Recovery Flow
The recovery website guides locked-out owners through verification without requiring them to sign in.
Recovery opens from the landing page. The owner is locked out, so the flow cannot depend on signing in.
An account without recovery enabled is refused before anything else happens. A destination that does not match the address on file is refused too, so knowing an account name is not enough to trigger a verification email.
A code goes to the address on file and the owner enters it. The account balance is never read, no case is treated differently, and no person decides the outcome. Every recovery follows the same path.
A case names either a new owner key or a new owner account, never both. If a key is needed, the browser creates it locally and sends only the public key; the private key stays on the owner’s device.
After verification, the request is sent to NEAR and the timelock begins. The owner is notified and can stop the recovery before the transaction is sent. Support cannot stop it for them.
An ordinary NEAR account gets a FullAccess key the owner controls and can use in any wallet. Recovering the account that owns leased names restores every name it holds.
The owner enters the account name and the recovery address on file. A different address is refused, so knowing an account name is not enough to trigger a verification email. An account without recovery enabled is refused before anything else happens.
We send a verification code to that address for the owner to enter. A name can also have a PIN and security questions; they are stored so they cannot be read back and are checked alongside the code. Repeated failures are limited. Once verification succeeds, the server creates the proof that allows the recovery request to continue.
If recovery creates a new key, the browser creates it locally and sends only the public key. The private key and its recovery phrase stay on the owner's device.
A recovery request names either a new owner key or a new owner account, never both. The server rejects a request that supplies both, or that names the account being recovered as its own new owner.