> ## Documentation Index
> Fetch the complete documentation index at: https://docs.walley.cc/llms.txt
> Use this file to discover all available pages before exploring further.

# Walley Key Management: Passkeys and Recovery Phrases

> Walley's two credentials explained: how the passkey and recovery phrase work, where to store each, how to recover access, and what to do if either is lost.

Walley protects your wallet through two distinct credentials: a **passkey** and a **recovery phrase**. Understanding what each one does, how each one is stored, and what to do if either is lost is essential to maintaining access to your funds. Because Walley is non-custodial, no one else holds copies of these credentials — their security is entirely your responsibility.

<Warning>
  If you lose access to both your passkey and your recovery phrase, your wallet access is permanently and irrecoverably lost. Walley has no mechanism to restore it.
</Warning>

## Your Two Credentials at a Glance

|                          | **Passkey**                                                                          | **Recovery Phrase**                                                                          |
| ------------------------ | ------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------- |
| **What it is**           | A device-bound cryptographic key using the WebAuthn standard                         | A 24-word BIP-39 seed phrase tied to an Ed25519 key pair                                     |
| **Where it lives**       | Inside your device's secure hardware enclave; bound to a specific device             | Written down by you and stored offline; generated client-side                                |
| **How you use it**       | Biometric (Face ID / fingerprint) or device PIN to authorize wallet actions          | Used together with your Party Hint to restore wallet access when your passkey is unavailable |
| **Can it be extracted?** | No — browser-side signing keys are non-extractable within the active browser context | No — generated and imported entirely client-side; never transmitted to Walley's servers      |
| **What it protects**     | Day-to-day wallet access and transaction signing                                     | Ultimate backup; the only recovery path if your passkey device is lost                       |
| **If lost**              | Use your recovery phrase to regain access                                            | Cannot be regenerated — if lost along with your passkey, access is permanently lost          |

## Your Passkey

A passkey is a WebAuthn credential stored in your device's secure hardware. When you authenticate to Walley, your device uses your biometric or device PIN to unlock the passkey and sign the authentication challenge — your biometric or PIN never leaves your device.

### How passkeys work

* **Device-bound:** Your passkey is tied to the specific device on which it was created. It cannot be extracted, copied, or transferred.
* **Non-extractable:** The private key material within the passkey is held inside the device's secure enclave and cannot be read by the browser, Walley's servers, or any other application.
* **Biometric or PIN authorization:** Approving wallet actions requires your biometric or device PIN — adding a physical layer of protection even if someone else has access to your device.

### What to do if you lose your passkey device

<Steps>
  <Step title="Locate your recovery phrase">
    Retrieve the physical copy of your 24-word recovery phrase from wherever you stored it safely.
  </Step>

  <Step title="Open Walley on a new device">
    Navigate to the official Walley application on your replacement device.
  </Step>

  <Step title="Select 'Import Recovery Phrase'">
    Choose the recovery option on the new device. Enter your 24-word recovery phrase and your **Party Hint** when prompted — both are required to complete recovery. This creates a temporary session on the new device.
  </Step>

  <Step title="Act within the session">
    Review balances, complete transactions, or move funds during the session. You will need to re-enter your phrase for each future session on that device.
  </Step>
</Steps>

<Note>
  Recovery via your phrase establishes a temporary session only — Walley cannot link your recovery phrase to a new passkey, so the phrase is required again for every subsequent session. If your original passkey was synced through a credential manager (iCloud Keychain, Google Password Manager), restoring that sync on the new device brings back normal passkey access.
</Note>

## Your Recovery Phrase

Your recovery phrase is a 24-word BIP-39 mnemonic that encodes the Ed25519 key pair underlying your wallet. It is generated entirely within your browser — it is never sent to Walley's servers or stored anywhere outside your control.

### How the recovery phrase works

* **Client-side only:** Generation and import happen exclusively in your browser. Walley never transmits or stores your phrase.
* **The ultimate backup:** It is the only credential that can restore access to your wallet when your passkey is unavailable.
* **Requires your Party Hint:** Recovery requires both your 24-word phrase and your **Party Hint** — a short identifier tied to your on-ledger party. You will need both at the time of recovery, so store them together.
* **Creates a temporary session:** Using your recovery phrase grants access for the current session only. The phrase cannot be linked to a new passkey, so you must re-enter it for each subsequent session.
* **Full wallet access:** Anyone who holds your recovery phrase has complete access to your wallet and funds. Protect it accordingly.

### How to store your recovery phrase safely

<Steps>
  <Step title="Write it down immediately">
    When your phrase is generated, write all 24 words on paper — in the exact order shown — before closing the screen.
  </Step>

  <Step title="Record your Party Hint alongside the phrase">
    Note your Party Hint on the same paper as your recovery phrase. Both are required to restore access — keeping them together ensures you have everything you need in an emergency.
  </Step>

  <Step title="Store it offline">
    Keep the written phrase and Party Hint entirely offline. Do not photograph them, type them into any app, or store them in any digital format.
  </Step>

  <Step title="Secure the physical copy">
    Place your phrase and Party Hint in a fireproof safe, safety deposit box, or another secure location only you can access.
  </Step>

  <Step title="Consider a second copy in a separate location">
    A duplicate stored in a different secure location protects against fire, flood, or physical theft at a single site.
  </Step>
</Steps>

<Warning>
  Never share your recovery phrase with anyone — including Walley support. No legitimate service will ever ask for it. Treat any such request as a phishing attempt.
</Warning>

## Credential Loss Scenarios

<Accordion title="I lost my passkey device but still have my recovery phrase">
  You can restore access. Navigate to the Walley app on a new device, select **Import Recovery Phrase**, and enter your 24-word recovery phrase together with your **Party Hint** when prompted. Recovery sessions are temporary — your phrase is needed again for each session, unless your original passkey comes back via your platform's credential-manager sync.
</Accordion>

<Accordion title="I lost my recovery phrase but still have my passkey">
  You can continue to access your wallet normally using your passkey. However, you have lost your only recovery option — the phrase is shown exactly once at wallet creation and cannot be re-displayed. While you still have passkey access, create a fresh wallet, back up its phrase securely, and move your assets to it.
</Accordion>

<Accordion title="I lost both my passkey and my recovery phrase">
  Access to your wallet is permanently lost. Walley is non-custodial and holds no copies of your credentials. There is no recovery path, no support escalation, and no technical mechanism that can restore access. This outcome is irreversible.
</Accordion>

<Accordion title="I think someone else has my recovery phrase">
  Treat this as an active security emergency. If possible, immediately move your assets to a new wallet whose credentials only you control. Do not delay — anyone with your phrase has full access to your funds right now.
</Accordion>

## Summary

* **Passkey** = your everyday credential, device-bound and non-extractable.
* **Recovery phrase** = your backup, offline-only and never shared.
* **Both lost** = permanent, irrecoverable loss of wallet access.

Keep both credentials secure, independent, and never digital. You are your own security.