Bankr Terminal
Configure these at bankr.bot → Security. They apply to every surface — chat, agent, and API — because they're enforced at the broadcast chokepoint. Modifying them requires web (Privy) authentication; an API key cannot change them. If you've turned on passkey MFA, each change also prompts for a fresh passkey.
The Security page is split into three tabs — Transactions (the controls below), Response Channels, and MFA & Sessions.
Controls
These live on the Transactions tab. Response channels have their own tab and are covered separately.
| Control | Default | Effect |
|---|---|---|
| Pause all transactions | Off | Blocks every outbound transaction until unpaused |
| Enable arbitrary contract calls | On | While off, blocks write_contract, submit_raw_transaction, deploy_contract, and raw /wallet/submit (named operations like swaps still work) |
| Daily spending limit | $500 / 24h | Rejects any tx that pushes rolling-24h USD outflow past the limit |
| Per-transaction limit | $500 | Rejects any single tx priced above the limit |
| Permitted recipients | Off | Restricts transfers/swaps to an allowlist; new entries enter a cooldown |
| Price impact protection | Off | Rejects swaps whose estimated price impact exceeds your max % — protects against thin pools that would fill far below market value |
USD limits accept 1 to 1,000,000. Setting 0 is rejected — disable the limit instead. Cooldown accepts 0 to 168 hours. Price impact accepts 1% to 100%.
Raw contract interactions work out of the box. If you don't use them, turning this off is a cheap way to shrink what a compromised session can do — named operations like swaps and transfers keep working either way.
Timers: turn a control off (or on) for a fixed window
Four of the controls above — plus response channels — take an optional timer, so a temporary loosening doesn't quietly become permanent. (Pause all transactions and permitted recipients don't.) In every case the deadline is computed on the server — you pick a duration, not a timestamp — and the choices are 10 min, 30 min, 1 hour, 24 hours, or no timer at all.
The timer always runs on the less safe side of the toggle, and always resolves back toward the safe one:
| Control | Timer rides | When it lapses |
|---|---|---|
| Daily spending limit, per-transaction limit, price impact protection | turning the protection off | the protection turns itself back on |
| Enable arbitrary contract calls | turning the permission on | arbitrary contract calls switch back off |
| Response channels | turning a channel on | Bankr stops replying on that channel again |
Deadlines resolve at read time — there's no background sweeper and no delay. A lapsed timer can only restore a protection or revoke a permission; it can never turn a protection off or grant a permission you didn't ask for. Editing a control (toggling it, or changing its amount) replaces whatever timer was running, so you can't be left with a stale window you've forgotten about.
The Security page shows the running state inline — "Turns back on at …" while a protection is off on a timer, and "Turned back on at …" for a window that has already lapsed.
The toggle used to read "Disable arbitrary contract calls", off by default. It now reads "Enable arbitrary contract calls", on by default — the same behaviour (calls allowed until you say otherwise), stated the way round that matches the timer, which grants the permission for a window rather than suspending a protection. If you're calling the API, prefer PATCH /user/security/arbitrary-contract-calls with { enabled, durationMinutes? }; the old negative-framed route still works but is deprecated.
Response channels
Response channels have their own tab on the Security page and control which platforms Bankr replies to you on. Every channel is on by default.
A row appears for each social account you've linked — X (Twitter), Farcaster, and Telegram. Turning one off stops Bankr replying to you there; your messages still land in chat history, so re-enabling the channel doesn't lose anything said in the meantime.
Telegram's /start and wallet-linking commands stay live regardless, so switching replies off can never lock you out of account management.
Pricing & fail-closed behavior
Bankr prices each transaction at submission time using on-chain quotes (0x for EVM, Jupiter for Solana). If pricing is unavailable and a USD limit is enabled, the transaction is rejected rather than waved through. Disable the limit if you need to proceed unpriced.
Recipient cooldown
Newly-added entries on the permitted-recipients list wait the configured cooldown (default 24h) before they're usable. Re-adding a previously-removed recipient restarts the cooldown. Your own EVM and Solana addresses are always implicitly allowed.
Spend tracking
Successful transactions are recorded in a per-wallet spend log, idempotent on transaction hash, so retries can't inflate the daily counter.
Example error messages
This transaction is $2,400.00, above your per-transaction limit of $500.
Adjust the limit or disable it in Security settings to proceed.
This transaction would push your 24-hour spending past the $500 limit
(spent so far: $410.00, this transaction: $120.00).
Adjust the limit or disable it in Security settings to proceed.
0xabc... was added recently and is still in its safety cooldown period.
Available in ~12h.
Passkey MFA
Add a passkey (WebAuthn — Touch ID, Face ID, Windows Hello, or a hardware key) as a second factor to your account under bankr.bot → Security. Require MFA turns on by default when you add your first passkey — the passkey is verified as it's enabled, so you can't lock yourself out with a factor that doesn't work. You can toggle it off anytime (this also prompts for your passkey).
Once MFA is on, it enforces two tiers:
- Login gate — signing in requires your passkey. A successful verification is remembered for 7 days per session, so you're not prompted on every visit. The Bankr CLI can't run a passkey in a terminal, so
bankr login emailhands you an approval link to verify in the browser instead; that approval is valid for five minutes only. - Per-operation step-up — changing any Security setting, adding or removing a passkey, or disabling MFA each require a fresh passkey prompt at the moment you make the change.
Enforcement lives at the server, so it covers chat, the agent, and the API session alike — a leaked API key still can't touch these settings. You can manage your passkeys (name, add, remove) from the same Security page.
Bankr MFA is independent of your social login's MFA. Turn on both — see Secure Your Account. Even if your X account is compromised, an attacker without your passkey can't sign in to Bankr or loosen these settings.
Active sessions
The Security page lists every device signed in to your account — OS and browser, approximate location, IP, and last-seen time, with the current session marked. Log out any session you don't recognize; the logout takes effect server-side immediately, and if MFA is on, revoking another session prompts for your passkey. Sessions drop off the list after 60 days of inactivity.
Email logins from the Bankr CLI (bankr login email) are listed here alongside browser sessions and can be logged out the same way. Run bankr update first if you signed in with an older CLI — those sessions predate the change and won't appear.
Sign out of all clears every session at once — including the device you're on, so you'll be signed out here too. It's the right move when you suspect a compromise and don't want to work down the list one row at a time. The action takes two confirmations and, with MFA on, the same passkey step-up as revoking a single session.
Reviewing this list periodically is the fastest way to catch an unauthorized login — if you see a session you can't place, log it out and rotate any credentials that may have leaked.