Recovery
The ways a Cavos user regains access to their wallet after losing a device — and which ones to offer.
A Cavos wallet is controlled by keys that live on the user's devices and never leave them. That is the point, and it is also the risk: a device that is lost, wiped, or replaced takes its key with it.
So recovery is the work of setting up a way back before it is needed, because none of these can be arranged after the fact. On Starknet, Solana, and native Stellar that way back is a copy of the MasterDEK the account key derives from.
The paths
| Path | The user needs | Best for | Cost |
|---|---|---|---|
| Multi-device | Another device that restores the MasterDEK | Users who already have a second device | The enclave or a passkey must be enabled |
| Passkeys | Face ID / Touch ID / PIN | Almost everyone | One prompt after login (enrollPasskeyDefault) — never during OAuth |
| Recovery codes | A code they stored | Grandfathered Stellar only | The user must keep a secret |
| Hardware-isolated recovery | To sign in again with Google / Apple / email | Starknet, Solana, and Stellar | Opt-in per environment; the enclave wraps the MasterDEK |
The first two answer "I still have something." The last two answer "I have nothing." A serious app wants at least one of each.
What to offer
Start with a passkey or the enclave — not both as the same deviceApproval.
deviceApproval: "passkey" is one chain, and a passkey that was added can open
the wallet. deviceApproval: "enclave" wraps the MasterDEK for
every native chain in the session. Signing up never asks for a passkey; call
enrollPasskeyDefault() when you want one.
Add a way back from nothing. On Starknet, Solana, and Stellar that is the enclave (sign in again) or a passkey the user added. Recovery codes do not restore native accounts; they apply to grandfathered Stellar wallets only.
Do not rely on multi-device alone: there is no second on-chain signer on native accounts. A second phone unwraps the same DEK.
If a user loses every device and every factor, and none of the above was set up, Cavos cannot restore access. No support ticket recovers that wallet, because no Cavos key can. This is what self-custody costs, and it is the reason to set up a second authority during onboarding rather than when it is needed.
What Cavos never does
None of these paths gives Cavos a hot key that can move funds in production relaying. The enclave only wraps a MasterDEK.
Hardware-isolated recovery is the only path that introduces a party beyond the user and the chain, and it is deliberately bounded: see Why this is still self-custodial.
Per-chain detail
Each adapter implements these with the primitives its chain offers. Recovery codes has the per-chain restore paths, and Hardware-isolated recovery covers what the enclave holds on each chain.
The Cavos vault
On the web, signing keys live in an iframe on a Cavos origin. Your page asks for signatures; the vault signs within the limits you set in the dashboard and asks the user for the rest.
Passkeys
Add a passkey after sign-up so a new device can open the wallet. It carries an encrypted copy of the wallet's key, on Starknet, Solana, and Stellar alike. Signing up never asks for one.