Device linking and recovery

A device-bound passkey cannot be copied, which is what makes it a safe root. It also means that one passkey cannot survive the loss of its device. On Tenzro Network 1 an account survives device loss by having more than one independent root: another device, or a set of guardians. It never does so by making any single root weaker.

Always have a second root

An account with one passkey is one lost phone away from being unrecoverable. The console and tenzro-sdk treat a second root as part of setup, not an optional extra:

• a passkey on a second device (a phone and a laptop, or a hardware security key), or
• a set of guardians who can approve recovery.

Until an account has a second root it can receive funds but cannot send them. A synced passkey never counts as the only root, even if it appears on several devices. See Console and passkey wallet.

Link another device

Linking a device adds a credential that can sign for the account, so it is a custody change. It needs approval from a device that is already on the account.

In the console, open Wallet, choose to add a device, and follow the prompts:

1. On the new device, create a passkey for the account.
2. On an existing device, approve the link. If the existing passkey is on your phone, the browser shows a QR code; scan it and approve with your fingerprint, face or PIN.
3. The node checks the approval against a single-use challenge bound to the account and the new key, then adds the device. The account address does not change.

Each linked device carries its own P-256 passkey and its own ML-DSA-65 key derived from that passkey, so every device produces full hybrid signatures. The published account record is updated, and each new version must be signed by a device that was already in the previous version.

From the command line:

# Add a device through the browser ceremony (shows a QR for a phone)
tenzro passkey add --account-address 0xYourAccount --label "Work laptop"

# See which devices can sign
tenzro passkey list --account-address 0xYourAccount

# Remove a lost or retired device
tenzro passkey remove --account-address 0xYourAccount --credential-id-hex 0x...

Removing a device ends its access and every session it authorised, in one action. The console will not let you remove an account's last root.

Require two devices

By default any one enrolled device can approve an operation. For higher-value accounts you can require two distinct devices to sign every operation:

tenzro passkey set-policy --account-address 0xYourAccount --second-factor two_credentials
tenzro passkey get-policy --account-address 0xYourAccount

You can also add a hardware signer that is required on every operation, or only above a value threshold. See Smart-account policies.

Guardians

Guardians are other Tenzro identities, such as family members, colleagues or an institution you trust, that can together approve moving your account to a new device. You choose the guardians and the threshold (how many must approve). Each guardian signs with its own hybrid key.

tenzro passkey add-guardian \
  --account-address 0xYourAccount \
  --guardian-ed25519-hex <guardian-classical-key> \
  --guardian-ml-dsa-hex <guardian-ml-dsa-65-key> \
  --label "Sam" \
  --threshold 2

Adding a guardian is a custody change and needs approval from a device on the account.

Recovery

If you lose every device, or want to replace the one you have, you recover the account onto a new passkey. Recovery always runs behind a timelock with a veto:

1. Initiate. On the new device, create a passkey and open a recovery for the account.
2. Alert. The account's owner is notified straight away that a new device is being added.
3. Timelock. A delay starts. It is visible and counts down.
4. Veto. Any existing device on the account can cancel the recovery instantly, with no delay.
5. Finalise. When the guardians reach their threshold and the timelock has passed without a veto, the new passkey is installed. The account address, balance and history are unchanged.

# On the new device: open the recovery with the new passkey's keys
tenzro passkey initiate-recovery \
  --account-address 0xYourAccount \
  --new-passkey-pubkey-hex 0x... \
  --new-credential-id-hex 0x... \
  --new-ml-dsa-pubkey-hex 0x...

# Each guardian submits a signature over the recovery
tenzro passkey submit-recovery-signature \
  --recovery-id <id> --guardian-index 0 --composite-signature-hex 0x...

# Watch progress, then finalise
tenzro passkey list-pending-recoveries --account-address 0xYourAccount
tenzro passkey finalize-recovery --recovery-id <id>

An attacker who starts a recovery gains nothing while you still hold any device: you see the alert and cancel it.

Email is an alarm, not a key

If you give the console an email address, it is used for account lookup and as the alarm channel for recovery. It is never a root:

• email cannot create, replace or recover a signer;
• email cannot raise a spending limit;
• a recovery alert by email only warns you; you cancel the recovery with a device you hold.

This keeps the account exactly as strong as your hardware, rather than as strong as your mailbox.

Machines

Machine identities are rooted in the machine's own TPM 2.0 or Secure Enclave. The key is derived from the hardware on demand, so reinstalling the software or wiping the data directory does not change the machine's DID. A replacement machine is a new machine with a new DID; its controller links it and moves any delegations across. See Hardware-rooted keys.

Methods