Keys and recovery
Your root decides which devices are yours: only devices it certified are trusted, by every one of your nodes, so a stolen server cannot add a device to your identity. When you create your identity at the first run, your passkey (Face ID) becomes your root's first authority.
If you lose your devices
Settings → If you lose your devices shows your ways back in plain sentences, and how strong they are together: one way back is weak, two good, three or more strong.
| Way back | Set it up | Getting back in |
|---|---|---|
| Your synced passkey | Use a passkey saved in iCloud Keychain or Google Password Manager (Security → Add) | Face ID on the new phone or computer, as usual |
| Another device | Use Mandala on a second device (Security → Add a device) | Approve the new device from the other one |
| People you trust | Pick 2–5 people (Root keys → Trustees) | Enough of them vouch for you, after talking to you |
| Recovery kit | Your 24-word paper key (Root keys → Paper key) | Type the words on the new device |
| This machine's console | Coming soon | On your own server or Mac, owning the machine will be a way back |
If every way back is lost, nobody, including Mandala's developers, can give the account back. Your data stays on your machines.
Advanced: root keys
Settings → Root keys manages the root directly: the paper key, security keys and trustees. A node set up before accounts can create its root here.
1. Paper key (the recovery kit)
24 words that can act as your root. Press Create: the words are generated in your browser, shown once and never stored, not even on your server. Write them on paper, keep the paper somewhere safe, then type back the words asked to prove you have them.
2. Security keys and passkeys (up to 3)
A passkey or a hardware security key (YubiKey and similar) registered here can certify devices and change the root with a touch, like the paper key. Keys are bound to your tailnet address, so one key works with every node.
3. Trustees (optional, up to 5)
People you recognize in Relationships and exchange. If you lose your paper and security keys, enough of them together can vouch for a new root. With several trustees, at least two must agree; you choose how many.
4. Create
Create root (only on a node without one). From then on:
- Certify each device under Devices, with the paper key or a security key. Uncertified devices stop syncing until certified.
- Change the root (add or remove security keys, change trustees): the current root signs the change.
If you lose your keys
Recover with trustees: Mandala prepares a recovery request. Write down the new paper key it shows first. Send the request to each trustee; each pastes it in their Settings → Root keys → Vouch for someone, after checking with you in person or by a call, and sends back their answer. Paste the answers, one per line, and Recover.
As a trustee, vouch only after you have spoken with the person: whoever controls their root controls their devices.
Coming soon
Coming soon — trustee requests and answers through Exchange instead of copy and paste, a printable recovery kit with your seal and a QR, and console recovery on your own machines.