Recovery
The four ways a Cavos user regains access to their wallet after losing a device — and which ones to offer.
A Cavos wallet is controlled by keys that live on the user's devices and never leave them. That is the point, and it is also the risk: a device that is lost, wiped, or replaced takes its key with it.
So the account is built to recognize more than one authority. Recovery is the work of setting up a second one before it is needed, because none of these can be arranged after the fact.
The four paths
| Path | The user needs | Best for | Cost |
|---|---|---|---|
| Multi-device | Another signed-in device | Users who already have a second device | Nothing to set up |
| Passkeys | Face ID / Touch ID / PIN | Almost everyone — the strongest default | One prompt at signup |
| Recovery codes | A code they stored | A last-resort factor, and self-hosted setups | The user must keep a secret |
| Hardware-isolated recovery | To sign in again with Google / Apple / email | Consumer apps where users will lose everything | Opt-in per environment; adds an enclave to the trust model |
The first two answer "I still have something." The last two answer "I have nothing." A serious app wants at least one of each.
What to offer
Start with a passkey. It is synced by the platform, survives losing the device, needs no secret the user can misplace, and costs one prompt during onboarding. The built-in modal offers it automatically.
Add a way back from nothing. A passkey is bound to the user's platform account; if they lose access to that too, they need another path. That is either a recovery code they kept, or hardware-isolated recovery — which works by signing in again and so asks nothing of the user in advance. Consumer apps usually want the latter, because in practice most users will not keep a code.
Do not rely on multi-device alone. It is excellent when it applies and useless in the case that matters: the user who had one phone and dropped it in a lake.
If a user loses every device and every factor, and none of the above was set up, Cavos cannot restore access. No support ticket recovers that wallet, because no Cavos key can. This is what self-custody costs, and it is the reason to set up a second authority during onboarding rather than when it is needed.
What Cavos never does
None of these paths gives Cavos a key that can move funds. The account contract is the sole authority over who may sign, and every recovery path adds an authority the user's own device — or an enclave that the user's device granted a single restricted permission to — authorized on-chain.
Hardware-isolated recovery is the only path that introduces a party beyond the user and the chain, and it is deliberately bounded: see Why this is still self-custodial.
Per-chain detail
Each adapter implements these with the primitives its chain offers. Recovery codes has the per-chain restore paths, and Hardware-isolated recovery covers what each chain enforces on the recovery authority.