-Feb-15-2023-02-29-15-7102-PM.png?width=120&height=40&name=Untitled%20design%20(8)-Feb-15-2023-02-29-15-7102-PM.png){kind=small}
Understanding Your Keys: A Plain-Language Guide
Every Casa vault is protected by multiple keys. This article explains what keys are, which types exist, and how they work together to keep your assets secure.
What is a "key" in Casa?
In Casa, a key is a cryptographic credential, a piece of digital information that proves ownership and authorizes transactions. Think of it like a physical key that unlocks a safe: your vault has multiple keys, and you need more than one of them to open it (i.e., send funds).
Because Casa uses multisig (multi-signature) technology, no single key can move funds on its own. This means that losing one key, or having one key compromised, does not put your assets at risk.
The four key types
Mobile key
The mobile key lives in the Secure Enclave of your phone, a hardware-isolated chip designed specifically to protect sensitive cryptographic material. It is generated on your device; Casa never sees it. The key is encrypted and backed up automatically to iCloud (iPhone) or Google Drive (Android), so you don't need to write down a seed phrase.
The mobile key is your everyday signing key. When you send a transaction from your vault, the mobile key signs automatically in the background as one of the required signatures.
Held by: you.
Hardware key
The hardware key is stored on a dedicated physical hardware device, a Trezor, Ledger, Coldcard, Keystone, Passport, or similar device. This is your second layer of security, entirely separate from your phone.
To sign a transaction with a hardware key, you connect the device and physically approve the transaction on the device itself. This means an attacker who compromises your phone still cannot move funds without physically accessing your hardware device.
In a 5-key vault, you hold three hardware keys, each on a separate device.
Held by: you.
Casa Recovery Key
The Casa Recovery Key is held by Casa on your behalf. It exists for one purpose: emergency recovery if you lose access to one of your other keys.
This key is never used in routine transactions, and Casa cannot use it alone to move funds. Before the Recovery Key can be applied to any transaction, your identity must be verified, and a mandatory waiting period applies:
- Standard / Standard Plus members: You authenticate by answering the security questions you set up when creating your vault. There is then a 7-day delay before Casa applies the signature, giving you time to cancel if the request wasn't made by you.
- Premium / Private Client members: Authentication is done via a live video verification call with Casa's Client Services team, followed by a security review and 2-day delay.
The Casa Recovery Key should not be relied upon for time-sensitive transactions (such as margin calls for loans), due to the mandatory waiting period.
Held by: Casa (for your benefit).
Pay key (Casa Pay)
The Pay key is used exclusively for Casa Pay, a lightweight single-key wallet for quick BTC or ETH transactions. It is separate from your vault and operates independently.
Like the mobile key, the Pay key is generated and stored in your phone's Secure Enclave and backed up automatically to iCloud or Google Drive. Casa never has access to it. Because Casa Pay is a single-key wallet, only one signature is needed to send a transaction, no hardware devices required.
Held by: you.
Which keys are in my vault?
| Vault type | Mobile key | Hardware key(s) | Casa Recovery Key |
|---|---|---|---|
| 3-Key Vault | 1 | 1 | 1 (held by Casa) |
| 5-Key Vault | 1 | 3 | 1 (held by Casa) |
Note: Advanced users with a 3-key vault have the option to replace the mobile key with a second hardware key (BTC vaults only). See Replacing your mobile key with a second hardware key →
How many keys do I need to send a transaction?
Casa vaults use a "M-of-N" multisig model, you need M signatures from a total of N keys. Here's how it works in practice:
| Signatures required | How it works | |
|---|---|---|
| 3-Key Vault | 2 of 3 | Mobile key signs automatically + you approve on 1 hardware device |
| 5-Key Vault | 3 of 5 | Mobile key signs automatically + you approve on 2 hardware devices |
| Casa Pay | 1 of 1 | Phone only — no hardware device needed |
Learn more about each key type
Also relevant: What is the Casa app? · Casa Pay vs. Your Vault: What's the Difference?