SocketFi Account Recovery for Lost Passkeys and Devices

​

What recovery is and is not

​

When users need recovery

• Lost, stolen, or destroyed phone
• Passkey deleted during a factory reset or OS reinstall
• Failed device migration (old device disposed before credential was transferred)
• Authenticator app uninstalled or reset

​

The recovery flow

​

Recovery security requirements

• Identity verification is mandatory — there is no path through recovery that bypasses it
• Recovery tokens are server-side only — never expose the raw token in a URL or client-side log
• Rate limiting is in place — limit recovery attempts per wallet per time window to deter brute-force attacks
• All recovery events are logged — timestamp, wallet, outcome, IP, and verification method
• Users are notified — send a push notification or email when a recovery is initiated, approved, and completed

​

UX recommendations

​

Monitoring recovery events

type RecoveryEvent = {
  timestamp: number;
  walletAddress: string;
  stage: "initiated" | "identity-verified" | "authorized" | "completed" | "failed";
  outcome: "success" | "failure";
  reason?: string;
  ipAddress?: string;
};

export async function logRecoveryEvent(event: RecoveryEvent) {
  // Write to your audit log / SIEM
  await auditLog.write(event);

  // Alert on unexpected patterns
  if (event.outcome === "failure") {
    await alerting.increment(`recovery.failures.${event.walletAddress}`);
  }
}