Skip to main content

Server config

In trio, mobile talks to "first" server, over a single websocket endpoint. The "second" server is used in inter-server communication, during keygen and recovery, hence not exposed to mobile. By default the endpoint points at the public demo:

PurposeDefault value
MPC websocket (WebsocketConfig.url)trio-server.demo.silencelaboratories.com (port 443, TLS)
Cloud verifying key9c4c79e942bbc3ff1d6ace7256404d701498056978cc4638c35832acdf821b1e

You'll typically swap these for one of three reasons: pointing at your own dev servers, running locally for hacking, or moving to a production deployment of your own.

Unlike duo, trio does not call an HTTP endpoint for export — session.export(keyId) runs entirely over the websocket, so there is no DEMO_SERVER_HTTP_URL to configure.

Where the values live

The websocket URL, port, and cloud verifying key are all defined in VaultSessionManager.

vault/.../session/VaultSessionManager.kt
companion object {
    private const val DEMO_SERVER_URL = "trio-server.demo.silencelaboratories.com"
    private const val DEMO_SERVER_PORT = 443
    private const val CLOUD_VERIFYING_KEY =
        "9c4c79e942bbc3ff1d6ace7256404d701498056978cc4638c35832acdf821b1e"
}

private val websocketConfig = WebsocketConfig(
    url = DEMO_SERVER_URL,
    port = DEMO_SERVER_PORT,
    isSecure = true,
)

Configuring the WebsocketConfig endpoint

WebsocketConfig accepts the endpoint two ways — the demo config above uses the host-plus-parts form so the TLS scheme is explicit:

// Full URL — used verbatim; port and isSecure are ignored.
WebsocketConfig(url = "wss://your-server.com")

// Host + parts — the scheme and port are composed from isSecure and port.
WebsocketConfig(url = "your-server.com", port = 443, isSecure = true)  // -> wss://your-server.com:443
WebsocketConfig(url = "10.0.2.2", port = 8080, isSecure = false)       // -> ws://10.0.2.2:8080 (local dev)

// Optional token, sent as the first message once connected (e.g. a JWT).
WebsocketConfig(url = "wss://your-server.com", authenticationToken = "<jwt>")

port and isSecure (default true) apply only when url has no scheme; a full ws:///wss:// URL is used as-is.

Pointing at local Trio servers

Trio runs two server processes (first and second) instead of duo's one. The full local-setup walkthrough — Docker compose file, environment variables, and the script that prints the cloud verifying key — is in Get started with Trio Servers. Read that first; it ends with both containers up and a verifying key in the logs.

Once your local servers are running, change two values in the example — mobile only ever connects to the first server:

  1. Vault websocket URL (VaultSessionManager.<DEMO_SERVER_URL|demoServerUrl>) — point at your local first endpoint and set isSecure = false for a plaintext ws:// connection.
  2. Cloud verifying key (VaultSessionManager.<CLOUD_VERIFYING_KEY|cloudVerifyingKey>) — copy the hex string the first server prints on startup. The handshake fails silently if this doesn't match.

The Android emulator routes localhost to the emulator itself, so use 10.0.2.2 to reach servers on your host machine:

vault/.../session/VaultSessionManager.kt
private const val DEMO_SERVER_URL = "10.0.2.2"
private const val DEMO_SERVER_PORT = 8080
private const val CLOUD_VERIFYING_KEY = "<hex from first server logs>"
// ...
private val websocketConfig = WebsocketConfig(url = DEMO_SERVER_URL, port = DEMO_SERVER_PORT, isSecure = false)