Skip to main content
Every Aura account comes with a built-in wallet. You never install an extension, and your private key is never stored in your browser or on your device. You open the wallet by logging in, and it works the same everywhere you sign in.

​
Where your key lives

Your wallet’s private key is generated inside a secure enclave, an isolated machine that runs one reviewed program and nothing else. The key is created there, used there, and encrypted at rest with a cloud key whose policy will only release it back to that same reviewed program. What that gives you in practice:
  • The key never reaches your browser. A malicious script on a web page has nothing to steal, because no key material exists on your device.
  • Aura staff cannot sign for you. Signing requires a short-lived permission slip issued to your logged-in session. Aura holds no standing credential that authorizes a transfer out of your wallet.
  • A server breach does not expose your key. The stored copy is encrypted, and the servers that handle your login never see the decrypted version.
Aura operates the enclave, so this is not the same trust model as a hardware wallet you hold yourself. The design goal is that compromising Aura’s servers, database, or dependencies does not give an attacker your key.

​
Two addresses, one wallet

Your wallet gives you two addresses and you can ignore both most of the time:

​
Signing in

1

Sign up with email or Google

Enter your email and type the one-time code we send you, or continue with Google. This is always the first step, so your account is recoverable from the moment it exists.
2

Add a passkey (optional)

A passkey gives you one-tap sign-in with Face ID, Touch ID, Windows Hello, or your device PIN. It is a faster way in, and skipping it costs you nothing.
Every method opens the same wallet. They are ways in, not separate accounts.

​
Recovering your account

Recovery works through your login, so there is nothing to write down and store:
  • Lost your phone or laptop? Sign in with email or Google from any device and your balance is there.
  • Lost your passkey? Same answer. A passkey is a shortcut, and losing it never locks you out.
Because email and Google carry account authority, treat those accounts as you would your bank login. Sensitive actions such as changing your recovery email or your passkeys require a fresh confirmation and send you an out-of-band notification, so an unexpected change is visible and reversible.

​
Exporting a recovery phrase

If you want the option to hold your own key outside Aura, you must turn it on during signup, when the wallet creation flow offers to bind an export credential. That credential is a passkey the enclave itself checks, so exporting works even if Aura’s login servers are fully compromised.
Binding that export credential during signup is the only chance to enable raw phrase export. Skipping it is permanent for that wallet. Your wallet stays fully usable and fully recoverable either way, and you can always withdraw your balance to any address you control.

​
Signing transactions

Once you are signed in, ordinary activity signs in the background. Placing an order, voting, or staking goes through without a biometric prompt, and clicking the action is the approval. Moving money to an address outside Aura is treated differently. Those transactions show you the decoded destination and amount on a trusted screen and ask you to confirm with your passkey or an email code before anything is signed.

​
Your username

Every new account gets a generated username such as brisk-otter-42. It is your public identity on Aura, shown on comments, the leaderboard, and your profile page. Rename it, add a picture and bio, or make your profile private in Settings.

​
Security summary

Last modified on July 29, 2026