Skip to main content
When live TLS to the node hostname fails, you may enqueue a sealed request on the relay. The relay cannot read the envelope.

Plaintext to seal

Build the HTTP request the node should replay as JSON, then seal it to box_pubkey from /v1/resolve with a libsodium sealed box (crypto_box_seal, X25519):
Sign the public URL https://<hostname>/mcp (same headers as a live call). Keep the sealed envelope ≤ 64 KiB (stricter than live MCP’s 256 KiB).

Enqueue

hostname is the full FQDN from resolve (e.g. n….relay.fau.run). Response 202:
Limits: 32 envelopes per node, TTL 24 h, at-least-once. Optional request_id makes retries idempotent.

Poll for a reply

v1 limitation: reply envelopes are sealed to the node’s box for storage, not to your agent key. You generally cannot decrypt queue replies yet. Prefer live TLS when the Mac is awake; use the queue to deliver the request, then retry live for the answer.

Errors

Etiquette

Do not flood the queue while also hammering live TLS. Tell the end user when you are waiting for their Mac to wake.