---
title: "MTE Relay V5: what changes for your business"
description: "A plain language brief for executives on what MTE Relay V5 improves over V4: stronger message protection, less overhead, a management console for the whole fleet, and new WebSocket and TCP products on the same protocol."
canonical: https://tmp.trevorblackman.dev/relay-v5-exec/
markdown: https://tmp.trevorblackman.dev/relay-v5-exec/index.md
generated: 2026-09-16 from index.html
---

# MTE Relay V5: what changes for your business

Summary

## Stronger, leaner, easier to run, and it covers more of your traffic

MTE Relay V5 keeps everything that works in V4 and rebuilds the parts customers asked us to improve. The whole story fits in four cards.

Stronger

#### Every message is checked before it is used

V4 verifies a stream when it ends. V5 verifies every message the moment it arrives, and it locks the request type and the response status inside the encryption so nobody in the middle can change them.

Leaner

#### Less overhead on every request

A compact binary format replaces text encoding and custom headers. Typical requests carry an estimated 35 to 47 percent less protection overhead and one fewer cryptographic operation.

Easier to run

#### One console for the whole fleet

Change settings live, see every relay's status, roll back a bad change in one click, and automate safely with scoped tokens. Customers who have previewed it call it the standout feature.

Wider reach

#### Web APIs, live WebSocket traffic, and TCP applications

The same protocol now powers SocketX V2 for real time apps and TCPQ for SSH, file transfer, mail, and databases, without changing those applications.

