Authentication and encryption
Authentication checks a key shared in advance between server and client. Keep these identifiers distinct:
| Value | Role |
|---|---|
| Device ID | Identifies authentication credentials |
| Device Key | Secret shared authentication key |
| CID | Messaging address assigned by the server |
An authenticated device can use its registered CID. Anonymous CIDs may change after reconnection.
Connection encryption and E2E
IOSignal uses boho for shared-key authentication and message encryption. In JS 7.2.0, AUTO uses boho connection encryption when authentication has succeeded and TLS is absent. WSS uses TLS to protect the client–server connection.
Connection encryption does not prevent the server from reading message content. For only the final endpoints to read a payload, use a separate E2E data key that is not given to the relay server. See boho.
Provisioning and access policy
Issue per-device keys through a trusted setup channel. Do not embed a common secret in a public JavaScript bundle. Manage storage, rotation, and revocation explicitly.
Authentication and authorization for a particular message are separate concerns. HOME CHANNEL is IP-based grouping, not proof of identity. Message size, subscriber counts, and other quotas depend on server settings and authentication level.
Configure your system
- Server authentication with files, arguments, or Redis
- CLI client credentials
- Server API
- Public service conditions
TLS also supports PSK modes. Read technical details for the difference in trust setup and protection scope.