---
title: "Backup and Recovery"
description: "Learn how to create, back up, and restore a Wallet SDK signing identity with platform recovery providers."
stack: "Community Stack (open source) — version 1.1.1"
stack_version: "1.1.1"
stack_comparison: https://docs.walt.id/community-vs-enterprise.md
canonical_url: https://docs.walt.id/community-stack/mobile-wallet/backup-and-recovery
generated: 2026-10-01
---
# Backup and Recovery

This guide shows you how to create a recoverable signing identity and back it up with a platform recovery provider. A **signing identity** binds a signing key to its DID and records how that key is protected and recovered.

Use `wallet.signingIdentity` for the whole lifecycle: create, back up, discover, restore, and delete recovery records.

## Prerequisites

Before you begin, ensure you have:

- **A Wallet SDK instance** — Follow [Keys and Storage](https://docs.walt.id/community-stack/mobile-wallet/keys-and-storage.md).
- **A recovery provider registered in wallet configuration** — The SDK registers **no** recovery provider by default.

**Error:**

By default there is no backup. Add a platform provider when you want recovery. Deleting local wallet data and deleting provider recovery records are separate actions.

---

## Create

`initialize()` reopens the selected identity or creates the recommended P-256 / `did:jwk` identity **without** recovery. For an explicit recoverable identity, request options and pass the selected object back unchanged:

**Option: Kotlin**

```kotlin
when (val options = wallet.signingIdentity.creationOptions(SigningIdentityIntent.Recoverable)) {
    is SigningIdentityCreationOptions.Available ->
        showChoices(listOf(options.recommended) + options.alternatives)
    is SigningIdentityCreationOptions.Unavailable -> showUnavailable(options.reasons)
}
val result = wallet.signingIdentity.create(selectedOption)
```

**Option: Swift**

```swift
switch try await wallet.signingIdentity.creationOptions(intent: .recoverable) {
case .available(let recommended, let alternatives):
    print(recommended.storage, alternatives.count)
case .unavailable(let reasons):
    print(reasons)
}
```

Options have no public constructor. They belong to the wallet that issued them. The SDK rechecks native support before execution.

## Back Up and Restore

On Android, register a Block Store recovery provider. On iOS, add the `WalletSDKKeychainRecovery` product:

```swift
import WalletSDK
import WalletSDKKeychainRecovery

let configuration = WalletConfiguration(signingIdentity: .init(
    recoveryProviders: [KeychainIdentityRecovery(namespace: "my-wallet")]
))
```

Then use `backupOptions()` / `backup()` to submit a recovery secret, and `discoverRecovery()` / `restorationOptions()` / `restore()` to recover the original key identifier, public key, and DID.

Providers receive secret bytes and must protect them. The SDK verifies local readback before accepting submission. OS acknowledgment does not prove cloud delivery, restoration on another device, or deletion of other device copies.

**Error:**

iOS cannot restore the original signing key into another device's Secure Enclave. Choose Secure Enclave generation with no secret backup, or a recoverable ordinary-Keychain / software signing identity. On Android, a recovered key can be imported into hardware-backed Keystore when the device supports it; its origin is still imported.

Optional Enterprise custody copies an exportable key into a KMS resource you authorize. That is a custody copy, not a substitute for platform recovery.

## Next Steps

- **Configure hardware keys and encrypted databases** — [Keys and Storage](https://docs.walt.id/community-stack/mobile-wallet/keys-and-storage.md).
- **See how PIN, signing policy, and reader trust differ** — [Security](https://docs.walt.id/community-stack/mobile-wallet/security.md).
- **Wire recovery into onboarding** — [Integrate the SDK](https://docs.walt.id/community-stack/mobile-wallet/integrate-the-sdk.md).