Mobile Signer

The io.sign Mobile Signer lets a person hold a vault share, review requests, and participate in threshold signing from a supported iOS or Android device.

Requirements

Platform	Supported baseline
iOS	iPhone 12 or later running iOS 17 or later
Android	Android 12 (API level 31) or later with a hardware-backed Keystore

Enable secure biometric authentication and keep the operating system current. iPad and macOS availability in the App Store does not imply official io.sign support.

Install the app

Download the current io.sign Mobile Signer binary from an official store:

The current store listing is named io.finnet while the signing product transitions to the io.sign brand. Verify that the developer is Io FinNet Group, Inc. before installing.

If your organisation uses customer-cloud, on-premise, or air-gapped io.sign, connect the app to that service before signing in. See Connect to a custom environment.

The store links identify the published io.finnet app. Confirm with your administrator that the installed version supports your io.sign environment and the custom-environment flow. A store listing alone does not establish compatibility with a launch or preview backend.

Register the signer

Open the app and sign in with the account issued for your io.sign environment.
When prompted, register the device as a new signer.
Review the generated device name. You can change it later in your profile.
Choose a local protection method:
- Passphrase: stronger protection and the recommended choice.
- PIN: more convenient but less resistant to guessing.
Enable biometric authentication when available.
Complete the recovery setup and store the recovery material according to your organisation's security procedure.

After registration, an administrator can add the Mobile Signer to a vault and assign its weight.

Review and approve requests

Open the request notification or the app's request list and select the pending operation.
Check the organisation, vault, operation type, and the details shown. For a signing request, review its payload or decoded transaction and any warnings. For vault creation or resharing, review the proposed signer membership, weights, and threshold.
Approve only if the request matches the operation you expect. Complete the app's local identity verification when prompted. Otherwise, choose Reject and confirm.
Keep the app connected while the signing ceremony runs, and check the final request status. An approval alone does not mean the request completed or a transaction reached a blockchain.

A request can complete without your approval if another eligible signer set meets the threshold. If your approval is not enough, additional eligible signer weight must approve and remain reachable.

If the app cannot decode a payload, verify the exact data through an approved independent process before deciding. A warning acknowledgement is not a validation of the payload.

Troubleshoot signing

Symptom	What to check
No pending request appears	Correct environment and organisation, signer membership, request expiry, and network access. Open the app rather than relying only on push notifications.
A request is waiting after approval	Enough eligible signer weight must approve and remain reachable to meet the threshold. Ask the administrator to check signing-stream and MQTT connectivity.
An update is required	Install the compatible version supplied through your organisation's approved distribution channel.
Device lost or replaced	Use the approved recovery process with the encrypted backup and recovery secret. Do not assume a fresh registration restores existing key shares.

Protect recovery material

Recovery setup creates a signer-specific 24-word phrase. It protects the encrypted backup used to recover the signer's shares if the device is lost or replaced.

Store the phrase separately from the device and its cloud account.
Do not photograph it, paste it into a password field, or send it through chat or email.
Losing both the device and usable recovery material can prevent that signer from participating in its vaults.
Anyone who obtains the encrypted backup and its recovery secret may be able to recover the share. Apply your organisation's access-control and custody requirements.

The device passphrase is separate from the account password. It cannot be recovered or changed if it is lost.

Backup syncing

On iOS, encrypted backups can sync through iCloud or Google Drive. Android supports Google Drive. A synced backup remains encrypted and requires its recovery secret before it can be restored.

Confirm that the selected cloud-backup provider is permitted by your organisation before enabling sync. Organisations that prohibit consumer cloud storage should use their approved recovery procedure instead.

Resharing a vault

Resharing can add or remove signers or change their weights without changing the vault's public key.

Resharing does not necessarily make every historical copy of an old share cryptographically unusable. If vault membership changes because a signer or share may be compromised, create a new vault and rotate to its new public key instead of relying only on resharing.

Next steps

Connect to a custom environment for customer-operated io.sign.
Vaults, signers, and thresholds explains how the Mobile Signer's weight contributes to signing.