<figure class="fig">
<img src="data:image/svg+xml;base64,PHN2ZyB2aWV3Ym94PSIwIDAgMTAwMCAyNTAiIHdpZHRoPSIxMDAlIiByb2xlPSJpbWciIGFyaWEtbGFiZWw9IlRocmVlIGxhbmVzIHNob3dpbmcgd2ViIGFwcHMgdGhyb3VnaCBNVEUgUmVsYXkgVjUsIGxpdmUgYXBwcyB0aHJvdWdoIFNvY2tldFggVjIsIGFuZCBUQ1AgYXBwbGljYXRpb25zIHRocm91Z2ggVENQUSwgYWxsIG9uIG9uZSBwcm90b2NvbCI+CiAgICAgIDxkZWZzPjxtYXJrZXIgaWQ9ImFyciIgdmlld2JveD0iMCAwIDEwIDEwIiByZWZ4PSI5IiByZWZ5PSI1IiBtYXJrZXJ3aWR0aD0iNyIgbWFya2VyaGVpZ2h0PSI3IiBvcmllbnQ9ImF1dG8tc3RhcnQtcmV2ZXJzZSI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBmaWxsPSJ2YXIoLS1pbmstMykiIC8+PC9tYXJrZXI+PC9kZWZzPgogICAgICA8dGV4dCB4PSIyMCIgeT0iMjgiIGNsYXNzPSJzbSI+V0hBVCBZT1UgUlVOPC90ZXh0Pjx0ZXh0IHg9IjQwMCIgeT0iMjgiIGNsYXNzPSJzbSI+RUNMWVBTRVMgUFJPRFVDVDwvdGV4dD48dGV4dCB4PSI3NzAiIHk9IjI4IiBjbGFzcz0ic20iPldIQVQgSVQgUFJPVEVDVFM8L3RleHQ+CiAgICAgIDxyZWN0IHg9IjIwIiB5PSI0MiIgd2lkdGg9IjMwMCIgaGVpZ2h0PSI0NiIgcng9IjgiIGNsYXNzPSJib3ggYWNjIiAvPjx0ZXh0IHg9IjE3MCIgeT0iNzAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIGNsYXNzPSJsYmwiPldlYiBhbmQgbW9iaWxlIGFwcHM8L3RleHQ+CiAgICAgIDxsaW5lIHgxPSIzMjIiIHkxPSI2NSIgeDI9IjM5NSIgeTI9IjY1IiBjbGFzcz0iYXJyb3ciIG1hcmtlci1lbmQ9InVybCgjYXJyKSI+PC9saW5lPgogICAgICA8cmVjdCB4PSI0MDAiIHk9IjQyIiB3aWR0aD0iMzMwIiBoZWlnaHQ9IjQ2IiByeD0iOCIgY2xhc3M9ImJveCBoaSIgLz48dGV4dCB4PSI1NjUiIHk9IjcwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBjbGFzcz0ibGJsIj5NVEUgUmVsYXkgVjUgKEhUVFApPC90ZXh0PgogICAgICA8bGluZSB4MT0iNzMyIiB5MT0iNjUiIHgyPSI3NjUiIHkyPSI2NSIgY2xhc3M9ImFycm93IiBtYXJrZXItZW5kPSJ1cmwoI2FycikiPjwvbGluZT4KICAgICAgPHJlY3QgeD0iNzcwIiB5PSI0MiIgd2lkdGg9IjIxMCIgaGVpZ2h0PSI0NiIgcng9IjgiIGNsYXNzPSJib3giIC8+PHRleHQgeD0iODc1IiB5PSI3MCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgY2xhc3M9ImluayI+WW91ciBBUElzPC90ZXh0PgogICAgICA8cmVjdCB4PSIyMCIgeT0iMTEyIiB3aWR0aD0iMzAwIiBoZWlnaHQ9IjQ2IiByeD0iOCIgY2xhc3M9ImJveCBhY2MiIC8+PHRleHQgeD0iMTcwIiB5PSIxNDAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIGNsYXNzPSJsYmwiPkxpdmUgYXBwczogY2hhdCwgZGFzaGJvYXJkczwvdGV4dD4KICAgICAgPGxpbmUgeDE9IjMyMiIgeTE9IjEzNSIgeDI9IjM5NSIgeTI9IjEzNSIgY2xhc3M9ImFycm93IiBtYXJrZXItZW5kPSJ1cmwoI2FycikiPjwvbGluZT4KICAgICAgPHJlY3QgeD0iNDAwIiB5PSIxMTIiIHdpZHRoPSIzMzAiIGhlaWdodD0iNDYiIHJ4PSI4IiBjbGFzcz0iYm94IGhpIiAvPjx0ZXh0IHg9IjU2NSIgeT0iMTQwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBjbGFzcz0ibGJsIj5Tb2NrZXRYIFYyIChXZWJTb2NrZXQpPC90ZXh0PgogICAgICA8bGluZSB4MT0iNzMyIiB5MT0iMTM1IiB4Mj0iNzY1IiB5Mj0iMTM1IiBjbGFzcz0iYXJyb3ciIG1hcmtlci1lbmQ9InVybCgjYXJyKSI+PC9saW5lPgogICAgICA8cmVjdCB4PSI3NzAiIHk9IjExMiIgd2lkdGg9IjIxMCIgaGVpZ2h0PSI0NiIgcng9IjgiIGNsYXNzPSJib3giIC8+PHRleHQgeD0iODc1IiB5PSIxNDAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIGNsYXNzPSJpbmsiPlJlYWwgdGltZSBzZXJ2aWNlczwvdGV4dD4KICAgICAgPHJlY3QgeD0iMjAiIHk9IjE4MiIgd2lkdGg9IjMwMCIgaGVpZ2h0PSI0NiIgcng9IjgiIGNsYXNzPSJib3ggYWNjIiAvPjx0ZXh0IHg9IjE3MCIgeT0iMjEwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBjbGFzcz0ibGJsIj5TU0gsIFNGVFAsIG1haWwsIGRhdGFiYXNlczwvdGV4dD4KICAgICAgPGxpbmUgeDE9IjMyMiIgeTE9IjIwNSIgeDI9IjM5NSIgeTI9IjIwNSIgY2xhc3M9ImFycm93IiBtYXJrZXItZW5kPSJ1cmwoI2FycikiPjwvbGluZT4KICAgICAgPHJlY3QgeD0iNDAwIiB5PSIxODIiIHdpZHRoPSIzMzAiIGhlaWdodD0iNDYiIHJ4PSI4IiBjbGFzcz0iYm94IGhpIiAvPjx0ZXh0IHg9IjU2NSIgeT0iMjEwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBjbGFzcz0ibGJsIj5UQ1BRIFYxIChUQ1AgdHVubmVsKTwvdGV4dD4KICAgICAgPGxpbmUgeDE9IjczMiIgeTE9IjIwNSIgeDI9Ijc2NSIgeTI9IjIwNSIgY2xhc3M9ImFycm93IiBtYXJrZXItZW5kPSJ1cmwoI2FycikiPjwvbGluZT4KICAgICAgPHJlY3QgeD0iNzcwIiB5PSIxODIiIHdpZHRoPSIyMTAiIGhlaWdodD0iNDYiIHJ4PSI4IiBjbGFzcz0iYm94IiAvPjx0ZXh0IHg9Ijg3NSIgeT0iMjEwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBjbGFzcz0iaW5rIj5JbnRlcm5hbCBzZXJ2ZXJzPC90ZXh0PgogICAgICA8dGV4dCB4PSI1NjUiIHk9IjI0NiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgY2xhc3M9InNtIj5PbmUgcHJvdG9jb2wgKGZyYW1lIHZlcnNpb24gMikgdW5kZXIgYWxsIHRocmVlLCBlYWNoIHJlbGVhc2VkIGFzIGl0cyBvd24gcHJvZHVjdDwvdGV4dD4KICAgIDwvc3ZnPg==" />
<figcaption>V4 protects HTTP traffic. V5's protocol was built to carry HTTP, WebSocket, and TCP, and each transport ships as its own product on its own schedule.</figcaption>
</figure>

