Overview
Mural uses Digital Signatures to authenticate payments coming from your Mural Accounts. Your digital signature functions as the approval mechanism for all transactions, and is the source of security / protection for your funds.
When you configure a Mural Account, you will be asked to select Approvers and set an Approval threshold for transactions coming from that account. Your digital signature is used for providing those approvals. The digital signature is tied to your Mural user, and can be configured via your Profile settings.
Mural is a non-custodial payments platform, meaning Mural does not have access to or control over user funds. It is critical that you protect access to your digital signature to ensure security of your assets.
Creating your Passkey
Upon signing up for Mural, you will be prompted to setup your Digital Signature by creating a new passkey. Follow the prompts to add a passkey to your browser, mobile device, or hardware security key.
If you have issues creating a passkey, please reach out to [email protected]. Although most modern browsers and devices support passkeys, there are some configurations not yet supported.
Having trouble creating a Passkey?
If you are having trouble creating a passkey, select the "Use email instead" option. When you perform a payment, a confirmation code (that is valid for 1 hour) will be sent to your email. Please note that the code will be from [email protected].
If you need any assistance, please don't hesitate to contact [email protected].
Adding new Passkeys
After your Digital Signature is configured, you can access the details and add / remove passkeys in your user Profile. Choose Add Passkey to setup additional passkeys, providing further signing flexibility and redundancy.
It is recommended to setup multiple passkeys on different devices to provide backups in the case you lose a device / passkey.
Recovering lost Passkeys
If you lose access to the passkey(s) backing your Digital Signature, you can add new passkeys by clicking the Recover passkey button in your Profile settings.
This will initiate an email-based recovery flow, in which you will receive a recovery code to your Mural associated email address from [email protected]. Enter the recovery code, enter a name for your new passkey device, and follow the prompts.
It is imperative that you do not lose access to the email associated with your Mural account. If you lose access to your passkey devices and you lose access to your email, you will have no way recover your digital signature. This can lead to the loss of funds in your Mural accounts.
OS and Browser Support
Modern browsers and mobile devices have native support for passkeys, with the exception of Firefox, which only supports hardware security keys. See caniuse.com for more detailed information. Support also varies by Operating System. This matrix contains detailed information about OS-level passkey support.
If you are having difficulty setting up a passkey on your device(s), please reach out to us at [email protected]. In the case that your device(s) don't support passkeys, we also support using an External Wallet for your Digital Signature.
Passkey Security
Under the hood, passkeys are cryptographic key pairs created and stored directly on your devices. This comes with some significant security upgrades as compared to traditional passwords:
Access and usage of passkeys are gated on OS-level biometrics: faceId, touchId, PINs, lock screen patterns, etc.
The underlying credential is stored on your device is never disclosed to Mural (or any website), making them a lot harder to steal.
Your passkey is bound to the web domain that creates them (i.e. app.muralpay.com). This is important to thwart phishing attacks.
Passkeys are synced across devices natively on Apple and Google devices. Apple supports this via the iCloud keychain, and Google via the Google Password Manager.