Wallet backup

How cloud backup upgrades embedded wallet recovery to a 2-of-3 threshold scheme using Google Drive.

Users can back up their User Share to a cloud provider as an additional recovery option, alongside the local copy stored on their device and the Dynamic Server Share. Dynamic supports Google Drive as the cloud backup provider.

How cloud backup works

Enabling cloud backup upgrades the wallet from the default 2-of-2 threshold scheme to 2-of-3 through Key Resharing:

• The client keeps its local User Share.
• A new share is created and uploaded to the chosen cloud provider.
• Dynamic continues to hold the Server Share.

This creates three recovery paths: local share + Server Share, cloud share + Server Share, or local share + cloud share. The third path is Independent Recovery: a user with both their local share and their cloud-backed share can reconstruct their wallet without Dynamic’s involvement at all.

If delegated access is enabled before or after cloud backup, the delegated share is sent to your webhook instead of a new share going to the cloud provider, and the cloud backup becomes a redundant copy of the client’s existing share rather than a distinct one.

For meaningful protection, set a password for the key share during wallet creation or update. This is the security boundary that prevents anyone, including Dynamic and the developer, from decrypting the backup. Without a password, the share is still stored encrypted, but the encryption cannot be scoped to a user secret.

Even though a developer can obtain OAuth access tokens for users who authenticate with Google, this does not grant access to the wallet: the key share cannot be reconstructed by the developer or backend, and it remains inaccessible without the user’s participation.

Enable Google Drive backup

Google Drive authentication uses OAuth. The user grants two Drive scopes on the consent screen and must link a Google account before backing up.

Enabling Google Drive takes two steps: turn it on for your environment in the Dynamic Developer Console, under Wallets > Embedded Wallets > Backup & Recovery, then complete the setup in the implementation guide below. You must also enable the Google Drive API in your Google Cloud project.

When a user successfully backs up their key share, Dynamic fires the wallet.keyShares.backedUpToExternal webhook event.

Implement

Google Drive backup

Configuration steps, OAuth scopes, and the pre-flight readiness check.