Go to developer

Recovery

Help enrolled users regain KEYRA verification access when their factor is unavailable.

On this page

When to use recovery

Use recovery when a user still exists in your system but cannot complete challenge approval (lost phone, factor unavailable, etc.). Recovery is a privileged backend operation — treat it like password reset.

Recovery URL session

SERVERTypeScript
const session = await keyra.recoverIdentity(externalUserId);
// session.recoveryUrl — show once to the authenticated user (or send via your secure channel)
// session.expiresIn — seconds (900 / 15 minutes at creation)
// session.recoverySessionId — rcs_…
responseResponse
JSON
{
  "recoverySessionId": "rcs_…",
  "recoveryUrl": "https://get-started.keyra.ie/recover/…",
  "expiresIn": 900
}

What happens here? The SDK resolves identityId via status, then calls POST /v1/identities/{identityId}/recovery/initiate. The user opens the signed recovery URL to complete KEYRA's recovery UX.

Recovery codes

SERVERTypeScript
const { identityId, codes } = await keyra.generateRecoveryCodes(externalUserId);
// Show codes once to the user. Store only if you have a secure vault strategy.
// Calling again invalidates previous unused codes and issues 10 new ones.
responseResponse
JSON
{
  "identityId": "kid_…",
  "codes": ["a1b2c3d4e5", "…"]
}
  • Backend generates 10 codes per request.
  • Previous unused codes are invalidated when you regenerate.
  • Display codes once in a trusted UI; do not email them in plaintext if you can avoid it.

Security implications