Skip to content

docs(blog): invite-link shared terminals are end to end now #85

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kipavy merged 1 commit into from
Oct 7, 2026
Merged

docs(blog): invite-link shared terminals are end to end now #85

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 7 additions & 5 deletions landing/content/blog/shared-terminals.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
---
title: "Share a Live Terminal, Hand Over the Keyboard"
description: "A shared terminal in Voltius is read-only for guests by default and hands control over one request at a time. Here's how inviting, watching, requesting and revoking work, and which invites are end-to-end encrypted."
description: "A shared terminal in Voltius is read-only for guests by default and hands control over one request at a time. Here's how inviting, watching, requesting and revoking work, and why the server can't read any of them."
date: "2026-10-06"
category: "Product"
tags:
Expand Down Expand Up @@ -44,12 +44,14 @@ If you're on another tab when the request comes in, it arrives as a notification

Every shared session gets a fresh 256-bit key. Output and input are sealed with XChaCha20-Poly1305 on the sending device and opened on the receiving one, and the relay server only ever moves ciphertext, including the history it keeps so late joiners can catch up.

How a guest gets that key decides who could read the session:
The key never reaches the server either. It is wrapped separately for each guest's public key, so only that guest's devices can unwrap it:

- **People** and **Team vault** invites are end to end. The key is wrapped separately for each invited person's public key, so only their devices can unwrap it. The server can't read the session.
- An **invite link** works for whoever holds it, so the server keeps that session's key and hands it to anyone who opens the link. The stream is still encrypted on the wire, but the server could read a link session.
- **People** and **Team vault** invites wrap the key for each invited person when you send the invite.
- An **invite link** only lets a guest in. Once they join, your Voltius wraps the key for them, and their bar reads **Waiting for the host…** for the moment that takes. The link itself never carries the key.

For anything sensitive, invite people by handle or through a team vault.
Anyone holding the link can still join, so send it only to people you would share the session with. What the link no longer does is let the server read the session.

Link sessions hosted from Voltius 0.49.1 or earlier still keep their key on the server. Update to the latest version to make them end to end.

## Plans

Expand Down
Loading