# End-to-End Encryption (E2EE)

End-to-End Encryption (E2EE) adds an extra layer of security by encrypting data transmitted between the client and the Incode server. The process begins with a key exchange where the client and server share keys for encrypting and decrypting messages.

E2EE is configured in two places: at SDK initialization (to point the SDK at the E2EE server) and on the session (to enable encryption for a specific onboarding session).

## Configure the E2EE URL at initialization

Pass `e2eeUrl` in `apiConfig` when calling `initialize`:

```ts
await IncodeSdk.initialize({
  apiConfig: {
    key: 'YOUR_API_KEY',
    url: 'YOUR_API_URL',
    e2eeUrl: 'YOUR_E2EE_URL',
  },
});
```

❗{/* [SME input needed: confirm where customers obtain the `e2eeUrl` value. Is it provided by Incode, configured on the Dashboard, or generated by the customer's backend? Source-level review couldn't answer this; it's an ops/backend question.] */}

## Enable E2EE on a session

Set `e2eEncryptionEnabled: true` on the `sessionConfig` for any session that should use end-to-end encryption:

```ts
const sessionConfig = {
  e2eEncryptionEnabled: true,
};
```

`sessionConfig` has the same shape across `startOnboarding()`, `startOnboardingSection()`, `startFlow()`, `startWorkflow()`, and `setupOnboardingSession()`, so this flag applies the same way to all of them. Pass it when setting up an onboarding session or when starting a flow:

```ts
await IncodeSdk.setupOnboardingSession({ sessionConfig });

await IncodeSdk.startOnboarding({
  sessionConfig,
  flowConfig,
});
```

## Enable E2EE for Face Login

`startFaceLogin()` is not part of the onboarding `sessionConfig` and takes its own `e2eeEncryptionEnabled` parameter directly in its config object (note the double "e" - this is a separate flag from the onboarding session's `e2eEncryptionEnabled`):

```ts
await IncodeSdk.startFaceLogin({
  showTutorials: true,
  e2eeEncryptionEnabled: true,
});
```

See [Face Login](../react-native-face-login.md) for the full API.