Recovery & strict policy

Give people a defined way to replace a lost passkey, and explain what changes when an account chooses strict policy.

Configure a verified recovery address

Install the passkey feature first. Email recovery is available only when your app supplies the account’s verified current email address. AddAuth does not verify ownership of an address for you.

AddAuth.configure do |config|
  config.trusted_recovery_address = ->(user) {
    user.email_address if user.confirmed?
  }
  config.support_url = "/support"
end

confirmed? is an example of a method owned by your app. Replace it with your actual address-verification rule. The returned address must equal the account’s current email_address; return nil when recovery is unavailable. The default callback returns nil.

Create a real local support page at the configured path, explaining your recovery process and how to get help. The URL supplies navigation; it does not create a support process or authorize a policy change. Restart the app and run bin/rails add_auth:doctor.

Replace a lost passkey

1. Open /recover and request recovery for the account.
2. Open the delivered link and explicitly confirm it within 20 minutes.
3. Complete the replacement passkey prompt before the replacement grant expires: ten minutes by default.
4. After successful replacement, check the passkey list and deliberately remove credentials that should no longer be trusted.

Successful replacement revokes other sessions and outstanding proofs, rotates the current session bearer, and records a security email. Existing credentials remain listed. Opening a recovery link or cancelling replacement does not complete recovery.

flowchart TD
    accTitle: Choose the account's recovery path
    accDescr: Strict accounts use a remaining passkey or host support. Other accounts can use email replacement only when the host supplies a verified current recovery address.
    A[Lost a passkey] --> B{Strict account?}
    B -->|Yes| C[Use remaining passkey or host support]
    B -->|No| D{Verified recovery address available?}
    D -->|Yes| E[Request and confirm recovery email]
    E --> F[Register replacement passkey]
    F --> G[Revoke other sessions and send notice]
    D -->|No| H[Use another allowed method or host support]

Understand strict policy before enabling it

Strict policy disables password sign-in, ordinary email sign-in and email recovery for that account. It requires fresh passkey verification and explicit acknowledgement in the passkey management page. Keep another usable passkey and explain the support process before enabling it.

Activating or relaxing strict policy revokes other sessions and pending proofs. Password resets and feature toggles cannot restore password or email access to a strict account. AddAuth provides no recovery codes. A strict account that loses every usable passkey needs the host’s established support process.

Check both recovery paths

Next, confirm that security emails reach a real mailbox and review your deployment and rollback procedures.