Encrypted API relay with replay protection.
CRelay protects sensitive API payloads beyond HTTPS with AES-256-GCM encryption, timestamp freshness, route-bound AAD, and encrypted responses.
Open SDK. Public protocol. Hosted enforcement.
HTTPS protects the pipe. CRelay protects the payload.
After TLS termination, sensitive payloads may still pass through logs, proxies, queues, and internal services. CRelay adds application-level payload protection and replay defense for sensitive API calls.
Once TLS terminates, your payload is plaintext inside infrastructure. Logs, queues, and proxies see everything.
Without replay protection, captured requests can be replayed. Identical payloads accepted twice means double charges, duplicate actions.
Without route-bound AAD, a valid encrypted payload may be accepted in the wrong context.
How it works
SDK encrypts request
Your client SDK encrypts the request payload with AES-256-GCM, binding the AAD to method, path, and tenant.
Gateway verifies AAD, freshness, and replay
The gateway checks timestamp freshness, validates the AAD matches the route, and rejects replays.
Gateway forwards to allowlisted upstream
Only pre-approved target URLs receive the decrypted request.
Gateway encrypts response back to SDK
The upstream response is encrypted with response-specific AAD before returning to the client.
CRelay operates within a trusted gateway boundary: the gateway decrypts requests to validate and forward them, then encrypts responses before they return to the SDK. This is how replay protection, AAD verification, and allowlist enforcement work in practice.
Security features
Authenticated encryption with 32-byte keys, 12-byte nonces, and 16-byte auth tags. Industry-standard envelope encryption.
Every request carries a unique nonce. The gateway rejects any nonce it has already seen within the freshness window.
Requests must arrive within a configurable freshness window (default 5 minutes). Stale envelopes are rejected.
Additional Authenticated Data binds each encryption to a specific method, path, and tenant. Prevents route confusion attacks.
Only pre-approved upstream URLs can receive forwarded requests. Prevents SSRF and unauthorized forwarding.
Responses are encrypted before returning to the SDK, using response-specific AAD (RESPONSE:/path:tenantId).
Built for developers
Open SDK. Public protocol. Hosted enforcement.
CRelay keeps the developer-facing parts transparent: the SDK, protocol, threat model, and quickstart are open for review. The hosted gateway provides the managed enforcement layer for replay protection, freshness validation, route-bound AAD, target allowlists, and encrypted responses.
Review the envelope format, AAD rules, freshness model, and threat assumptions.
Transparent enough to trust. Managed enough to be useful.