#Backup and Recovery

This guide shows you how to create a recoverable signing identity and back it up with a platform recovery provider. A signing identity binds a signing key to its DID and records how that key is protected and recovered.

Use wallet.signingIdentity for the whole lifecycle: create, back up, discover, restore, and delete recovery records.

#Prerequisites

Before you begin, ensure you have:

• A Wallet SDK instance — Follow Keys and Storage.
• A recovery provider registered in wallet configuration — The SDK registers no recovery provider by default.

#Create

initialize() reopens the selected identity or creates the recommended P-256 / did:jwk identity without recovery. For an explicit recoverable identity, request options and pass the selected object back unchanged:

when (val options = wallet.signingIdentity.creationOptions(SigningIdentityIntent.Recoverable)) {
    is SigningIdentityCreationOptions.Available ->
        showChoices(listOf(options.recommended) + options.alternatives)
    is SigningIdentityCreationOptions.Unavailable -> showUnavailable(options.reasons)
}
val result = wallet.signingIdentity.create(selectedOption)

Options have no public constructor. They belong to the wallet that issued them. The SDK rechecks native support before execution.

#Back Up and Restore

On Android, register a Block Store recovery provider. On iOS, add the WalletSDKKeychainRecovery product:

import WalletSDK
import WalletSDKKeychainRecovery

let configuration = WalletConfiguration(signingIdentity: .init(
    recoveryProviders: [KeychainIdentityRecovery(namespace: "my-wallet")]
))

Then use backupOptions() / backup() to submit a recovery secret, and discoverRecovery() / restorationOptions() / restore() to recover the original key identifier, public key, and DID.

Providers receive secret bytes and must protect them. The SDK verifies local readback before accepting submission. OS acknowledgment does not prove cloud delivery, restoration on another device, or deletion of other device copies.

Optional Enterprise custody copies an exportable key into a KMS resource you authorize. That is a custody copy, not a substitute for platform recovery.

#Next Steps

• Configure hardware keys and encrypted databases — Keys and Storage.
• See how PIN, signing policy, and reader trust differ — Security.
• Wire recovery into onboarding — Integrate the SDK.