<!-- tempo-docs-context -->
> Source: [/docs/accounts/admin-keys](https://tempo.xyz/developers/docs/accounts/admin-keys.md)
> Section: [Tempo EVM](https://tempo.xyz/developers/docs/development.md). Build on Tempo EVM: wallets and keys, transactions and fees, TIP-20 Tokens, contracts, exchange, network details, nodes, protocol specifications, and changelog.
> [Documentation index](https://tempo.xyz/developers/llms.txt) · [Docs skill](https://tempo.xyz/developers/SKILL.md)

> Tempo MCP: Use `search`, `find_pages`, `read_page`, and `code` at `https://mcp.tempo.xyz` for Tempo and related documentation.
> If an indexed page is missing or reflects an older site, read this site’s [documentation index](https://tempo.xyz/developers/llms.txt) and Markdown pages directly.

# Manage admin keys

Authorize an admin key when an application or device needs to manage an account's other keys. It can create and revoke limited keys and other admin keys. This delegated authority does not replace the account's root key or change its address.

Admin keys cannot have an expiry, token budget, or call scopes. For spending within those restrictions, use a [limited access key](https://tempo.xyz/developers/docs/accounts/access-keys).

## Authorize an admin key

Create a test account, authorize an admin key, then revoke it. Each transaction requests your passkey confirmation.

### Try it

In the interactive web page, create or connect a testnet passkey account, authorize an admin key, inspect its onchain status, and revoke it.

### TypeScript

Use a funded root account on Moderato testnet for this example. Install Viem with `pnpm add viem` and set `TEMPO_ROOT_PRIVATE_KEY` to that test account's private key in your local environment. Run the code in a server or local script.

```ts [admin-key.ts]
import { tempoModerato } from 'viem/chains'
import { Account, createClient, P256 } from 'viem/tempo'

const privateKey = process.env.TEMPO_ROOT_PRIVATE_KEY
if (!privateKey || !/^0x[0-9a-fA-F]{64}$/.test(privateKey)) {
  throw new Error('Set TEMPO_ROOT_PRIVATE_KEY to a test account private key')
}

const root = Account.fromSecp256k1(privateKey as `0x${string}`)
const client = createClient({
  account: root,
  chain: tempoModerato,
  feeToken: '0x20c0000000000000000000000000000000000001',
})
const adminKey = Account.fromP256(P256.randomPrivateKey(), { access: root })

await client.accessKey.authorizeSync({
  accessKey: adminKey,
  admin: true,
})

console.log(await client.accessKey.isAdmin({ accessKey: adminKey })) // true

// End this demonstration by removing the temporary admin key.
await client.accessKey.revokeSync({ accessKey: adminKey })
console.log(await client.accessKey.isAdmin({ accessKey: adminKey })) // false
```

The example revokes its temporary key before exiting. For ongoing access, retain the key in secure storage and expose revocation in your account UI.

## Use admin authority for key management

The root key or an active admin key can:

* Authorize limited access keys and other admin keys.
* Revoke keys, including admin keys.
* Update a limited key's token spending limit.
* Add, change, or remove allowed-call scopes for a limited key.

Show admin status in your account UI. The `isAdmin` check returns `true` for both the root key and active admin keys. See [Access keys](https://tempo.xyz/developers/docs/accounts/access-keys) for the full permission model.

## Remove or replace an admin key

Have the root or another active admin key revoke the old key and wait for confirmation. Revocation is permanent for that key ID on the account. Authorize a newly generated key if you need a replacement.

Revoking an admin key does not revoke the keys it authorized. Review those grants and revoke them separately.

Use the [Account Keychain specification](https://tempo.xyz/developers/docs/protocol/transactions/AccountKeychain) for the ABI and [admin signature verification](https://tempo.xyz/developers/docs/protocol/upgrades/t6#for-admin-access-keys) for contract checks.