> Source: [/docs/accounts/access-keys/admin-access-keys](https://tempo.xyz/developers/docs/accounts/access-keys/admin-access-keys.md) > Section: [Accounts](https://tempo.xyz/developers/docs/accounts.md). Create accounts, set up signing methods, policies, access keys, key rotation, and fees, and follow guides for users, automations, agents, and teams. > [Documentation index](https://tempo.xyz/developers/llms.txt) · [Docs skill](https://tempo.xyz/developers/SKILL.md) > Tempo MCP: Use `search`, `find_pages`, `read_page`, and `code` at `https://mcp.tempo.xyz` for Tempo and related documentation. > If an indexed page is missing or reflects an older site, read this site’s [documentation index](https://tempo.xyz/developers/llms.txt) and Markdown pages directly. # Admin Access Keys Manages an account's other access keys without the signers approving each change. ## Overview An admin access key is the only kind of [access key](https://tempo.xyz/developers/docs/accounts/access-keys) that can authorize, change, and revoke keys. A customer's trusted device can add their new phone, or your key-management service can rotate keys. Unlike a limited key, an admin key has no spending limit, expiry, or scopes. Whoever holds it can spend the whole balance. ## Permissions An admin key can: * Authorize any access key, including another admin key. * Change a limited key's [spending limit](https://tempo.xyz/developers/docs/accounts/access-keys/spending-limits) or [scopes](https://tempo.xyz/developers/docs/accounts/access-keys/scopes). * [Revoke](https://tempo.xyz/developers/docs/accounts/access-keys/revocation) any access key, including itself. * Approve a message that a contract checks with [`verifyKeychainAdmin`](https://tempo.xyz/developers/docs/sdk/foundry/signature-verifier#how-signature-verification-works-in-foundry). An admin key isn't a signer. It can't change the signers or the threshold, or lock the signers out. A key-management call from a limited key reverts with [`UnauthorizedCaller`](https://tempo.xyz/developers/docs/protocol/transactions/AccountKeychain#error-unauthorizedcaller). ## Use Cases Give an admin key only to a party you'd trust with the whole balance. On a configurable account (devnet until [T14](https://tempo.xyz/developers/docs/protocol/upgrades/t14)), an admin key also skips the [signing threshold](https://tempo.xyz/developers/docs/accounts/policies/signing-thresholds). It removes the protection of requiring several signers. | Holder | Key | | --- | --- | | A customer's trusted device, or your key-management service | Admin key | | An [AI agent](https://tempo.xyz/developers/docs/accounts/automations/give-an-agent-a-wallet) | Limited key | | A [backend that pays out](https://tempo.xyz/developers/docs/accounts/automations/pay-out-from-a-backend) | Limited key | | A [card program](https://tempo.xyz/developers/docs/accounts/automations/pay-from-an-embedded-wallet) | Limited key | Protect an admin key like a signer. Keep it in a KMS or HSM, or as a [device key](https://tempo.xyz/developers/docs/accounts/authentication/device-keys) that can't be exported. A leaked admin key compromises the account. Its holder can authorize a new admin key before you revoke the leaked one. ## Authorize an Admin Access Key Enough signers to reach the threshold, or an existing admin key, authorize it like any [access key](https://tempo.xyz/developers/docs/accounts/access-keys#authorize-an-access-key). Pass `admin: true` to Viem's [`accessKey.authorize`](https://viem.sh/tempo/actions/accessKey.authorize). Viem ignores `limits`, `expiry`, and `scopes` on an admin key. Tempo rejects an admin authorization that carries any of them. Check a key with [`accessKey.isAdmin`](https://viem.sh/tempo/actions/accessKey.isAdmin). ## Limits * Changing an admin key's spending limit or scopes reverts with [`InvalidKeyId`](https://tempo.xyz/developers/docs/protocol/transactions/AccountKeychain#error-invalidkeyid), because it has neither. To bound its holder, revoke it and authorize a new limited key. * Revoking an admin key leaves the keys it authorized in place, so revoke each one separately. Specification: [Account Keychain admin keys](https://tempo.xyz/developers/docs/protocol/transactions/AccountKeychain#admin-key-authorization). ## Related [Access Keys](https://tempo.xyz/developers/docs/accounts/access-keys): Covers how access keys sign for an account within their bounds. [Revocation](https://tempo.xyz/developers/docs/accounts/access-keys/revocation): Covers how to end an access key and what stays in place. [Signing Thresholds](https://tempo.xyz/developers/docs/accounts/policies/signing-thresholds): Covers the signer approvals an admin key skips. [Device Keys](https://tempo.xyz/developers/docs/accounts/authentication/device-keys): Covers non-exportable keys on a customer's device.