],
  },
});
```

To limit the session to specific calls, list the permissions and set `restrictToActions`:

```ts {7-15} theme={null}
const session = await rhinestone.createSession({
  chain: base,
  owners: {
    type: "ecdsa",
    accounts: [sessionOwnerAccount],
  },
  permissions: [
    {
      abi: erc20Abi,
      address: usdcAddress,
      functions: { transfer: {} },
    },
  ],
  restrictToActions: true,
  saltMode: "strict",
});
```

Permissions alone do not make a restrictive allowlist. Without `restrictToActions`, the session retains the wildcard intent-execution fallback for calls approved by the Orchestrator's intent target allowlist. See [Restrict a session](./restrict-a-session) for the behavior and tradeoffs.

Keep `saltMode: "strict"` when creating a new restricted session. The SDK 2.16.1 default, `"none"`, uses a zero salt, so sessions with the same signer reuse a permission ID even when their actions differ. Enabling another definition under that ID adds its policies to the on-chain sets instead of replacing earlier grants. Strict mode gives different restricted definitions distinct permission IDs, but it does not invalidate any permission ID that the signer already controls. Revoke the previous broader session before relying on the signer to have narrower authority.

Permissions govern account calls, while [cross-chain permits](./policies/cross-chain) govern the separate Permit2 claim-signing surface for source-chain assets in cross-chain intents. Because those claims rely on fallback policies for spending and time bounds, the SDK does not allow `restrictToActions` with `crossChainPermits` or `claimPolicies`.

Finally, you can constrain function parameters. The SDK derives the selector and parameter offsets from the ABI, so you reference parameters by name:

```ts {11-21} theme={null}
const session = await rhinestone.createSession({
  chain: base,
  owners: {
    type: "ecdsa",
    accounts: [sessionOwnerAccount],
  },
  permissions: [
    {
      abi: erc20Abi,
      address: usdcAddress,
      functions: {
        transfer: {
          params: {
            recipient: {
              condition: "equal",
              value: "0xd8da6bf26964af9d7eed9e03e53415d37aa96045",
            },
          },
        },
      },
    },
  ],
  restrictToActions: true,
  saltMode: "strict",
});
```

See the [Call policy](./policies/call) for the full set of parameter conditions, and [Restrict a session](./restrict-a-session) to make the listed permissions the only calls the session can run.

## Next steps

<CardGroup cols={2}>
  <Card title="Use a session" href="/wallets/session-keys/custom-setup/use-a-session">
    Enable the session on-chain and transact with it.
  </Card>

  <Card title="Session signing" href="/wallets/session-keys/custom-setup/session-signing">
    Decide what the session key may sign off-chain.
  </Card>
</CardGroup>