> ## Documentation Index > Fetch the complete documentation index at: https://docs.dynamic.xyz/docs/llms.txt > Use this file to discover all available pages before exploring further. # Wallet backup > How cloud backup upgrades embedded wallet recovery to a 2-of-3 threshold scheme using Google Drive. Users can back up their [User Share](/docs/embedded-wallets/mpc/glossary#user-share) to a cloud provider as an additional recovery option, alongside the local copy stored on their device and the [Dynamic Server Share](/docs/embedded-wallets/mpc/glossary#dynamic-server-share). Dynamic supports **Google Drive** as the cloud backup provider. ## How cloud backup works Enabling cloud backup upgrades the wallet from the default 2-of-2 threshold scheme to 2-of-3 through [Key Resharing](/docs/embedded-wallets/mpc/glossary#key-resharing--refreshing): * The client keeps its local User Share. * A new share is created and uploaded to the chosen cloud provider. * Dynamic continues to hold the Server Share. This creates three recovery paths: local share + Server Share, cloud share + Server Share, or local share + cloud share. The third path is [Independent Recovery](/docs/embedded-wallets/mpc/glossary#independent-recovery): a user with both their local share and their cloud-backed share can reconstruct their wallet without Dynamic's involvement at all. For meaningful protection, set a [password for the key share](/docs/embedded-wallets/mpc/configuration-guide#password) during wallet creation or update. This is the security boundary that prevents anyone, including Dynamic and the developer, from decrypting the backup. Without a password, the share is still stored encrypted, but the encryption cannot be scoped to a user secret. Even though a developer can obtain OAuth access tokens for users who authenticate with Google, this does not grant access to the wallet: the key share cannot be reconstructed by the developer or backend, and it remains inaccessible without the user's participation. ## Enable Google Drive backup Google Drive authentication uses OAuth. The user grants two Drive scopes on the consent screen and must link a Google account before backing up. Enabling Google Drive takes two steps: turn it on for your environment in the [Dynamic Developer Console](https://console.dynamic.xyz/dashboard), under **Wallets > Embedded Wallets > Backup & Recovery**, then complete the setup in the implementation guide below. You must also enable the Google Drive API in your Google Cloud project. When a user successfully backs up their key share, Dynamic fires the `wallet.keyShares.backedUpToExternal` [webhook event](/docs/platform/dashboard/webhooks/events). ## Implement Configuration steps, OAuth scopes, and the pre-flight readiness check.