authorize_session_signer
Refuses ALWAYS with BROWSER_CONFIRMATION_REQUIRED.
Minting (or reactivating) a session signer grants NEW signing authority -- a trust grant at least as sensitive as loosening a policy, which is already browser-gated. This tool therefore refuses EVERY call, for EVERY wallet (not only Lane 2), after validating capabilities for early UX. The only mint path is the browser handshake: request_session_signer_authorization (open) -> the wallet OWNER approves in their browser -> poll_session_signer_authorization (bind the stored payload). signer_pubkey is a keypair the USER creates and holds -- ONLY its PUBLIC key ever crosses this surface (hard rule 1); once authorized via the handshake, calls carrying it are trade-only under tx_verify (docs/SESSION_SIGNER_DESIGN.md).
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| label | No | ||
| caller_id | No | ||
| expires_at | No | ||
| capabilities | No | ||
| signer_pubkey | Yes | ||
| wallet_address | Yes |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||