Skip to main content
Key export lets you obtain a backup of your organization’s root keys, giving you complete control over your funds outside of MPCVault. Once exported, you can derive private keys for all wallets—including those created after the export.
Available for business and enterprise customers on annual plans. Contact your account manager to begin.

​
When to Export

Set up key export when you create your organization. Exporting later is possible but incurs an additional charge.
Key export is initiated manually by your account manager—it’s not a self-service feature. If you anticipate needing key export, discuss it with your account manager before your organization goes live.

​
How It Works

MPCVault uses key derivation to generate wallet addresses from root keys. Once root keys are exported, you can calculate private keys for all addresses—including wallets created after the export.

​
Encryption-Based Security

MPCVault uses 3-of-3 MPC, meaning your root key is split into three shares. Rather than providing raw key shares directly, we ask you to generate three Ed25519 encryption keys locally. Each root share is then encrypted using one of your public keys, along with other necessary information like the chaincode. This design ensures:
  • No one in the backup process (including MPCVault) can access your actual key values
  • Intercepted backups are useless without your corresponding private keys
  • Full cryptographic control remains with whoever holds the encryption keys
Key Backup Process

​
Root Key Types

To derive all wallet addresses, you need both root key types exported:
Key TypeUsed For
ECC_ED25519Ed25519-based chains (Solana, TON, Aptos, Sui)
ECC_SECP256K1Bitcoin, Ethereum, and all EVM chains
Key Derivation

​
Export Steps

​
1. Generate three encryption keys

Run these commands in your terminal to create three Ed25519 key pairs: 
ssh-keygen -t ed25519 -C "backup-key-1"
ssh-keygen -t ed25519 -C "backup-key-2"
ssh-keygen -t ed25519 -C "backup-key-3"
For each key:
  1. Choose a save location
  2. Set a strong password (recommended)
  3. Store the private key file securely
Multi-party key generation: For enhanced security, have three different trusted individuals each generate one key. This ensures no single person holds all encryption keys.

​
2. Send public keys to your account manager

Your public keys look like this: 
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK0wmN/Cr3JXqmLW7u+g9pTh+wyqDHpSQEIQczXkVx9q backup-key-1
Send all three public keys to your account manager, who will create the backup request.

​
3. Approve the backup request

An Org root key backup signing request will appear in your signing request list. All active organization members must approve and sign.

​
4. Download the backup package

Once approved, download the encrypted backup from the signing request details page in the web console.
Download within 15 days—the backup expires after that.

​
5. Store securely

Store the backup package and encryption keys in separate, secure locations:
ItemStorage Recommendations
Backup packageStore multiple copies in different secure locations (safe deposit box, encrypted cloud storage, etc.)
Encryption private keysEach key in a separate secure location, ideally held by different trusted parties
Key passwordsStore separately from the private keys they protect

​
Recovery Requirements

To recover your wallets later, you’ll need:
ItemDescription
Backup packageThe encrypted JSON file
Private keysYour three Ed25519 private keys
PasswordsPasswords for the private keys (if set)
Recovery toolProvided by your account manager
Your personal key certificate is not needed for recovery. The backup package and encryption keys are completely independent from your MPCVault app credentials.

​
Security Best Practices

Do not split the backup file among multiple people. The encrypted file alone cannot recover your keys—it’s useless without the corresponding private keys. Instead:
  • Store redundant copies of the backup package in secure locations
  • Focus access control on the encryption keys, not the encrypted file
  • Consider using Shamir’s Secret Sharing to split each encryption key if you need multi-party control

​
Backup Package Format

The backup package is a JSON file containing encrypted key shares and metadata needed for key derivation. 
{
  "version": "1.0",
  "exported_key_shares": [
    {
      "key_id": "1a6bd986-aea3-47dd-9486-db4f42835599",
      "org_id": "617c0325-1223-4c59-97d7-f44fd1188b4f",
      "key_type": "KEY_TYPE_ECC_ED25519",
      "chaincode": "diLn5mFhQmNuC3mLXHSnk3mhkiv4c102OfyJilPBSOY=",
      "encryption_pubkeys": [
        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK0wmN/Cr3JXqmLW7u+g9pTh+wyqDHpSQEIQczXkVx9q backup-key-1",
        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJKylTU8A4orMxP1NHD9Lqo5K9w/yvqMhl6v5mPGBBEr backup-key-2",
        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDhSbRi6ky7VqVRP9SLKLzGj0X8zN2Nmf4xF5QH8K6Qj backup-key-3"
      ],
      "encrypted_shares": [
        "LS0tLS1CRUdJTiBTU0ggRU5DUllQVEVEIFBSSVZBVEUgS0VZLS0tLS0KYjNCbGJuTnphQzFyWlhrdGRqRUFBQUF...",
        "LS0tLS1CRUdJTiBTU0ggRU5DUllQVEVEIFBSSVZBVEUgS0VZLS0tLS0KYjNCbGJuTnphQzFyWlhrdGRqRUFBQUF...",
        "LS0tLS1CRUdJTiBTU0ggRU5DUllQVEVEIFBSSVZBVEUgS0VZLS0tLS0KYjNCbGJuTnphQzFyWlhrdGRqRUFBQUF..."
      ]
    },
    {
      "key_id": "2b7ce097-bfb4-58ee-a597-ec5g53946610",
      "org_id": "617c0325-1223-4c59-97d7-f44fd1188b4f",
      "key_type": "KEY_TYPE_ECC_SECP256K1",
      "chaincode": "xKMp6nGiRnOvD4nMYITol4nikjw5d213PgzKjmQCTPZ=",
      "encryption_pubkeys": [
        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK0wmN/Cr3JXqmLW7u+g9pTh+wyqDHpSQEIQczXkVx9q backup-key-1",
        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJKylTU8A4orMxP1NHD9Lqo5K9w/yvqMhl6v5mPGBBEr backup-key-2",
        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDhSbRi6ky7VqVRP9SLKLzGj0X8zN2Nmf4xF5QH8K6Qj backup-key-3"
      ],
      "encrypted_shares": [
        "LS0tLS1CRUdJTiBTU0ggRU5DUllQVEVEIFBSSVZBVEUgS0VZLS0tLS0KYjNCbGJuTnphQzFyWlhrdGRqRUFBQUF...",
        "LS0tLS1CRUdJTiBTU0ggRU5DUllQVEVEIFBSSVZBVEUgS0VZLS0tLS0KYjNCbGJuTnphQzFyWlhrdGRqRUFBQUF...",
        "LS0tLS1CRUdJTiBTU0ggRU5DUllQVEVEIFBSSVZBVEUgS0VZLS0tLS0KYjNCbGJuTnphQzFyWlhrdGRqRUFBQUF..."
      ]
    }
  ],
  "timestamp": 1707118991467
}
FieldDescription
key_idUnique identifier for the root key
org_idYour organization’s identifier
key_typeEither ECC_ED25519 or ECC_SECP256K1
chaincodeRequired for hierarchical key derivation (base64 encoded)
encryption_pubkeysThe three public keys you provided
encrypted_sharesYour three encrypted key shares (ciphertext)
timestampExport time in Unix milliseconds
The backup file alone cannot recover private keys. You must have the corresponding Ed25519 private keys and their passwords to decrypt the shares.