E2EE keys
Worker-client payload encryption keys.
Worker-client payload encryption keys.
This screen belongs to the Router deployment operator, not an ordinary hosted customer. Hosted customers have a separate account page with their own keys and limits; policy and service settings are not exposed there. Contact the operator to change protection. In the operator console, open the route listed above; a report tenant filter does not automatically scope a global setting.
Examples use educational data. Use your own authorized tenant in real integrations. Each screenshot shows the actual frontend, with the source and educational/demo mode stated below it.
Step-by-step actions
- Open /e2ee and locate your worker.
- Generate a supported key pair on the client and set E2EE_PRIVATE_KEY_PATH.
- Register only the public key through the worker protocol.
- Refresh and check status, then test encryption/decryption in the supported runtime.
Every control and its meaning
| Control / parameter | Values, units and effect |
|---|---|
| Public key | View the worker public X25519 key and heartbeat. Never send the private key to the console. |
| E2EE_PRIVATE_KEY_PATH | Client-side path to the private key, configured on the worker rather than in this page. |
| Preview / Refresh | This page is a guide and inventory, without key generation or an encryption toggle. |
Verify the result
A public key entry does not prove protection for every API route. Verify the specific client payload and response.
Errors, disabling and reverting changes
If the private key is lost, restore an authorized backup or register a new pair. A new key cannot decrypt old data.
Detailed security settings · Traffic analysis · FAQ · All application sections