Key refresh

Key refresh generates new shares on mobile and server side, without changing the public key. Same address, same balance, same transaction history — only the share material changes. This is proactive security: even if an attacker captured a snapshot of the old share, it becomes useless after a refresh.

For the SDK contract see Key Refresh (Kotlin) and Key Refresh (Swift).

How the example does it

Android
iOS / macOS

vault/.../session/VaultSessionManager.kt
suspend fun keyRefresh(keyId: String) {
    val dao = readDao(keyId)
    val keyshare = dao.currentKeyshare
        ?: throw Exception("No active keyshare found for keyId: $keyId")
    sessionFor(dao.keyType).keyRefresh(keyshare).getOrThrow()
}

Vault/Session/VaultSessionManager.swift
func keyRefresh(keyId: String) async throws {
    let record = try loadRecord(keyId: keyId)
    let keyshare = try requireActiveKeyshare(record)
    _ = try await sessionForKeyType(record.keyType)
        .keyRefresh(keyshare: keyshare).get()
}

The SDK persists the new share via the registered storage client using the two-slot staged/current model. If the app is killed mid-refresh, the next launch picks up the staged share and commits it via the reconciliation pass.