# Approvals PayBox authenticates every protected account request with a live MoonX session (access token), verified statelessly. This proves account ownership; no separate proof-of-presence check runs server-side. ## Approval flow When an agent requests something that needs sign-off, PayBox creates a **pending approval**. Wallet grants can use **iframe** mode: the user confirms in the in-chat signing window, which then signs and submits immediately. App **always approve** still requires the user to confirm in PayBox (and a push notification on mobile). Approvals are **operation-bound**: change a parameter (amount, merchant, payload) and it's a new request — an approval can't be replayed against different operation details. :::warning A removed passkey can't be restored from email alone. If passkeys are the only thing protecting your account and you remove the last one, the account is locked for security. Keep a passkey on a second device. :::