Control plane

## One console for the whole fleet

V4 relays are configured with environment variables and restarted to change anything. V5 adds a control plane with a web console and an API that manage every relay you run, on any platform. This is the feature customers who have previewed V5 ask about first, and the one they say they want in production tomorrow.

<figure class="fig">
<img src="data:image/svg+xml;base64,PHN2ZyB2aWV3Ym94PSIwIDAgMTAwMCA0MDAiIHdpZHRoPSIxMDAlIiByb2xlPSJpbWciIGFyaWEtbGFiZWw9IklsbHVzdHJhdGlvbiBvZiB0aGUgY29udHJvbCBwbGFuZSBjb25zb2xlOiBhIHNpZGViYXIgd2l0aCBEYXNoYm9hcmQsIEZsZWV0LCBQcm94aWVzLCBDb25maWd1cmF0aW9uLCBhbmQgSGlzdG9yeSwgZm91ciBzdGF0dXMgdGlsZXMsIGFuZCBhIGZsZWV0IHRhYmxlIHdpdGggc3RhdHVzIGJhZGdlcyI+CiAgICAgIDxyZWN0IHg9IjEwIiB5PSIxMCIgd2lkdGg9Ijk4MCIgaGVpZ2h0PSIzODAiIHJ4PSIxMiIgY2xhc3M9ImJveCIgLz4KICAgICAgPHJlY3QgeD0iMTAiIHk9IjEwIiB3aWR0aD0iMjAwIiBoZWlnaHQ9IjM4MCIgcng9IjEyIiBjbGFzcz0iYm94IGhpIiAvPgogICAgICA8dGV4dCB4PSIzMCIgeT0iNDYiIGNsYXNzPSJsYmwiPlJlbGF5IENvbnRyb2wgUGxhbmU8L3RleHQ+CiAgICAgIDx0ZXh0IHg9IjMwIiB5PSI5MCIgY2xhc3M9ImluayI+RGFzaGJvYXJkPC90ZXh0PgogICAgICA8cmVjdCB4PSIyMiIgeT0iMTA0IiB3aWR0aD0iMTc2IiBoZWlnaHQ9IjMwIiByeD0iNiIgZmlsbD0idmFyKC0tczEpIiBmaWxsLW9wYWNpdHk9IjAuMjIiIC8+PHRleHQgeD0iMzAiIHk9IjEyNCIgY2xhc3M9ImxibCI+RmxlZXQ8L3RleHQ+CiAgICAgIDx0ZXh0IHg9IjMwIiB5PSIxNjIiIGNsYXNzPSJpbmsiPlByb3hpZXM8L3RleHQ+CiAgICAgIDx0ZXh0IHg9IjMwIiB5PSIxOTgiIGNsYXNzPSJpbmsiPkNvbmZpZ3VyYXRpb248L3RleHQ+CiAgICAgIDx0ZXh0IHg9IjMwIiB5PSIyMzQiIGNsYXNzPSJpbmsiPkhpc3Rvcnk8L3RleHQ+CiAgICAgIDx0ZXh0IHg9IjMwIiB5PSIzNzIiIGNsYXNzPSJzbSI+U2lnbiBvdXQ8L3RleHQ+CiAgICAgIDx0ZXh0IHg9IjIzNiIgeT0iNDYiIGNsYXNzPSJsYmwiPkZsZWV0PC90ZXh0Pjx0ZXh0IHg9IjIzNiIgeT0iNjYiIGNsYXNzPSJzbSI+TGl2ZSB3b3JrZXIgc3RhdHVzLCB2ZXJzaW9ucywgYW5kIGNvbmZpZyBzeW5jLiBSZWZyZXNoZXMgZXZlcnkgNSBzZWNvbmRzLjwvdGV4dD4KICAgICAgPHJlY3QgeD0iMjM2IiB5PSI4NCIgd2lkdGg9IjE3MCIgaGVpZ2h0PSI2NCIgcng9IjgiIGNsYXNzPSJib3giIC8+PHRleHQgeD0iMjUwIiB5PSIxMDYiIGNsYXNzPSJzbSI+V09SS0VSUyBPTkxJTkU8L3RleHQ+PHRleHQgeD0iMjUwIiB5PSIxMzYiIGNsYXNzPSJsYmwiIHN0eWxlPSJmb250LXNpemU6MjJweCI+NjwvdGV4dD4KICAgICAgPHJlY3QgeD0iNDIwIiB5PSI4NCIgd2lkdGg9IjE3MCIgaGVpZ2h0PSI2NCIgcng9IjgiIGNsYXNzPSJib3giIC8+PHRleHQgeD0iNDM0IiB5PSIxMDYiIGNsYXNzPSJzbSI+SU4gU1lOQzwvdGV4dD48dGV4dCB4PSI0MzQiIHk9IjEzNiIgY2xhc3M9ImxibCIgc3R5bGU9ImZvbnQtc2l6ZToyMnB4Ij41LzY8L3RleHQ+CiAgICAgIDxyZWN0IHg9IjYwNCIgeT0iODQiIHdpZHRoPSIxNzAiIGhlaWdodD0iNjQiIHJ4PSI4IiBjbGFzcz0iYm94IiAvPjx0ZXh0IHg9IjYxOCIgeT0iMTA2IiBjbGFzcz0ic20iPkNPTkZJRyBWRVJTSU9OPC90ZXh0Pjx0ZXh0IHg9IjYxOCIgeT0iMTM2IiBjbGFzcz0ibGJsIiBzdHlsZT0iZm9udC1zaXplOjIycHgiPnY0MjwvdGV4dD4KICAgICAgPHJlY3QgeD0iNzg4IiB5PSI4NCIgd2lkdGg9IjE4MiIgaGVpZ2h0PSI2NCIgcng9IjgiIGNsYXNzPSJib3giIC8+PHRleHQgeD0iODAyIiB5PSIxMDYiIGNsYXNzPSJzbSI+UFJPWElFUzwvdGV4dD48dGV4dCB4PSI4MDIiIHk9IjEzNiIgY2xhc3M9ImxibCIgc3R5bGU9ImZvbnQtc2l6ZToyMnB4Ij40PC90ZXh0PgogICAgICA8cmVjdCB4PSIyMzYiIHk9IjE2OCIgd2lkdGg9IjczNCIgaGVpZ2h0PSIzMCIgcng9IjYiIGNsYXNzPSJib3giIC8+CiAgICAgIDx0ZXh0IHg9IjI1MCIgeT0iMTg4IiBjbGFzcz0ic20iPkhPU1Q8L3RleHQ+PHRleHQgeD0iNDMwIiB5PSIxODgiIGNsYXNzPSJzbSI+VkVSU0lPTjwvdGV4dD48dGV4dCB4PSI1NDAiIHk9IjE4OCIgY2xhc3M9InNtIj5VUFRJTUU8L3RleHQ+PHRleHQgeD0iNjQwIiB5PSIxODgiIGNsYXNzPSJzbSI+U1RBVFVTPC90ZXh0Pjx0ZXh0IHg9IjgwMCIgeT0iMTg4IiBjbGFzcz0ic20iPlBFTkRJTkcgUkVTVEFSVDwvdGV4dD4KICAgICAgPHRleHQgeD0iMjUwIiB5PSIyMjYiIGNsYXNzPSJpbmsiPnJlbGF5MDE8L3RleHQ+PHRleHQgeD0iNDMwIiB5PSIyMjYiIGNsYXNzPSJpbmsiPjUuMC4wPC90ZXh0Pjx0ZXh0IHg9IjU0MCIgeT0iMjI2IiBjbGFzcz0iaW5rIj4xMmQgNGg8L3RleHQ+CiAgICAgIDxyZWN0IHg9IjY0MCIgeT0iMjExIiB3aWR0aD0iNzIiIGhlaWdodD0iMjIiIHJ4PSIxMSIgZmlsbD0idmFyKC0tZ29vZCkiIGZpbGwtb3BhY2l0eT0iMC4xOCIgLz48dGV4dCB4PSI2NzYiIHk9IjIyNiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgY2xhc3M9Imdvb2QiIHN0eWxlPSJmb250LXNpemU6MTJweDtmb250LXdlaWdodDo2MDAiPmluIHN5bmM8L3RleHQ+CiAgICAgIDx0ZXh0IHg9IjI1MCIgeT0iMjYyIiBjbGFzcz0iaW5rIj5yZWxheTAyPC90ZXh0Pjx0ZXh0IHg9IjQzMCIgeT0iMjYyIiBjbGFzcz0iaW5rIj41LjAuMDwvdGV4dD48dGV4dCB4PSI1NDAiIHk9IjI2MiIgY2xhc3M9ImluayI+MTJkIDRoPC90ZXh0PgogICAgICA8cmVjdCB4PSI2NDAiIHk9IjI0NyIgd2lkdGg9IjcyIiBoZWlnaHQ9IjIyIiByeD0iMTEiIGZpbGw9InZhcigtLWdvb2QpIiBmaWxsLW9wYWNpdHk9IjAuMTgiIC8+PHRleHQgeD0iNjc2IiB5PSIyNjIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIGNsYXNzPSJnb29kIiBzdHlsZT0iZm9udC1zaXplOjEycHg7Zm9udC13ZWlnaHQ6NjAwIj5pbiBzeW5jPC90ZXh0PgogICAgICA8cmVjdCB4PSI4MDAiIHk9IjI0NyIgd2lkdGg9IjE1MCIgaGVpZ2h0PSIyMiIgcng9IjExIiBmaWxsPSJ2YXIoLS13YXJuKSIgZmlsbC1vcGFjaXR5PSIwLjE4IiAvPjx0ZXh0IHg9Ijg3NSIgeT0iMjYyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBjbGFzcz0id2FybiIgc3R5bGU9ImZvbnQtc2l6ZToxMnB4O2ZvbnQtd2VpZ2h0OjYwMCI+S1lCRVJfU1RSRU5HVEg8L3RleHQ+CiAgICAgIDx0ZXh0IHg9IjI1MCIgeT0iMjk4IiBjbGFzcz0iaW5rIj5yZWxheTAzPC90ZXh0Pjx0ZXh0IHg9IjQzMCIgeT0iMjk4IiBjbGFzcz0iaW5rIj41LjAuMDwvdGV4dD48dGV4dCB4PSI1NDAiIHk9IjI5OCIgY2xhc3M9ImluayI+M2ggMTJtPC90ZXh0PgogICAgICA8cmVjdCB4PSI2NDAiIHk9IjI4MyIgd2lkdGg9Ijk2IiBoZWlnaHQ9IjIyIiByeD0iMTEiIGZpbGw9InZhcigtLXdhcm4pIiBmaWxsLW9wYWNpdHk9IjAuMTgiIC8+PHRleHQgeD0iNjg4IiB5PSIyOTgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIGNsYXNzPSJ3YXJuIiBzdHlsZT0iZm9udC1zaXplOjEycHg7Zm9udC13ZWlnaHQ6NjAwIj5iZWhpbmQgKHY0MSk8L3RleHQ+CiAgICAgIDx0ZXh0IHg9IjI1MCIgeT0iMzM0IiBjbGFzcz0iaW5rIj5yZWxheTA0PC90ZXh0Pjx0ZXh0IHg9IjQzMCIgeT0iMzM0IiBjbGFzcz0iaW5rIj41LjAuMDwvdGV4dD48dGV4dCB4PSI1NDAiIHk9IjMzNCIgY2xhc3M9ImluayI+MTJkIDNoPC90ZXh0PgogICAgICA8cmVjdCB4PSI2NDAiIHk9IjMxOSIgd2lkdGg9IjcyIiBoZWlnaHQ9IjIyIiByeD0iMTEiIGZpbGw9InZhcigtLWdvb2QpIiBmaWxsLW9wYWNpdHk9IjAuMTgiIC8+PHRleHQgeD0iNjc2IiB5PSIzMzQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIGNsYXNzPSJnb29kIiBzdHlsZT0iZm9udC1zaXplOjEycHg7Zm9udC13ZWlnaHQ6NjAwIj5pbiBzeW5jPC90ZXh0PgogICAgICA8cmVjdCB4PSIyMzYiIHk9IjM1MiIgd2lkdGg9IjczNCIgaGVpZ2h0PSIyOCIgcng9IjYiIGNsYXNzPSJib3ggaGkiIC8+PHRleHQgeD0iMjUwIiB5PSIzNzEiIGNsYXNzPSJzbSBtb25vIj5BcHBseWluZyBwZW5kaW5nIHJlc3RhcnQgZmllbGRzOiBrdWJlY3RsIHJvbGxvdXQgcmVzdGFydCBkZXBsb3ltZW50L3JlbGF5PC90ZXh0PgogICAgPC9zdmc+" />
<figcaption>An illustration of the Fleet page. Every relay reports in every few seconds; the console shows who is current, who is behind, and which settings are waiting for a restart, with the exact restart command for your platform.</figcaption>
</figure>

