Every action on Hup is onchain. A post is a transaction. A like is a transaction. A repost is a transaction. That is the whole point of the app — but taken literally, it means a wallet popup for every tap, and nobody scrolls a feed like that. The In-app wallet tab in Settings is how we solved it.
What it is
The in-app wallet is a session key: a second, lightweight keypair that lives in your browser and is allowed to act as you for a limited time. You authorize it once with your real wallet — a single authorizeSession(key, 30 days) call on the Hup contract — and from then on the session key signs posts, likes and reposts on its own. The contract checks userSessions[you], sees that the signer is your authorized key and the session hasn't expired, and records the action under your account. Your main wallet never has to open.
The Settings page shows exactly what's going on: whether a session is active, the session address, its balance, and when it expires. From there you can authorize, revoke (one onchain call, effective immediately), back up the key to move it to another device, or import one you already have. Two switches sit alongside it: Batch Like, which queues hearts so a burst of likes is sent together, and Gasless Actions, which routes sponsored actions through our relayer so the session costs you nothing.
Why we built it this way
A wallet popup per like is not a social network. Session keys are the standard answer in onchain games, and social has the same shape: many small, low-stakes actions. We wanted a feed that feels like a feed.
It's scoped. The session key can only call Hup's social functions — create, edit, delete, like, unlike. It cannot touch the tokens in your main wallet. It holds, at most, a little native coin for gas, and with Gasless Actions on, often nothing at all.
It's time-boxed and revocable onchain. Sessions expire after 30 days, and you can end one early at any time. Because the authorization lives in the contract, revoking it is real — not a setting we could forget to honour.
It's the same key everywhere. The session key isn't random. It's derived from the app-wide Security Vault (Settings → Security): one wallet signature plus one PIN produce a master secret, and the in-app wallet is a child of it. The same wallet and PIN reproduce the same session key on any device, and the key is stored encrypted under that master — the app never asks for a separate wallet password.
It unlocks things a normal wallet can't. Universal Profiles are smart-contract accounts and can't sign a gasless forward request themselves; the session key is what lets UP users ride the sponsored relay. And mini apps like Hup Miner get a narrow signing bridge to the session key, so a third-party frame can play a game without ever touching your real wallet.
In short: your keys stay yours, your main wallet stays quiet, and Hup gets to behave like the social app it's meant to be.