# OpenE2EE Signal Protocol Relay (https://docs.open-e2ee.dev/relay.md) Reviewed: 2026-10-19. OpenE2EE Signal Protocol Relay is built to work with the OpenE2EE Signal Protocol SDK. It is the hosted delivery path: it operates encrypted device mailboxes, delivery and pull, group fan-out, private encrypted attachment storage, push wakes, exact usage, and lifecycle controls. It never needs message plaintext or device private keys. The [self-hosted adapter path](https://docs.open-e2ee.dev/start/choosing-adapters.md) remains separate. It keeps relay infrastructure and metadata under your control. Hosted and self-hosted deployments use disjoint trust roots and product scopes. ## Sandbox quickstart [#sandbox-quickstart] The hosted sandbox environment has one job: reach an acknowledged encrypted message before production setup. It needs no payment card. Device-owned identity is the default, and the service creates no production trust root. 1. Install the SDK with the [SDK quickstart](https://docs.open-e2ee.dev/start/quickstart.md). 2. Install the `oe` command with `npm install --global @open-e2ee/oe`. It needs Node.js 22.18 or later. To run one command without an installation, use `npx @open-e2ee/oe@latest`, for example `npx @open-e2ee/oe@latest auth login`. Do not run `npx oe`, because the npm package `oe` is not an OpenE2EE package. 3. Run `oe auth login`. A person approves the login in a browser. When the organization has not accepted the OpenE2EE terms, read them, then run `oe auth login --accept-terms`. At a terminal, a person who belongs to more than one organization chooses one at login. `oe org switch` changes it later. 4. If the project already exists in Console, run `oe link PROJECT_SLUG` in the application directory. Copy the exact command from its Sandbox setup guide. Otherwise, run `oe new` to create the project and its Sandbox environment. The CLI writes the public project policy to `open-e2ee.config.ts` and the Sandbox connection to `.env.local`. When it creates the local configuration, it also adds the `@open-e2ee/oe` devDependency. Then install the dependencies. 5. Use the generated Relay connection. The SDK resolves its public protocol binding. Do not pair a hostname with a second value. 6. Register two test devices and send one encrypted message. The round trip in the [SDK quickstart](https://docs.open-e2ee.dev/start/quickstart.md) does this. In the Sandbox environment, `hostedRelaySandboxIdentity(storage)` from the SDK supplies the identity assertions. The helper works only in a Sandbox environment. Production uses the identity integration of your application, as [identity and authentication](https://docs.open-e2ee.dev/relay/identity.md) describes. 7. Run `oe doctor --env sandbox`. It reads the recorded acknowledgment and can repeat after a successful exchange. The exchange is complete when the destination acknowledges its mailbox entry. To wait for a new event, start `oe doctor --env sandbox --wait` in another terminal before step 6. The application uses one semantic setting in every environment: ```text OPEN_E2EE_RELAY_URL=https:// ``` In a Next.js, Expo, or Vite application, the variable name has the public prefix of the framework: `NEXT_PUBLIC_`, `EXPO_PUBLIC_`, or `VITE_`. `oe new` selects the name from `package.json`. Pass that value as `hosted.relayUrl` to `createHostedSignalProtocolClient()`. The URL is public configuration. It is not a credential. `oe new` writes the sandbox value to `.env.local`, and `oe config push` writes the production value to `.env.production.local`. The application source does not change. Before that acknowledgment, the setup path does not ask about push, groups, attachments, sealed sender, retention, recovery, provider migration, billing, or advanced verifier settings. Each becomes an explicit next step afterward. ## Sandbox boundary [#sandbox-boundary] The sandbox environment includes 25 test accounts, 25,000 delivery units, 25,000 attachment uploads, and 250 MB of storage each month. Its default ciphertext retention is 24 hours. You can reduce it or increase it to no more than seven days. It suspends after 30 inactive days and has no production roots or service-level commitment. ## Production path [#production-path] Production activation changes the trust and plan environment. It does not verify your application identity integration. If your application has member accounts, configure its [custom-token verifier](https://docs.open-e2ee.dev/relay/custom-token.md) before member-device registration. Device-owned Production accounts prove local key possession and do not bind to an application login. Clerk and Firebase setup remains unavailable until its SDK and provider acceptance checks pass. A production project cannot reuse sandbox credentials, roots, certificates, or stored state. The external ES256 option requires Relay-specific claims and configured public keys. Arbitrary OIDC session tokens do not satisfy this contract. To activate Production, add a `production` entry under `environments` in `open-e2ee.config.ts`, then run `oe config push`. The push applies the Sandbox section first, then the Production section. Production activation needs four things, in this order: the billing permission on the organization, the accepted terms, a Free slot for the project, and a saved card. When one is missing, the push stops and names the step. The [CLI reference](https://docs.open-e2ee.dev/reference/cli.md) lists every `oe` command, flag, exit code, and environment variable. Continue with [identity and authentication](https://docs.open-e2ee.dev/relay/identity.md), then [delivery and push](https://docs.open-e2ee.dev/relay/delivery-and-push.md). After your first devices connect, read [device figures](https://docs.open-e2ee.dev/relay/devices.md) for what the Devices view and the device page count. To show users when other users are online, read [presence](https://docs.open-e2ee.dev/relay/presence.md).