Device Enrollment
Enrollment is a multi-step process that ensures only explicitly approved devices can join a tenant. The server never handles private keys.Step 1: Invite Creation
The owner generates a single-use, time-limited invite token.The raw invite token is returned to the owner exactly once. The server stores only the BLAKE2b hash. If the owner loses the token, they must generate a new one.
Step 2: Agent Enrollment
The agent consumes the invite and registers its public keys.Step 3: Owner Approval
The owner verifies the device fingerprint and explicitly approves the device.Step 4: Key Exchange and Activation
Both parties perform X3DH key agreement and initialize the Double Ratchet.Encrypted Messaging
Send Message (Owner to Agent)
Offline Message Retrieval
When a client reconnects after being offline, it fetches missed messages in order.Offline messages must be processed in chronological order because each decryption advances the ratchet chain. Processing out of order would desynchronize the ratchet state.