At a glance
Backup
Backup comprises a one-time setup for each Dynamic environment, followed by a per-user flow that runs when each user backs up their wallet.One-time setup: connect Dynamic to CoinCover
1
CoinCover provides a webhook URL
During onboarding, CoinCover issues a webhook URL for the customer’s Dynamic environment.
2
The customer registers the webhook in Dynamic
In the Dynamic dashboard, under Developers → Webhooks, the customer adds a webhook with the CoinCover URL and subscribes it to the
wallet.offlineRecovery.created event.3
The customer shares the webhook details with CoinCover
The customer provides the webhook ID, its signing secret and the Dynamic environment ID. CoinCover uses these to verify the
x-dynamic-signature-256 signature on each delivery, and accepts shares only from that environment.Backing up a user’s wallet
1
The user completes identity verification
The customer’s backend calls
POST /v1/verification/start with an identifier for the user, and the app launches the Identity SDK with the returned verification_id. The user completes the verification — for example, an identity document and a selfie — within the customer’s app, and the flow can be white-labelled. The backup proceeds once the status is APPROVED.2
CoinCover issues a key for the user
The customer’s backend calls
POST /v1/key/generate with the user’s identifier and the approved verification_id. CoinCover generates an RSA key pair within its secure enclave and returns the public key as hex-encoded SPKI, together with a signature.3
The app creates the offline recovery shares
The app calls the Dynamic SDK’s
createWaasOfflineRecoveryShares, passing the CoinCover public key, base64-encoded, as recoveryEncryptionPublicKey. The SDK stores the client share in the user’s Google Drive or iCloud.4
Dynamic delivers the server share to CoinCover
Dynamic encrypts the server share to the CoinCover public key and sends it to CoinCover in the
wallet.offlineRecovery.created webhook. CoinCover identifies the user from the key the share is encrypted to. CoinCover confirms within the enclave that the share can be decrypted, then stores it, encrypted, against that user.Verify the
signature returned with the public key against CoinCover’s published JWKS before passing the key to Dynamic. See Validating key signatures.The customer’s backend makes only the verification and key requests, and never receives either share. The client share passes from the Dynamic SDK to the user’s Google Drive or iCloud, and the server share passes from Dynamic to CoinCover in encrypted form.
Retail integration guide
Full request and response details for the verification and key endpoints are documented in the Retail integration guide.
Recovery
Recovery applies when the user has lost access to their wallet, or when Dynamic is unavailable. It takes place between the user’s device, the customer’s backend and CoinCover, and does not require Dynamic.1
The user completes identity verification again
The customer’s backend starts a new verification with the same user identifier, and the user completes it within the app. CoinCover compares it with the verification captured at backup to confirm it is the same person. Recovery proceeds only once the status is
APPROVED, and each approved verification authorises a single recovery.2
The app generates a one-time key on the device
The app generates a new key pair on the user’s device for this recovery only. The private key remains on the device under the platform’s secure key handling and is never stored or transmitted; only the public key is shared.
3
CoinCover returns the server share to the device
The customer’s backend calls
POST /v1/backup/recover with the approved verification_id and the one-time public key as rsa_public_key. CoinCover decrypts the server share within its secure enclave and re-encrypts it to the one-time key, so that only the user’s device can decrypt it. The customer’s backend relays the response but cannot read it.4
The app reconstructs the private key
The app decrypts the server share with the one-time private key, retrieves the client share from the user’s Google Drive or iCloud, and combines the two on the device using Dynamic’s offline recovery (
offlineExportKey). Dynamic’s offline recovery tool provides a reference implementation. The one-time key is then discarded.Outside CoinCover’s secure enclave, the user’s device is the only place the server share can be read. The one-time key exists only for the duration of the recovery, so there is no long-lived key to intercept or compromise.
End result
The user regains the wallet’s private key on their own device after verifying their identity, without the customer or Dynamic handling any key material.
What’s next
Retail integration guide
The identity verification and key API in full.
UI components
Embedding the Identity SDK in your app.
Fireblocks
The workspace and device-share MPC integration.
Partners overview
All CoinCover partner integrations.