# End-to-End Encryption (E2EE)

End-to-End Encryption (E2EE) adds a layer of security to communications between the client and Incode's servers by encrypting transmitted data. The client and server first exchange keys for encrypting and decrypting messages. After this exchange, all subsequent communications are encrypted, and only the intended server and client can decrypt them.

## Prerequisites

- A custom E2EE server URL provided by Incode.

## Enable End-to-End Encryption

End-to-End Encryption (E2EE) setup takes three steps: initialize the SDK with a custom server URL, enable E2EE on the session configuration, and pass the session configuration to the SDK.

### 1. Initialize the SDK with a custom E2EE server

Pass your `e2eeUrl` to the `initializeSDK()` method.

```javascript Javascript
cordova.exec(
  function () { console.log("SDK initialized"); },
  function (err) { console.log("Init error:", err); },
  "Cplugin",
  "initializeSDK",
  [
    "YOUR_API_KEY",              // apiKey
    "https://your.api.url",      // apiUrl
    "true",                      // loggingEnabled
    "false",                     // testMode
    "false",                     // isExternalTokenEnabled
    null,                        // clientExperimentId
    "https://your.e2ee.url",     // e2eeUrl — required when using E2EE
    { enabled: false, forceSSLPinning: false } // sslPinningConfig
  ]
);
```

### 2. Enable E2EE on the session configuration

Set `e2eEncryptionEnabled` to `true` on your `sessionConfig`.

```javascript Javascript
var sessionConfig = {
  e2eEncryptionEnabled: true,
};
```

### 3. Pass the session configuration to the SDK

Pass the configured `sessionConfig` to either `setupOnboardingSession()` (for section-based flows):

```javascript Javascript
// Section-based
cordova.exec(
  function (data) { console.log("Session:", data.interviewId, data.token); },
  function (err) { console.log("Error:", err); },
  "Cplugin",
  "setupOnboardingSession",
  [sessionConfig]
);
```

or to `startOnboarding()` , `startFlow()`, or `startWorkflow()` (for end-to-end flows):

```javascript Javascript
// startOnboarding
cordova.exec(
  function (result) { console.log("Done:", result); },
  function (err) { console.log("Error:", err); },
  "Cplugin",
  "startOnboarding",
  [sessionConfig, flowConfig, recordSessionConfig]
);

// startFlow — dashboard flow, optionally from a module
cordova.exec(
  function (result) { console.log("Done:", result); },
  function (err) { console.log("Error:", err); },
  "Cplugin",
  "startFlow",
  [{ configurationId: "your-flow-id", e2eEncryptionEnabled: true }, "EMAIL"] // moduleId optional
);

// startWorkflow — dashboard workflow, end to end
cordova.exec(
  function (result) { console.log("Done:", result); },
  function (err) { console.log("Error:", err); },
  "Cplugin",
  "startWorkflow",
  [{ configurationId: "your-workflow-id", e2eEncryptionEnabled: true }]
);
```

## End-to-End Encryption in Face Login

Face Login has its own End-to-End Encryption (E2EE) parameter, `e2eEncryptionEnabled`. E2EE is disabled by default for Face Login and supported on Android only. See [Face Login](#) for details.

```javascript Javascript
cordova.exec(
  function (result) { console.log("Face login success:", result); },
  function (err) { console.log("Face login error:", err); },
  "Cplugin",
  "startFaceLogin",
  [{ e2eEncryptionEnabled: true }]
);
```

## Verify End-to-End Encryption is working

If End-to-End Encryption (E2EE) is enabled but not properly configured, the SDK returns an error. If E2EE is working, the SDK sends and receives requests to and from the E2EE server, and the requests themselves are encrypted. Check your logs to confirm.

Contact your Incode representative if you need help diagnosing an E2EE issue.