> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ixo.world/llms.txt
> Use this file to discover all available pages before exploring further.

# Manage authorization

> Grant, revoke, and execute Cosmos authz and feegrant messages on the IXO Protocol.

<Tip>
  Authorization (`x/authz`) lets one account grant another the right to broadcast specific message types on its behalf, scoped by amount, time, or message URL. `x/feegrant` lets one account pay another's transaction fees. Both are standard Cosmos SDK modules — IXO uses the upstream message types directly.
</Tip>

## Before you start

You need:

* An IXO account with `uixo` for fees on the network you target — see [Networks and endpoints](/reference/networks-and-endpoints).
* An offline signer — see the [SDK README](https://github.com/ixofoundation/ixo-multiclient-sdk#creating-signers).
* The granter and grantee bech32 addresses.

```bash theme={"system"}
npm install @ixo/impactxclient-sdk
```

```ts theme={"system"}
import { cosmos, createSigningClient } from "@ixo/impactxclient-sdk";

const signingClient = await createSigningClient(RPC_ENDPOINT, offlineSigner);
```

## Grant a send authorization

`SendAuthorization` lets the grantee call `cosmos.bank.v1beta1.MsgSend` from the granter, capped at `spend_limit`.

```ts theme={"system"}
const sendAuth = cosmos.bank.v1beta1.SendAuthorization.fromPartial({
  spendLimit: [{ denom: "uixo", amount: "1000000" }],
});

const grantMsg = {
  typeUrl: "/cosmos.authz.v1beta1.MsgGrant",
  value: cosmos.authz.v1beta1.MsgGrant.fromPartial({
    granter: granterAddress,
    grantee: granteeAddress,
    grant: cosmos.authz.v1beta1.Grant.fromPartial({
      authorization: {
        typeUrl: "/cosmos.bank.v1beta1.SendAuthorization",
        value: cosmos.bank.v1beta1.SendAuthorization.encode(sendAuth).finish(),
      },
    }),
  }),
};

await signingClient.signAndBroadcast(granterAddress, [grantMsg], "auto");
```

For broader grants (e.g. authorize any IBC transfer message URL), use `cosmos.authz.v1beta1.GenericAuthorization` with the target `msg` type URL.

## Execute a granted message

The grantee wraps the message they were authorized to send inside `cosmos.authz.v1beta1.MsgExec`.

```ts theme={"system"}
const innerSend = cosmos.bank.v1beta1.MsgSend.fromPartial({
  fromAddress: granterAddress,
  toAddress: recipientAddress,
  amount: [{ denom: "uixo", amount: "100000" }],
});

const execMsg = {
  typeUrl: "/cosmos.authz.v1beta1.MsgExec",
  value: cosmos.authz.v1beta1.MsgExec.fromPartial({
    grantee: granteeAddress,
    msgs: [
      {
        typeUrl: "/cosmos.bank.v1beta1.MsgSend",
        value: cosmos.bank.v1beta1.MsgSend.encode(innerSend).finish(),
      },
    ],
  }),
};

await signingClient.signAndBroadcast(granteeAddress, [execMsg], "auto");
```

For an IBC transfer, replace the inner message with `ibc.applications.transfer.v1.MsgTransfer`.

## Revoke an authorization

```ts theme={"system"}
const revokeMsg = {
  typeUrl: "/cosmos.authz.v1beta1.MsgRevoke",
  value: cosmos.authz.v1beta1.MsgRevoke.fromPartial({
    granter: granterAddress,
    grantee: granteeAddress,
    msgTypeUrl: "/cosmos.bank.v1beta1.MsgSend",
  }),
};
```

## Grant a fee allowance

```ts theme={"system"}
const basicAllowance = cosmos.feegrant.v1beta1.BasicAllowance.fromPartial({
  spendLimit: [{ denom: "uixo", amount: "500000" }],
});

const grantAllowanceMsg = {
  typeUrl: "/cosmos.feegrant.v1beta1.MsgGrantAllowance",
  value: cosmos.feegrant.v1beta1.MsgGrantAllowance.fromPartial({
    granter: granterAddress,
    grantee: granteeAddress,
    allowance: {
      typeUrl: "/cosmos.feegrant.v1beta1.BasicAllowance",
      value: cosmos.feegrant.v1beta1.BasicAllowance.encode(basicAllowance).finish(),
    },
  }),
};
```

## Revoke a fee allowance

```ts theme={"system"}
const revokeAllowanceMsg = {
  typeUrl: "/cosmos.feegrant.v1beta1.MsgRevokeAllowance",
  value: cosmos.feegrant.v1beta1.MsgRevokeAllowance.fromPartial({
    granter: granterAddress,
    grantee: granteeAddress,
  }),
};
```

The grantee then sets the granter's address as the `feePayer` in the transaction's fee object — the granter is debited instead of the grantee.

## Verify the result

Query active grants through the [gRPC gateway API](/api-reference/grpc-gateway-api):

* `cosmos.authz.v1beta1.Query/Grants` — grants between a granter and grantee
* `cosmos.authz.v1beta1.Query/GranterGrants` — all grants issued by a granter
* `cosmos.authz.v1beta1.Query/GranteeGrants` — all grants received by a grantee
* `cosmos.feegrant.v1beta1.Query/Allowance` — fee allowance status

## Troubleshooting

<AccordionGroup>
  <Accordion title="invalid authorization parameters" icon="circle-xmark">
    Confirm bech32 addresses are valid for the chain prefix (`ixo`), the denom is supported, and the amount is within `spend_limit`.
  </Accordion>

  <Accordion title="execution failures" icon="triangle-exclamation">
    Confirm the grant has not expired, the grantee's transaction message URL exactly matches the authorization's allowed type, and the spend limit has not been exhausted.
  </Accordion>

  <Accordion title="fee allowance issues" icon="hand-holding-dollar">
    Ensure the granter has sufficient balance for the allowance, the allowance type matches the use case (`BasicAllowance` vs `PeriodicAllowance` vs `AllowedMsgAllowance`), and the transaction's `feePayer` is set to the granter.
  </Accordion>
</AccordionGroup>

<Tip>
  Use `AllowedMsgAllowance` to combine fee payment with a strict whitelist of message URLs the grantee may submit at the granter's expense.
</Tip>

## Next steps

<CardGroup cols={2}>
  <Card title="Custom authorizations" icon="key" href="/guides/dev/authz-custom">
    Use IXO-specific authz types for entities, claims, and tokens.
  </Card>

  <Card title="Smart accounts" icon="user-shield" href="/guides/dev/smart-accounts">
    Add programmable authenticators on top of authz.
  </Card>

  <Card title="Cosmos authz module" icon="building-columns" href="https://docs.cosmos.network/main/build/modules/authz">
    Full reference for `x/authz`.
  </Card>

  <Card title="Cosmos feegrant module" icon="building-columns" href="https://docs.cosmos.network/main/build/modules/feegrant">
    Full reference for `x/feegrant`.
  </Card>
</CardGroup>