TON Connect 2.0 How Wallet Sessions Work and Why They Expire
You scan a QR code or tap a deep link. A wallet opens, asks for approval, and suddenly you’re connected. That handshake is TON Connect 2.0 at work. It’s the standard protocol that lets TON wallets talk to dApps. But the connection doesn’t last forever. Sessions expire. That’s by design.
The Session Lifecycle
Every TON Connect session begins with a bridge request. The dApp generates a payload containing its manifest URL, requested permissions, and a unique client ID. That payload is encoded into a QR code or deep link. Your wallet reads it, decrypts the manifest, and displays the app name, icon, and requested scopes. You approve.
The wallet generates an encrypted session key and sends it back through the bridge. From that moment, the dApp can send signed transactions to your wallet for confirmation; no further QR scans are needed. The bridge itself is a relay server. It never sees the contents of messages. Everything between wallet and dApp is end-to-end encrypted using a shared secret derived during the initial handshake, and each message carries a sequence number to prevent replay attacks.
Why Sessions Expire
Sessions have a built-in time limit. The TON Connect 2.0 specification defines a default session length, typically 24 hours. After that, the bridge invalidates the session ID. The dApp can no longer send requests, and the wallet will refuse to process them.
This is a security feature. A persistent connection is a persistent attack surface. If a session never expired, a compromised dApp could keep sending transaction requests indefinitely. An attacker who gains access to an active session could drain funds without the user ever noticing a new connection. Session expiry forces reauthentication. You have to scan a QR code or tap a link again, which gives you a chance to verify the dApp is still legitimate and limits the window for session hijacking.
The 'session expired' error
Inside Telegram Mini Apps, this error is common. You open a dApp, try to send a transaction, and see "session expired." The dApp still thinks it has a valid connection. The wallet knows otherwise.
This happens because Telegram Mini Apps often keep the dApp UI running in the background. The wallet session times out, but the dApp doesn't refresh its state. You need to reconnect. On Telegram, that usually means closing the mini app and reopening it, or manually triggering a new connection request from the dApp's interface. Some dApps handle this gracefully, detecting the expired session and prompting you to reconnect. Others don't. If you see the error, the fix is simple: disconnect and reconnect.
Session Hijacking Risk
A malicious dApp can request permissions it doesn't need. If you approve a session that asks for unlimited transaction signing, that dApp can drain your wallet until the session expires. The wallet warns you about the requested permissions during the initial handshake. Many users approve without reading.
Session hijacking works differently. An attacker doesn't need to compromise your wallet; they need to compromise the bridge or intercept the session key during the handshake. If they do, they can impersonate the dApp and send transaction requests to your wallet. Your wallet will display the dApp's name and icon, but the requests come from the attacker. This is rare. The bridge protocol uses TLS encryption, and the session key exchange is ephemeral. But it's not impossible.
How to Verify You're Connecting to a Legitimate App
Check the dApp's manifest. TON Connect 2.0 requires every dApp to host a manifest JSON file at a known URL. Your wallet fetches this during the handshake. The manifest contains the dApp name, icon URL, and terms of service link. If any of these look wrong, don't approve. Look at the URL in your wallet's connection prompt. Some wallets display the domain. If the domain doesn't match the dApp you intended to use, reject the request.
Never approve a session that requests "unlimited" or "unrestricted" transaction signing unless you fully trust the dApp. Most legitimate dApps request per-transaction approval. Check the dApp's community. A real project has a website, documentation, and an active user base. A fake one might have none of these.
Sessions expire for a reason. Use that expiry as a reminder to verify what you're connecting to. Every time you reconnect, you have a chance to say no.
Not financial advice. dupetheduck.com publishes market data and general information about digital assets. Crypto assets are volatile and you can lose everything you put in. Nothing here is a recommendation to buy, sell or hold, and we make no price predictions.
Prices are sourced from third parties and may be delayed or wrong. Verify anything you intend to act on against a primary source.