<!-- tempo-docs-context -->
> Source: [/docs/accounts/account-configuration](https://tempo.xyz/developers/docs/accounts/account-configuration.md)
> Section: [Accounts](https://tempo.xyz/developers/docs/accounts.md). Create accounts, set up signing methods, policies, access keys, key rotation, and fees, and follow guides for users, automations, agents, and teams.
> [Documentation index](https://tempo.xyz/developers/llms.txt) · [Docs skill](https://tempo.xyz/developers/SKILL.md)

> Tempo MCP: Use `search`, `find_pages`, `read_page`, and `code` at `https://mcp.tempo.xyz` for Tempo and related documentation.
> If an indexed page is missing or reflects an older site, read this site’s [documentation index](https://tempo.xyz/developers/llms.txt) and Markdown pages directly.

# Account Configuration

Changes a configurable account's signers, weights, and threshold without changing its address.

<span id="how-it-works" />

## Overview

An account's configuration is its signers, their weights, and its threshold. A signer is a key that approves the account's transactions. Because the address stays, the balance and history survive a lost phone or a departing approver.

:::warning
**Multiple signers arrive with the [T14 network upgrade](https://tempo.xyz/developers/docs/protocol/upgrades/t14).** Until T14 activates, an account with several signers and a threshold runs only on the [Tempo Accounts devnet](https://tempo.xyz/developers/docs/accounts/create#connect-to-the-devnet), not on mainnet or testnet, and may still change.
:::

A [configuration update](https://tempo.xyz/developers/docs/accounts/account-configuration/configuration-updates) replaces the account's whole signer list and its [threshold](https://tempo.xyz/developers/docs/accounts/policies/signing-thresholds) in one transaction. Signers whose weights reach the current threshold approve it, the same way they approve a payment. Only the current signers can approve a change. Tempo has no override, so [plan for recovery](https://tempo.xyz/developers/docs/accounts/account-configuration#plan-for-recovery) before you need it.

A single-key account (EOA) has no signer list to change. [Upgrade it](https://tempo.xyz/developers/docs/accounts/account-configuration/account-upgrade) to a configurable account first.

<span id="one-signer-update-same-address" />

<span id="every-change-is-one-signer-update-at-the-same-address" />

<span id="key-management-by-situation" />

<span id="key-replacement" />

<span id="recovery-situations" />

<span id="recovery-by-situation" />

<span id="key-rotation-by-situation" />

<span id="every-change-is-one-signer-update" />

## Approvers by Situation

The situations differ in who approves:

| Situation | The update | Who approves |
| --- | --- | --- |
| [Add a backup or recovery signer](https://tempo.xyz/developers/docs/accounts/account-configuration/configuration-updates#add-a-signer) | Adds the new signer | The current signers |
| [Rotate a key](https://tempo.xyz/developers/docs/accounts/account-configuration/configuration-updates#rotate-a-key-by-replacing-it-in-one-update) | Swaps the new key in at the old one's weight | The current signers, including the old key |
| [Replace a lost or compromised signer](https://tempo.xyz/developers/docs/accounts/account-configuration/configuration-updates#remove-a-lost-or-compromised-signer) | Swaps a new signer in for it | The other signers, without it |
| [Offboard an approver](https://tempo.xyz/developers/docs/accounts/custodians/team-multisig) | Removes their signer, and lowers the threshold if needed | The remaining approvers |
| [Hand off to a self-custodial wallet](https://tempo.xyz/developers/docs/accounts/apps/self-custodial-wallets) | Replaces your app's signers with one the user holds | Your app's signers |

<span id="revoke-a-key" />

<span id="revoke-access-keys" />

A configuration update doesn't touch access keys or token approvals. A device key on a lost phone keeps paying within its limits until you [revoke it](https://tempo.xyz/developers/docs/accounts/access-keys/revocation#revoke-after-a-signer-change).

<span id="watch-signer-changes" />

## Watch Changes

Each [configuration update](https://tempo.xyz/developers/docs/development/configurable-accounts#configuration-updates) emits `MultisigConfigUpdated` with the account, its new version, threshold, and signer list. The public indexer doesn't cover the Tempo Accounts devnet. Read the event with Viem's `getContractEvents` from a devnet client. The devnet RPC searches at most 100,000 blocks per request.

```ts [watch-signers.ts]
import { Abis, Addresses } from 'viem/tempo'
import { account } from './account'
import { client } from './client'

const latestBlock = await client.getBlockNumber()

const updates = await client.getContractEvents({ // [!code hl]
  abi: Abis.nativeMultisig,
  address: Addresses.nativeMultisig,
  eventName: 'MultisigConfigUpdated', // [!code hl]
  args: { account: account.address },
  fromBlock: latestBlock - 99_999n,
  toBlock: latestBlock,
  strict: true,
})
// each update's args: { account, salt, version, threshold, owners }
```

<span id="plan-for-recovery-before-you-need-it" />

## Plan for Recovery

Only the other signers can replace a lost one. When you create the account, choose weights that reach the threshold without any one signer. The test is total weight minus the largest signer's weight. When that's at least the threshold, the account survives losing any one signer.

For example, give a passkey weight 2, and a backup key and a recovery provider's key weight 1 each. Set the threshold to 2. It passes, because 4 minus 2 leaves 2. The two keys together replace a lost passkey. The passkey alone replaces either key. Other [recommended signer setups](https://tempo.xyz/developers/docs/accounts/policies/signing-thresholds#recommended-signer-setups) also pass. On an existing account, [add a recovery signer](https://tempo.xyz/developers/docs/accounts/account-configuration/configuration-updates#add-a-recovery-signer).

<span id="key-management-limits" />

<span id="account-recovery-limits" />

<span id="recovery-limits" />

<span id="key-rotation-limits" />

A recovery signer can approve payments at its weight too, so give it no more weight than recovery needs.

<span id="recover-funds-sent-on-another-chain" />

### Funds on Other Chains

The account has the same address on other EVM chains. A sender can pay it on the wrong chain by mistake. Those funds can't be retrieved today.

The [specification for configurable account addresses](https://tempo.xyz/developers/docs/development/configurable-accounts#configurable-account-address) defines a recovery factory contract for that chain. With it, the account's original secp256k1 signers could deploy a recovery wallet at the address. That wallet retrieves the funds. Those are standard Ethereum keys, such as KMS or hardware wallet keys. That works if their weights reach the original threshold, even after you remove them on Tempo. No chain has the recovery factory yet.

Passkeys and device keys don't count. Accounts [upgraded in place](https://tempo.xyz/developers/docs/accounts/account-configuration/account-upgrade) don't use the factory. On other chains, their original key still controls the address. To keep the option open, create the account with secp256k1 signers whose weights reach the threshold on their own.

<span id="changes" />

## Related

[Configuration Updates](https://tempo.xyz/developers/docs/accounts/account-configuration/configuration-updates): Use for adding, removing, or replacing a signer at the same address.

[Account Upgrade](https://tempo.xyz/developers/docs/accounts/account-configuration/account-upgrade): Use for turning a single-key account into a configurable account.

[Signing Thresholds](https://tempo.xyz/developers/docs/accounts/policies/signing-thresholds): Covers how signer weights reach a threshold to approve a transaction.

[Revocation](https://tempo.xyz/developers/docs/accounts/access-keys/revocation): Covers how to stop an access key from signing.

[Configurable Accounts](https://tempo.xyz/developers/docs/development/configurable-accounts): Covers the protocol reference for signers, updates, and addresses.