Skip to main content

How does it work?

Offline recovery creates two additional encrypted key shares (a 2-of-2 pair), separate from the wallet’s primary key shares:
  • Share 1. Encrypted and stored in the user’s Google Drive.
  • Share 2. Encrypted and delivered to your configured webhook when you run an offline recovery reshare.
Share 1 and Share 2 can be combined for offline recovery.

Configure offline recovery

To enable the feature follow the following steps:
  1. Configure Google Drive for your environment.
  2. In the developer dashboard, go to Wallets > Embedded Wallets > Backup & Recovery.
  3. Turn on Developer Recovery Share.
  4. Configure the Share Delivery webhook URL and the RSA public key used to encrypt shares.
When offline recovery is enabled, users cannot use Google Drive as a regular cloud backup.
If delegated access is enabled, offline recovery uses the same share-delivery webhook URL and encryption key.

Request a recovery share

Run an offline recovery reshare from the SDK for the user:
This creates the recovery shares: Share 1 goes to Google Drive, and Share 2 is delivered to your webhook. Step-up authentication is not required, but we strongly recommend requiring it before a recovery share is generated. Complete MFA, then pass the resulting mfaToken:
For other verification methods (passkey, email OTP, and more), see Step-up authentication. Your webhook receives a wallet.offlineRecovery.created event containing the encrypted Share 2. Store Share 2 securely.

Recovery

To recover, the user needs both recovery shares:
  1. Share 2 from your webhook.
  2. Share 1 from their Google Drive.
With both shares, recovery is a local cryptographic operation. Dynamic is not involved. Install the browser wallet package, then call offlineExportKey with the two decrypted shares:
For a full implementation, including decrypting Share 1 and Share 2, see the example recovery tool.
Last modified on August 13, 2026