> ## Documentation Index
> Fetch the complete documentation index at: https://www.dynamic.xyz/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Wallet backup

> How cloud backup upgrades embedded wallet recovery to a 2-of-3 threshold scheme, and how Google Drive and iCloud differ.

Users can back up their [User Share](/docs/embedded-wallets/mpc/glossary#user-share) to a cloud provider as an additional recovery option, alongside the local copy stored on their device and the [Dynamic Server Share](/docs/embedded-wallets/mpc/glossary#dynamic-server-share). Dynamic supports two providers: **Google Drive** and **Apple iCloud**.

## How cloud backup works

Enabling cloud backup upgrades the wallet from the default 2-of-2 threshold scheme to 2-of-3 through [Key Resharing](/docs/embedded-wallets/mpc/glossary#key-resharing--refreshing):

* The client keeps its local User Share.
* A new share is created and uploaded to the chosen cloud provider.
* Dynamic continues to hold the Server Share.

This creates three recovery paths: local share + Server Share, cloud share + Server Share, or local share + cloud share. The third path is [Independent Recovery](/docs/embedded-wallets/mpc/glossary#independent-recovery): a user with both their local share and their cloud-backed share can reconstruct their wallet without Dynamic's involvement at all.

<Note>
  If [delegated access](/docs/embedded-wallets/mpc/delegated-access/overview) is enabled before or after cloud backup, the delegated share is sent to your webhook instead of a new share going to the cloud provider, and the cloud backup becomes a redundant copy of the client's existing share rather than a distinct one.
</Note>

For meaningful protection, set a [password for the key share](/docs/embedded-wallets/mpc/configuration-guide#password) during wallet creation or update. This is the security boundary that prevents anyone, including Dynamic and the developer, from decrypting the backup. Without a password, the share is still stored encrypted, but the encryption cannot be scoped to a user secret.

Even though a developer can obtain OAuth access tokens for users who authenticate with Google, this does not grant access to the wallet: the key share cannot be reconstructed by the developer or backend, and it remains inaccessible without the user's participation.

## Choosing a provider

|                     | Google Drive                                                          | Apple iCloud                                                 |
| ------------------- | --------------------------------------------------------------------- | ------------------------------------------------------------ |
| **Authentication**  | Google OAuth. The user grants two Drive scopes on the consent screen. | A sandboxed iframe your app cannot access or manipulate.     |
| **Account linking** | The user must link a Google account before backing up.                | Not required; authentication happens during the backup flow. |
| **Availability**    | Generally available.                                                  | Beta.                                                        |

## Enable a provider

Enabling either provider takes two steps: turn it on for your environment in the [Dynamic Developer Console](https://console.dynamic.xyz/dashboard), under **Wallets > Embedded Wallets > Backup & Recovery**, then complete the provider-specific setup in your SDK's implementation guide below. Google Drive also requires enabling the Google Drive API in your Google Cloud project.

When a user successfully backs up their key share, Dynamic fires the `wallet.keyShares.backedUpToExternal` [webhook event](/docs/platform/dashboard/webhooks/events).

## Implement

<CardGroup cols={2}>
  <Card title="Google Drive backup" href="/docs/javascript/wallets/embedded-wallets/mpc/google-drive-backup">
    Configuration steps, OAuth scopes, and the pre-flight readiness check.
  </Card>
</CardGroup>