#### See the fleet at a glance

The dashboard shows workers online, how many are in sync, the current configuration version, and how many domains are mapped. The Fleet page lists every relay with its version, uptime, last check in, and a status badge: in sync, behind, stale, or rejected.

#### Change settings without downtime

Domain routing, log level, body limits, and header forwarding apply across the fleet within seconds, with no restart. Other settings save immediately, carry a restart badge, and apply on the next restart. The console shows the restart command for Kubernetes, OpenShift, Swarm, Compose, ECS, or a plain server.

#### Undo in one click

Every save is a new version that records who changed what. The History page keeps the last 50 versions and rolls back to any of them as a new version, so nothing is ever lost.

#### Know what each relay is running

Expand any relay to see every setting's live value and where it came from: the console, the environment, or the default. Secrets never leave the relay. The console shows fingerprints so you can confirm two relays match without seeing the value.

#### Automate safely

Named, scoped service tokens with an expiry date let CI pipelines, GitOps jobs, support scripts, and AI agents read or change configuration through the same API the console uses. Every automated change shows in the audit log under its token name.

#### Safe by design

Edits are validated with a dry run before they save. Two admins cannot overwrite each other. A relay that cannot reach the console keeps serving its last good configuration. Light and dark themes, and a login page that loads instantly.

**Why it matters.** Configuration mistakes and slow change windows are the most common source of relay support tickets. The console turns a redeploy into a form field and a bad change into a one click rollback. It is optional: relays still run from environment variables alone.

