Account Recovery
How a user regains access when their registered device is lost, replaced, or unavailable
Hawcx is device-bound: the credential is a non-exportable key held on the user's device, so there is no password to reset and no synced credential to fall back to. This page explains what happens when a user loses that device, gets a new one, or needs to sign in on a device they don't want to keep.
The Model
Each device is enrolled independently. Losing one device does not compromise or cascade to any other, and there is no long-lived recovery key to phish or lose. Recovery is therefore not a "reset"; it is re-establishing trust on a new device after the user proves control of a non-device factor.
Recovery never bypasses the proof
Recovery always runs through the same authentication flow as a normal login. The user must pass a primary factor, and enrolling the new device still performs the device-bound cryptographic proof. There is no shortcut that skips it.
Lost or Replaced Device
When a user no longer has their enrolled device:
- They start authentication on the new device and select a non-device primary factor: email OTP, SMS OTP, or magic link (or TOTP if enrolled).
- After that factor is verified, the enrollment phase provisions a new device-bound key on the new device.
- The user is now enrolled on the new device and authenticates with the device-bound proof going forward.
The old device's key never moves; it is non-exportable and stays isolated. It can be revoked in the Admin Console (device revocation is an administrative action, not part of the recovery flow) so it can no longer be used.
Shared or Public Devices
For a device the user does not want to trust permanently (a shared kiosk, a public machine, a borrowed phone), you can allow authentication without enrolling a new device. In that mode the user passes a non-device factor to sign in for that session only, and no device-bound key is provisioned on the shared machine.
Whether a successful login enrolls the device or not is controlled per flow in Flow Configuration via the device-trust setting (offer enrollment vs. require it vs. skip it).
Which Factors Are Available
Recovery relies on the same primary factors you already configure for your project:
| Factor | Recovery use |
|---|---|
| Email OTP | Verify control of the account's verified email, then enroll the new device |
| SMS OTP | Verify control of the account's verified phone, then enroll the new device |
| Magic link | Verify via a one-time link, then enroll the new device |
| TOTP | Available when the user previously enrolled an authenticator |
Configure which of these are offered in Flow Configuration.
Next Steps
- Flow Configuration: choose primary factors and device-trust behavior
- Device-Bound Authentication: why the credential can't be moved between devices
- Identity Model: the user's stable identity is unchanged across device re-enrollment