NEAR AccountsDocs
Open NEAR AccountsOpen app
Recovery

Recovery Backend Pipeline

The recovery service handles setup, identity checks, approval requests on NEAR, key signing, email, and retries. It uses multi-party computation (MPC), which splits control of a signing key among several parties. The House of Stake service is one part of recovery that you must trust. Recovery also needs your chosen methods, a signed confirmation, a 72-hour wait, and approval from independent watchers.

Enrollment

Recovery must be prepared before an account is locked out.

  1. The owner verifies a recovery email and selects a personal anti-phishing word that will appear in every official recovery email.
  2. The owner adds at least two different recovery method types: passkeys, a password, recovery codes, security questions, or a PIN.
  3. Multiple passkeys count as one method. The service creates ten single-use recovery codes, accepts one to five security questions, and accepts a 4–8 digit PIN.
  4. For a regular NEAR account, use your wallet to add a recovery key with full access. It can manage the account. Several parties share control of its signing key through MPC.
  5. Turn on recovery. The service saves its rules on NEAR: who confirms a request, the 72-hour wait, and how many watchers must approve it.

Enrollment remains incomplete until every prerequisite has been written and verified. Recovery belongs to the ownership account and automatically covers every rented account it controls. Once enrollment is complete, the MPC recovery key and installed policy remain after successful recoveries. They are removed only when the owner removes recovery.

Recovery for a regular NEAR account. During recovery, your wallet app creates or selects a new key. House of Stake receives its public part, which can be shared, but not the private part that lets you control the account. After the checks pass, MPC signs an AddKey transaction to add your new key. In NEAR, AddKey means “add a key.” A full-access key can manage the account. For a rented name, a separate recovery path can move it to a new owner account. It does not add a key to the rented account.

Request Pipeline

1
Prepare the casevalidate before sending or submitting
Bind the replacementThe case identifies the public key for the new recovery phrase.
Save before sendingThe backend validates policy, email, and enrolled methods, then records the case.
2
Verify the owneremail plus one recovery method
Email codeThe message carries the anti-phishing word and a short-lived six-digit code.
Selected methodPasskey, password, unused code, security questions, or PIN must succeed.
Record the proofA redeemed recovery code is consumed; the verified method is bound to the case.
3
Confirm and requestcheck the account and destination
Signed confirmationLinks the account, destination, request number, and expiry to the verified flow.
Start recoveryThe contract checks the proof, records the request, and starts the 72-hour wait.
4
Wait and approve72 hours plus independent watchers
72-hour waitThe owner is notified and can cancel before recovery finishes.
Watcher approvalIndependent watchers approve the account, destination, and request.
Activity checkActivity on the account or changed recovery settings stops the request.
5
Finalize the pathordinary accounts and rented names differ
Ordinary accountMPC signs only the permitted AddKey transaction for the replacement public key.
Direct name pathContract support uses owner-bound watcher signatures and the registry recoverName call.
6
Confirm and deliververify NEAR, then issue one-time access
Broadcast and confirmThe new access is confirmed; recovery enrollment remains active.
Recovery-phrase linkOne-time retrieval expires after seven days or its first use.
The House of Stake (HoS) serviceData / recordContractWallet / keyRecoveryInfrastructure
1
Prepare the casevalidate before sending or submitting
Bind the replacementThe case identifies the public key for the new recovery phrase.
Save before sendingThe backend validates policy, email, and enrolled methods, then records the case.
2
Verify the owneremail plus one recovery method
Email codeThe message carries the anti-phishing word and a short-lived six-digit code.
Selected methodPasskey, password, unused code, security questions, or PIN must succeed.
Record the proofA redeemed recovery code is consumed; the verified method is bound to the case.
3
Confirm and requestcheck the account and destination
Signed confirmationLinks the account, destination, request number, and expiry to the verified flow.
Start recoveryThe contract checks the proof, records the request, and starts the 72-hour wait.
4
Wait and approve72 hours plus independent watchers
72-hour waitThe owner is notified and can cancel before recovery finishes.
Watcher approvalIndependent watchers approve the account, destination, and request.
Activity checkActivity on the account or changed recovery settings stops the request.
5
Finalize the pathordinary accounts and rented names differ
Ordinary accountMPC signs only the permitted AddKey transaction for the replacement public key.
Direct name pathContract support uses owner-bound watcher signatures and the registry recoverName call.
6
Confirm and deliververify NEAR, then issue one-time access
Broadcast and confirmThe new access is confirmed; recovery enrollment remains active.
Recovery-phrase linkOne-time retrieval expires after seven days or its first use.
The House of Stake (HoS) serviceData / recordContractWallet / keyRecoveryInfrastructure
  1. Create and record the case. The backend validates the account, installed policy, saved email, and enrolled methods, then records the case before sending email or touching NEAR.
  2. Verify the email. A short-lived six-digit code confirms access to the saved recovery address. The message includes the user's anti-phishing word.
  3. Verify one recovery method. The owner completes a registered passkey, recovery password, unused recovery code, security-question check, or 4–8 digit PIN. A recovery code cannot be used again after successful verification.
  4. Sign the confirmation. After the email and selected method pass, the service signs an attestation (a message confirming that the checks passed). It includes the account, destination, request number, and expiry time.
  5. Start recovery on NEAR. The service calls request_recovery. The NEAR contract (the program that applies recovery rules) records a new request number and starts the 72-hour wait.
  6. Wait and collect approvals. After 72 hours, the service asks the independent watchers to approve the request for that account and destination. The contract checks that enough watchers approve it.
  7. Complete recovery. For a regular account, MPC signs an AddKey transaction to add the new key. For a rented name, the independent watchers approve the transfer and the registry applies it.
  8. Broadcast and confirm. The backend rebuilds and verifies the expected transaction hash, broadcasts it, and confirms the resulting on-chain state.
  9. Issue the completion link. After successful recovery, the service sends a one-time recovery-phrase link that expires after seven days or immediately after use.