Security

## Stronger protection of every message

The encryption engine (MTE and MKE) and the Kyber key exchange are the same technology V4 customers already trust. V5 changes how each message is packaged and checked, and closes gaps that existed between the encryption and the transport.

#### Checked message by message

V4 streams data through and confirms integrity when the stream ends, so a tampered chunk could reach an application before the check fails. V5 verifies every message before releasing any of it. Long downloads, live event feeds, and tunnels all get the same guarantee.

#### The request type and result cannot be altered in transit

In V4 the HTTP method and the response status travel outside the encryption. V5 locks both inside it. A GET cannot be turned into a DELETE at an intermediate hop, and an error cannot be dressed up as success.

#### All headers protected in both directions

V4 encrypts request headers but sends most response headers in the clear. V5 encrypts every header both ways, including cookies and authorization data, and keeps repeated headers intact.

#### Fake responses are blocked

If anything other than a genuine relay message comes back, such as a proxy error page, a firewall block page, or injected content, V5 clients refuse it. Applications never mistake it for a real answer.

#### Stronger key exchange

Kyber 1024 by default, the highest strength level, up from Kyber 512 in V4. The strength is configurable and advertised to clients, so a mismatch is caught at connection time with a clear message.

#### Abuse resistance

Rate limits on session setup, replay detection, size limits, and validation before any cryptographic work runs. V4 has none of these.

Performance

## Leaner on the wire, lighter on your servers

V4 wraps encrypted data in text encoding and custom headers. V5 sends compact binary frames. The result is fewer bytes and fewer cryptographic operations on every request, and bounded memory on large transfers.

V4 (4.7.0)V5 (frame version 2)

API read with a 512 byte reply

1,781 bytes

1,065 bytes

API write, 256 bytes each way

2,049 bytes

1,338 bytes

Small read with a 100 byte reply

1,716 bytes

1,065 bytes

Request answered with no body

1,483 bytes

792 bytes

Estimated protection overhead per request and response, derived from the two wire formats with identical application data. Measured V4 against V5 figures will follow before any percentage is published externally.

#### No text encoding

Base64 expands data by a third. V4 uses it for the encrypted path and headers. V5 removes it from the data path entirely.

#### Fewer operations

One encryption operation covers the path, method, and headers together. V4 uses two. Every request saves an operation on the client and another on the relay.

#### Bounded memory

Large uploads and downloads move in fixed size frames instead of being held in memory whole. Against the earlier prototype, a 1 GB upload ran faster while using about 4 percent of the memory.

#### Faster first byte

Response headers are sent the moment your backend answers, before the body, so live feeds and long polls open immediately.

#### Tunable streaming

Operators tune frame size and a short coalescing window per domain, trading a few milliseconds for far fewer bytes on high rate event streams.

#### Cheaper startup

The browser SDK opens one key pair instead of five and fills the rest in the background, so the first request leaves sooner and a phone uploads far less at page load.

Reliability

## Fewer surprises in production

Most V4 escalations are not cryptography problems. They are infrastructure misreading relay errors, sessions expiring while an app was idle, and configuration that could only be checked by reading logs. V5 addresses each.

#### Errors that play nicely with cloud infrastructure

V4 reports relay problems with unusual server error codes (559 to 569). Service meshes treat those as backend failures and eject relays, and CDNs replace the message with their own error page. V5 uses a dedicated block of client side codes with a plain reason attached, so meshes, CDNs, and proxies leave them alone and your dashboards read them correctly.

#### Self healing sessions

When one encrypted session goes bad, V5 repairs just that one instead of rebuilding everything. Idle apps keep sessions alive with a lightweight keepalive, so a mobile app returning from the background does not pay a full setup again.

#### Clients adapt to the server

At connection time the relay tells the SDK its limits, timeouts, and features. Mismatched versions or library builds are caught immediately with a message that names the fix.

#### Traceability

Every response, including errors and streams, carries a request id that matches the relay's logs, so support can go from a user report to the exact log line.

#### Timeouts that fit the workload

Request, response, idle, and heartbeat timeouts are set per domain, and slow uploads no longer die at a fixed wall clock limit.

