Account recovery

Someone who lost their master password or Secret Key can ask for their account back. After an admin approves the request, they get a reset link that opens {web app}/?view=recover#token=ov_rc_…. The reset gives them a new password, Secret Key and keys, and an account that starts without personal vaults. For 30 days the old vaults can be restored with the old password and the old Emergency Kit. See SPEC §18 for the full flow.

Resetting

const info = await account.recoverInfo(token);   // works signed out
// { email, notBefore, expiresAt, archiveDays, archives: { personalVaults, sharedGrants, soleAdminOrgs } }

const { secretKey } = await account.recover({ token, password });   // signed in and unlocked afterwards
showEmergencyKit(secretKey);

Show info before resetting, so the user knows what gets archived: personal vaults, vaults shared with them, and organisations where they are the only admin.

Restoring the old vaults

Later, with the account unlocked, and within the 30 days:

const status = await account.recoveryStatus();   // { archived, email?, expiresAt?, vaults?, locked? }
if (status.archived && !status.locked) {
  const { restored } = await account.restoreFromArchive({ oldPassword, oldSecretKey });   // vault list reloaded
}

The old keys are opened on the device, each archived vault key is sealed to the new keys, and the old keys are wiped again. The server never sees the old password or Secret Key.

Errors

The SDK docs cover OpenVireo SDK, develop (86e6cd2), last updated 26 October 2026. Found a mistake? Edit this page on GitHub.