Bankr Terminal
Configure these at bankr.bot → Security. They apply to every surface — chat, agent, and API — because they're enforced at the broadcast chokepoint. Modifying them requires web (Privy) authentication; an API key cannot change them. If you've turned on passkey MFA, each change also prompts for a fresh passkey.
Controls
| Control | Default | Effect |
|---|---|---|
| Pause all transactions | Off | Blocks every outbound transaction until unpaused |
| Daily spending limit | $500 / 24h | Rejects any tx that pushes rolling-24h USD outflow past the limit |
| Per-transaction limit | $500 | Rejects any single tx priced above the limit |
| Permitted recipients | Off | Restricts transfers/swaps to an allowlist; new entries enter a cooldown |
| Price impact protection | Off | Rejects swaps whose estimated price impact exceeds your max % — protects against thin pools that would fill far below market value |
| Disable arbitrary contract calls | Off | Blocks write_contract and raw /wallet/submit (named operations like swaps still work) |
| Response channels | All on | Controls which platforms Bankr will respond to you on (X, Farcaster) |
USD limits accept 1 to 1,000,000. Setting 0 is rejected — disable the limit instead. Cooldown accepts 0 to 168 hours. Price impact accepts 1% to 100%.
Pricing & fail-closed behavior
Bankr prices each transaction at submission time using on-chain quotes (0x for EVM, Jupiter for Solana). If pricing is unavailable and a USD limit is enabled, the transaction is rejected rather than waved through. Disable the limit if you need to proceed unpriced.
Recipient cooldown
Newly-added entries on the permitted-recipients list wait the configured cooldown (default 24h) before they're usable. Re-adding a previously-removed recipient restarts the cooldown. Your own EVM and Solana addresses are always implicitly allowed.
Spend tracking
Successful transactions are recorded in a per-wallet spend log, idempotent on transaction hash, so retries can't inflate the daily counter.
Example error messages
This transaction is $2,400.00, above your per-transaction limit of $500.
Adjust the limit or disable it in Security settings to proceed.
This transaction would push your 24-hour spending past the $500 limit
(spent so far: $410.00, this transaction: $120.00).
Adjust the limit or disable it in Security settings to proceed.
0xabc... was added recently and is still in its safety cooldown period.
Available in ~12h.
Passkey MFA
Add a passkey (WebAuthn — Touch ID, Face ID, Windows Hello, or a hardware key) as a second factor to your account under bankr.bot → Security. Require MFA turns on by default when you add your first passkey — the passkey is verified as it's enabled, so you can't lock yourself out with a factor that doesn't work. You can toggle it off anytime (this also prompts for your passkey).
Once MFA is on, it enforces two tiers:
- Login gate — signing in requires your passkey. A successful verification is remembered for 7 days per session, so you're not prompted on every visit.
- Per-operation step-up — changing any Security setting, adding or removing a passkey, or disabling MFA each require a fresh passkey prompt at the moment you make the change.
Enforcement lives at the server, so it covers chat, the agent, and the API session alike — a leaked API key still can't touch these settings. You can manage your passkeys (name, add, remove) from the same Security page.
Bankr MFA is independent of your social login's MFA. Turn on both — see Secure Your Account. Even if your X account is compromised, an attacker without your passkey can't sign in to Bankr or loosen these settings.
Active sessions
The Security page lists every device signed in to your account — OS and browser, approximate location, IP, and last-seen time, with the current session marked. Log out any session you don't recognize; the logout takes effect server-side immediately, and if MFA is on, revoking another session prompts for your passkey. Sessions drop off the list after 60 days of inactivity.
Email logins from the Bankr CLI (bankr login email) are listed here alongside browser sessions and can be logged out the same way. Run bankr update first if you signed in with an older CLI — those sessions predate the change and won't appear.
Reviewing this list periodically is the fastest way to catch an unauthorized login — if you see a session you can't place, log it out and rotate any credentials that may have leaked.