I lost my key

The honest answer first

If you have no key backup, no recovery phrase, and no colleague who is a recipient of the same content, the protected content is unrecoverable. Not locked pending support — unrecoverable. Nobody can decrypt it.

Before you conclude that: look for the recovery phrase

TOVIO generated one at tovio init and added it as an extra recipient of your protected content. If init ran on a terminal it printed the phrase. If it ran non-interactively, piped, or with --json, it wrote the phrase to a file and told you the path:

.tovio/tovio-recovery-key.txt

It is 64 hexadecimal characters, owner-readable only, and sits under the always-ignored .tovio/ directory so it can never be swept into a commit. A great many people have this file and have never opened it. Check before despairing — and once you have it, move it somewhere that is not the machine you might lose.

What you can recover from

What key recover actually does

It verifies the phrase against the recovery public key cached at .tovio/identity-recovery.pub, decrypts HEAD's protected content with the recovery secret, generates a brand-new identity, and re-wraps HEAD's content keys to it. Wrong, corrupt or absent material fails closed with TVO-KEY-006 — no identity is installed and nothing is re-wrapped, so a bad phrase can never quietly swap in an unrelated key.

Three consequences you must plan for

• HEAD only. Content whose keys were rotated away while your key was lost is not recovered.
• The audit chain resets. The old entries were signed by the lost key and cannot be bridged, so recovery starts a fresh verifiable segment and the old entries survive as orphaned, unverifiable objects. tovio audit verify on a just-recovered repository succeeds against an empty segment. TOVIO deliberately does not forge continuity.
• On a team repository, your teammates get dropped. Every teammate and device claim was signed by the lost authority key and no longer verifies, so the re-seal reaches only you and the recovery recipient. key recover names the dropped recipients out loud. You must re-run tovio access grant and tovio device approve for each of them afterwards. Recovery does not restore your team; it restores you.

A Simple repository has no recovery key

The recovery key is created with the cryptographic identity. A --mode simple repository has no identity and therefore nothing on record, and key recover will tell you so. Running tovio identity init is what creates both.

What is never lost

Unprotected content. Only policy-covered paths are encrypted; the rest of the repository is fine.

Assess the damage

tovio policy listtovio access check <path>

Never share the phrase while asking for help

The recovery phrase decrypts your protected content. Anyone who has it has your data. When you ask for help with a failed recovery, share the error code only — never the phrase, never the contents of .tovio/tovio-recovery-key.txt, never a key backup file, and never the passphrase that opens one. No part of TOVIO support will ever ask you for any of them.

Afterwards

Export a backup and test the restore. This is the failure worth building a habit around.