# End-to-End Encryption (E2EE)

End-to-End Encryption (E2EE) adds a layer of security to communications between the client and Incode's servers by encrypting transmitted data. The client and server first exchange keys for encrypting and decrypting messages. After this exchange, all subsequent communications are encrypted, and only the intended server and client can decrypt them.

## Prerequisites

- A custom E2EE server URL provided by Incode.

## Enable End-to-End Encryption

End-to-End Encryption (E2EE) setup takes three steps: initialize the SDK with a custom server URL, enable E2EE on the session configuration, and pass the session configuration to the SDK.

### 1. Initialize the SDK with a custom E2EE server

Pass your `e2eeUrl` to the `init` method.

```dart
IncodeOnboardingSdk.init(
  apiKey: 'YOUR_API_KEY',
  apiUrl: 'YOUR_API_URL',
  e2eeUrl: 'YOUR_E2EE_URL',
);
```

### 2. Enable E2EE on the session configuration

Set `e2eEncryptionEnabled` to `true` on your `OnboardingSessionConfiguration`.

```dart
OnboardingSessionConfiguration sessionConfig = OnboardingSessionConfiguration(
  e2eEncryptionEnabled: true,
);
```

### 3. Pass the session configuration to the SDK

Pass the configured `OnboardingSessionConfiguration` to either `setupOnboardingSession` (for section-based flows):

```dart
IncodeOnboardingSdk.setupOnboardingSession(
  sessionConfig: sessionConfig,
);
```

or to `startOnboarding` (for end-to-end flows):

```dart
IncodeOnboardingSdk.startOnboarding(
  sessionConfig: sessionConfig,
  flowConfig: flowConfig,
);
```

## End-to-End Encryption in Face Login

Face Login has its own End-to-End Encryption (E2EE) parameter, `e2eeEncryptionEnabled` (note the two Es, distinct from the session config's `e2eEncryptionEnabled`). E2EE is disabled by default for Face Login and supported on Android only. See [Face Login](./flutter-face-login) for details.

## Verify End-to-End Encryption is working

If End-to-End Encryption (E2EE) is enabled but not properly configured, the SDK returns an error. If E2EE is working, the SDK sends and receives requests to and from the E2EE server, and the requests themselves are encrypted. Check your logs to confirm.

Contact your Incode representative if you need help diagnosing an E2EE issue.