Mobile App Setup
The Vault mobile app turns a smartphone into an MPC signer. Each enrolled device holds one MPC key share, stored encrypted at rest in the device’s secure storage. The share stays on the device — only partial signatures are ever transmitted; it is decrypted into the app’s memory to compute a partial signature and wiped afterwards.
Supported Devices
| Platform | Minimum | Secure Hardware |
|---|---|---|
| iOS | 15.5+ | Secure Enclave |
| Android | 10+ (API 29) | Hardware-backed Keystore (StrongBox when the device provides it) |
Requirements: push notifications enabled and internet connectivity. Biometric unlock is optional — a PIN is always available and is what gates signing.
Key shares are stored as encrypted data in the app’s sandbox; the key that encrypts them is held in the device’s OS secure storage (iOS Keychain / Android Keystore, hardware-backed — StrongBox — where the device provides it). The share itself is not a non-exportable hardware key: it is decrypted into app memory for the MPC computation.
Installation
Install The Vault from the App Store (iOS) or Google Play (Android). On first launch, the app requests push notification permission.
Device Enrollment
Enrollment binds your device to The Vault as a recognized signer.
Generate Device Keypair
The app generates a device identity key pair (used to sign the enrollment request and later API calls — separate from the MPC key share). The private key is stored encrypted at rest on the device and is never transmitted off-device.
Submit Enrollment Request
The app generates a Certificate Signing Request (CSR) with the device public key and a device identifier (a fingerprint derived from device and app metadata). Your device appears in Settings → Devices as Pending Approval.
Admin Approval
An Admin reviews the device:
- Navigate to Settings → Devices in the dashboard.
- Click the pending device and verify the device name and user assignment.
- Fingerprint verification — confirm the certificate fingerprint in the dashboard matches what the mobile app displays (in App Settings → Device Certificate). Verify out-of-band.
- Click Approve and complete the step-up confirmation (approving a device is a protected action).
The Vault’s internal CA issues an X.509 device certificate. Status changes to Active.
Never skip fingerprint verification. Always confirm through a separate communication channel (in person, video call, or secure messaging).
Signing Requests
Once your device is enrolled, you receive a push notification whenever a transaction needs your approval. Open the app, review the details, and tap Approve and Sign (PIN) — your device then contributes its part of the signature. For how signing works end to end, see MPC Signing.
Push notifications are required for signing — without them you won’t be alerted and sessions may time out. (Key generation is different: it needs no push; the device joins automatically while the app is open.)
Troubleshooting
Push Notifications Not Arriving
| Check | Resolution |
|---|---|
| Notifications disabled in OS | Enable in device Settings → The Vault → Notifications |
| Do Not Disturb / Focus mode | Disable or add The Vault to allowlist |
| Battery optimization (Android) | Disable for The Vault: Settings → Apps → Battery → Unrestricted |
| Push token expired | Force-close app, reopen, re-authenticate |
| Firewall blocking APNs/FCM | Allowlist Apple Push and Firebase endpoints |
Signing Request Times Out
| Check | Resolution |
|---|---|
| Didn’t respond within 5 minutes | Transaction returns to pending; a new session will be initiated |
| App was in background | Enable Background App Refresh (iOS) or disable battery optimization (Android) |
Device Lifecycle
Managing a device after enrollment — blocking a lost or stolen device, replacing a phone, and renewing an expiring certificate — is covered in Device Management and Key Recovery.
A device’s key share cannot simply be copied to a new phone — replacing a device requires a key-share recovery ceremony.