Case States

StateMeaning
AwaitingVerificationThe email code has not passed yet.
AwaitingClaimEmail is verified; one recovery method is still required.
VerifiedBoth required user checks passed and the case is ready for attestation.
RequestedThe request is on NEAR and waiting through the 72-hour wait and watcher approval.
ApprovedThe contract checks passed and finalization may begin.
FinalizingThe backend is collecting or verifying the final signature.
BroadcastThe final transaction was sent and is awaiting confirmation.
ClaimedRecovered access or ownership is confirmed on-chain.
Aborted / FailedThe case stopped, with the reason retained for audit and support.

Ordinary Account Finalization

The ordinary-account path produces an AddKey transaction for the replacement public key. The MPC network signs with a derivation path unique to the account. Before broadcast, the backend reconstructs the unsigned transaction and verifies that the signed hash matches it.

After the transaction is confirmed, the service sends the user a one-time link to the new recovery phrase. The link works on any device. It expires seven days after issuance or immediately after the user views the phrase.

A successful case does not uninstall recovery. It closes that recovery round while leaving the MPC recovery key, installed policy, email, and enrolled methods available for later recoveries. Only an explicit removal by the owner disables that enrollment.

If signing or delivery is uncertain, the service checks NEAR before retrying. It never assumes that a timed-out request failed.

Rented-Name Finalization

In the current public process, you recover your ownership account. This restores control of every rented account it still owns.

The contracts also support a separate way to recover a rented name. It moves the name to a new owner account; it does not add a key to the rented account. Watchers approve a request that lists the name, new owner, current owner, deadline, and request number. The name registry contract (the NEAR program that records account ownership) uses recoverName only if those details still match. This path is not part of the public walkthrough.

Lost-Email Verification

Changing an inaccessible recovery email requires two different recovery method types instead of the single method used after ordinary email verification. After those checks pass, the new email is verified with a six-digit code and enters a separate 72-hour wait. The old address is notified and can stop the change.

Recovery Removal

The owner starts removal from Settings → Manage Accounts → Manage Your Recovery. The service requires the saved-email code and one enrolled recovery method. After both checks pass, it deletes the enrolled methods and removes the MPC recovery key and installed policy.

Removal disables future recovery. It does not happen after a successful recovery unless the owner requests it.

Cancellation and Ownership Changes

The owner can cancel a case until finalization or broadcast begins. Activity from the existing account cancels a pending case automatically. The service also stops a case when the installed policy, destination, owner, or watcher configuration no longer matches.

On a marketplace sale or transfer, all recovery information connected to the transferred account is cleared. Open cases for the previous owner are stopped, the account's direct recovery policy is removed, and no recovery email or method information carries over to the new owner. The latest recovery round remains available only for replay protection. Recovery enrollment on the previous owner's ownership account remains active.

For the owner-facing steps, see the Recovery Walkthrough. For defaults and implementation ownership, see the Recovery Technical Reference.

Walkthrough

Previous Page

Technical Reference

Next Page

On this page

EnrollmentRequest PipelineCase StatesOrdinary Account FinalizationRented-Name FinalizationLost-Email VerificationRecovery RemovalCancellation and Ownership Changes