Skip to main content
Recovery lets users regain access to their embedded wallet when they lose their usable passkeys. A configured recovery guardian authorizes a replacement passkey for the existing smart account, preserving its address and assets rather than creating a new wallet. Recovery adds a credential; it does not automatically remove previously active passkeys.

​
Configure recovery before it is needed

During account creation, Rhinestone first attempts passkey-based recovery using the authenticator’s PRF capability. When that capability is unavailable, you can configure verified-identity recovery as a fallback. Verified-identity recovery lets users prove control of the same email or social identity and register a new passkey. They return through your application’s authentication flow, with recovery applied across the required chains where their account is deployed. This policy must be configured when the account is created. Adding a fallback to your SDK configuration later does not enable recovery for existing accounts. Users must also return to the same application account namespace; changing the domain or passkey configuration selects a different account.

​
Understand guardian authority

The smart account checks guardian authorization onchain. For managed verified-identity recovery, Rhinestone operates the guardian signing service and applies the identity-verification policy offchain. A guardian can authorize a new signer and therefore enable control of the account. Managed recovery depends on that service’s security and availability; it is not trustless end to end.

​
Get started