#### Capacity that follows demand

Relay capacity grows with traffic instead of stopping at a fixed pool, and outbound sessions are kept warm and refilled in the background so bursts and long streams keep moving.

New transports

## Beyond web APIs: live traffic and TCP applications

V5's protocol was designed from the start to carry more than HTTP. Two products ride on it. Each is built, versioned, and released separately, and availability for each is announced on its own.

SocketX V2

#### Live WebSocket traffic

For chat, live dashboards, collaboration, trading screens, and any app that keeps a connection open. Each connection gets its own key pair, every message is verified individually, and long sessions rotate keys on a budget. The connection headers, cookies, and tokens travel inside the encryption. SocketX V1 customers get a new protocol generation: V1 and V2 do not interoperate, so client and server move together.

TCPQ V1

#### Existing TCP applications, unmodified

A small agent runs next to the application. The application connects to it locally and the agent tunnels the bytes to a relay that only connects to destinations you have approved. Fits SSH, SFTP, SMTP, IMAP, PostgreSQL, MySQL, SQL Server, MQTT, RDP to a host, and anything inside its own TLS. Each client holds an issued key that can be revoked, and revocation cuts live sessions within minutes.

**Plain limits.** TCP tunnels do not survive a relay upgrade, so sessions reconnect. Clustered systems that hand clients another address (Kafka, Redis Cluster, MongoDB replica sets, Oracle RAC) need one alias per node or do not fit. Active FTP and UDP are out. We say this before a proof of concept starts, not after.

Deployment and SDKs

## The same places you run it today, plus an open specification

#### Same deployment shapes

On premises images, AWS and Azure images, Docker Compose, Kubernetes, and an AKS extension. Images stay minimal with no shell inside.

#### One published specification

The protocol is a frozen, normative specification with a registry of reserved values and byte exact test vectors. Partner and third party SDKs build from the spec, not from our source, and every platform agrees byte for byte.

#### Version safety for years

Servers keep accepting the previous protocol version for 18 months after a new one ships, deprecations are announced a year ahead, and an old SDK always receives a precise message naming the minimum version.

#### SDKs

Browser SDK and public browser client (beta today), Go client, SocketX TypeScript client, C# in progress, and mobile SDKs to follow from the spec.

#### Test origin for your team

A published test origin image answers both HTTP and WebSocket so your developers can validate an integration before touching production.

#### Diagnostics on demand

Structured events, opt in profiling, and per stage timing are available when you need them and cost nothing when you do not.

Upgrade planning

## What the upgrade involves

V5 is a new protocol generation, so it is a coordinated upgrade rather than an image swap. The work is well defined and each step is short.

1.  **Upgrade servers and SDKs together.** V4 SDKs cannot talk to a V5 relay; they receive a clear message naming the minimum version. Plan a short cutover window per application.
2.  **Update monitoring.** Alerts keyed on the old 559 to 569 codes move to the new 470 to 490 block, which also comes with a readable reason.
3.  **Expect sessions to re establish.** Existing encrypted sessions are not migrated. Clients pair again automatically on first use.
4.  **Review configuration.** The single upstream setting is retired in favor of the domain map, and a few settings are renamed. The console shows the full schema with descriptions and defaults.
5.  **Decide on the console.** It is optional. Relays run from environment variables alone if you prefer, and the console can be added later without touching traffic.
6.  **Pilot the new transports separately.** SocketX V2 and TCPQ have their own release schedules and their own acceptance tests.

Straight talk

## What we are not claiming yet

- No "V5 is X times faster than V4" figure. The overhead reductions above are derived from the two formats. Measured V4 against V5 numbers will be published once the benchmark runs on identical hardware.
- Sticky "owner mode" with in memory state, and encrypted session state at rest, are designed and reviewed but not in this release. Multi replica deployments still use Redis.
- TCP tunnels do not yet rotate keys mid session and do not survive a relay upgrade.
- The HTTP relay upgrade does not include WebSocket or TCP support by itself. SocketX V2 and TCPQ are separate products with separate release dates.
- Kyber key exchange, streaming, multi tenant routing, and marketplace images are not new. V5 strengthens and extends them.