OpenE2EE Signal Protocol Relay

Reviewed: 2026-10-19.

OpenE2EE Signal Protocol Relay is built to work with the OpenE2EE Signal Protocol SDK. It is the hosted delivery path: it operates encrypted device mailboxes, delivery and pull, group fan-out, private encrypted attachment storage, push wakes, exact usage, and lifecycle controls. It never needs message plaintext or device private keys.

The self-hosted adapter path remains separate. It keeps relay infrastructure and metadata under your control. Hosted and self-hosted deployments use disjoint trust roots and product scopes.

Sandbox quickstart

The hosted sandbox environment has one job: reach an acknowledged encrypted message before production setup. It needs no payment card. Device-owned identity is the default, and the service creates no production trust root.

1. Install the SDK with the SDK quickstart.
2. Install the oe command with npm install --global @open-e2ee/oe. It needs Node.js 22.18 or later. To run one command without an installation, use npx @open-e2ee/oe@latest, for example npx @open-e2ee/oe@latest auth login. Do not run npx oe, because the npm package oe is not an OpenE2EE package.
3. Run oe auth login. A person approves the login in a browser. When the organization has not accepted the OpenE2EE terms, read them, then run oe auth login --accept-terms. At a terminal, a person who belongs to more than one organization chooses one at login. oe org switch changes it later.
4. If the project already exists in Console, run oe link PROJECT_SLUG in the application directory. Copy the exact command from its Sandbox setup guide. Otherwise, run oe new to create the project and its Sandbox environment. The CLI writes the public project policy to open-e2ee.config.ts and the Sandbox connection to .env.local. When it creates the local configuration, it also adds the @open-e2ee/oe devDependency. Then install the dependencies.
5. Use the generated Relay connection. The SDK resolves its public protocol binding. Do not pair a hostname with a second value.
6. Register two test devices and send one encrypted message. The round trip in the SDK quickstart does this. In the Sandbox environment, hostedRelaySandboxIdentity(storage) from the SDK supplies the identity assertions. The helper works only in a Sandbox environment. Production uses the identity integration of your application, as identity and authentication describes.
7. Run oe doctor --env sandbox. It reads the recorded acknowledgment and can repeat after a successful exchange. The exchange is complete when the destination acknowledges its mailbox entry. To wait for a new event, start oe doctor --env sandbox --wait in another terminal before step 6.

The application uses one semantic setting in every environment:

OPEN_E2EE_RELAY_URL=https://<generated-environment-connection>

In a Next.js, Expo, or Vite application, the variable name has the public prefix of the framework: NEXT_PUBLIC_, EXPO_PUBLIC_, or VITE_. oe new selects the name from package.json.

Pass that value as hosted.relayUrl to createHostedSignalProtocolClient(). The URL is public configuration. It is not a credential. oe new writes the sandbox value to .env.local, and oe config push writes the production value to .env.production.local. The application source does not change.

Before that acknowledgment, the setup path does not ask about push, groups, attachments, sealed sender, retention, recovery, provider migration, billing, or advanced verifier settings. Each becomes an explicit next step afterward.

Sandbox boundary

The sandbox environment includes 25 test accounts, 25,000 delivery units, 25,000 attachment uploads, and 250 MB of storage each month. Its default ciphertext retention is 24 hours. You can reduce it or increase it to no more than seven days. It suspends after 30 inactive days and has no production roots or service-level commitment.

Production path

Production activation changes the trust and plan environment. It does not verify your application identity integration. If your application has member accounts, configure its custom-token verifier before member-device registration. Device-owned Production accounts prove local key possession and do not bind to an application login. Clerk and Firebase setup remains unavailable until its SDK and provider acceptance checks pass. A production project cannot reuse sandbox credentials, roots, certificates, or stored state.

The external ES256 option requires Relay-specific claims and configured public keys. Arbitrary OIDC session tokens do not satisfy this contract.

To activate Production, add a production entry under environments in open-e2ee.config.ts, then run oe config push. The push applies the Sandbox section first, then the Production section. Production activation needs four things, in this order: the billing permission on the organization, the accepted terms, a Free slot for the project, and a saved card. When one is missing, the push stops and names the step.

The CLI reference lists every oe command, flag, exit code, and environment variable.

Continue with identity and authentication, then delivery and push. After your first devices connect, read device figures for what the Devices view and the device page count. To show users when other users are online, read presence.