At a glance
Before you start
Backup
Backup is a one-time step, done by your onchain signer once the recovery passphrase exists. It takes a few minutes.1
Generate your onchain key and recovery passphrase in Coinbase Prime
In Coinbase Prime, an administrator designates the initial onchain signer, and the designation is approved by your team’s consensus policy. The onchain signer then scans the QR code with the Coinbase Prime Approvals App, signs in with their Prime credentials and mobile security key, and completes key generation.The app shows the recovery passphrase. It covers the whole team, and the onchain signer is the only team member who sees it — so this is the moment to back it up. See Coinbase’s Get started with the Prime Onchain Wallet.
2
Save the passphrase to a plain-text file
Type the passphrase, exactly as shown, into a plain-text (
.txt) file — one line, words separated by single spaces. Save it locally, on the machine where you’ll run the CLI.3
Start the CLI and choose your environment
Run
coincover. Check the environment shown at the top is the one you were onboarded to; if not, choose Switch environment / API key and enter the API key for that environment. Then choose Back up key material.4
Confirm the identity for this backup
Use your saved User ID and Customer name, or enter new ones. Use a customer name that matches your organisation in Control.
5
Choose HOT or COLD, then RSA only
Choose the CoinCover key pair that protects your backup:
Use the Control ID CoinCover issued for the key pair you choose. The choice is permanent for this backup.Then select RSA only as the protection mode. A recovery passphrase is well inside the RSA-only size limit (445 bytes), and RSA only means the released file is the passphrase itself — there’s no second backup passphrase to keep safe.
6
Name the backup and select the file
Enter a Backup name (for example
Coinbase Prime recovery passphrase) and a Backup ID (for example 01). In the file browser, go to the folder where you saved the passphrase and select the .txt file.7
Enter your Control ID and upload
Check the backup summary, then enter the Control ID CoinCover gave you. Review the final summary and confirm Proceed?. The CLI allocates a CoinCover HOT or COLD RSA-4096 key, encrypts the file on your machine, uploads the ciphertext, and verifies the checksum.On success you’ll see the
backup_id, key_id and the path to a receipt saved under ~/.coincover/receipts/. Keep the receipt.Upload can’t be undone once it completes. If you entered the wrong file or Control ID, contact CoinCover rather than uploading a second copy.
8
Confirm the backup in CoinCover Control
In Control, open your organisation, go to Backups, and open the new backup — it shows CoinCover as the partner and Hot or Cold as the recovery type, matching the key pair you chose. On the Assurance tab, choose Run check now. Both checks should pass:
- Key rebuilt — CoinCover rebuilds the key from its stored parts and confirms it matches.
- File unchanged — CoinCover decrypts the stored file and confirms it matches what you uploaded.
9
Assign an Access Control List
On the backup’s Overview tab, choose Assign ACL and attach the ACL whose members will approve a recovery. Until an ACL is assigned, nothing can be recovered. See Set up your Access Control List.
CoinCover only ever holds your passphrase encrypted, under a key generated in a hardware-isolated enclave. Neither CoinCover nor its staff can read it, and it is only released when your ACL approves.
Recovery
Use recovery when you need the passphrase back — most often because every onchain signer has lost access, or to verify or replace your backup in Coinbase Prime.1
Start the recovery in CoinCover Control
Open the backup in Control and choose Start recovery. Provide your OpenPGP public key (armored text, or a
.asc, .txt, .gpg or .pgp file). CoinCover uses it to encrypt the released passphrase so only you can open it.2
Your approvers sign off
Each ACL member is notified, re-verifies their identity, and approves or rejects. Approval progress shows on the recovery. Nothing is released until the ACL’s approval threshold is met. See Approve or reject a recovery request.
3
Download the recovery package
For a COLD backup, CoinCover’s team retrieves the key from offline storage first, within 24 hours of approval — Control tells you this is happening and notifies you when the download is ready. When the recovery shows Recovery ready, choose Recover packages to download a ZIP. An approved recovery can be downloaded at most 3 times, within 3 days.
4
Decrypt the passphrase
The ZIP contains your passphrase file as a PGP-encrypted message. Decrypt it with your GPG private key — for example
gpg --decrypt "Coinbase Recovery Phrase.txt", or your GPG tool’s decrypt option. The result is your original recovery passphrase.Because the backup uses RSA only, there’s no CLI recovery step — the file you decrypt is the passphrase.5
Use the passphrase in Coinbase Prime
In Coinbase Prime, go to Settings → Onchain → Key Management:
Coinbase advises against starting key recovery while any onchain signer still holds a key shard. See Coinbase’s Restoring access to an Onchain Wallet and Verify your recovery passphrase.
Recover key material through CoinCover Control
The step-by-step recovery walkthrough in Control — raising the request, gathering approvals, and collecting the released material.
What’s next
CLI integration guide
Install the CoinCover Key Vault CLI and run the full backup flow.
Set up your ACL
Decide who approves the recovery of your Coinbase Prime backup.
Create a GPG key
Generate the key pair you need to receive a recovery.
Partners overview
All CoinCover partner integrations.