---
title: "End-to-End Encryption"
url: "https://developer.incode.com/sdk-reference/android-e2ee/"
section: "sdk-reference"
group: "Android SDK / Android Getting Started"
version: "v1.1"
status: "live"
---
# End-to-End Encryption

End-to-end encryption (E2EE) adds an extra layer of security by encrypting the data transmitted between the server and client. The process begins with a key exchange; the client and server share keys for encrypting and decrypting messages. This exchange ensures all later communications are encrypted. Only the intended server and client can decrypt the messages.

***

## Security

The Incode Android SDK uses the Android platform's standard cryptographic APIs (`javax.crypto`) for all cryptographic operations:

- RSA-OAEP with SHA-256 asymmetric encryption for secure key exchange
- AES-GCM symmetric encryption for securing server requests and responses

***

## Enable End-to-End Encryption

Complete the following steps in order.

### Set Up a Custom Server for E2EE

Initialize the Welcome SDK with a custom server for E2EE, supplying the `E2EE_URL`:

```kotlin
IncodeWelcome.Builder(this, WELCOME_API_URL, WELCOME_API_KEY, E2EE_URL)
    .build()
```
```java
new IncodeWelcome.Builder(this, WELCOME_API_URL, WELCOME_API_KEY, E2EE_URL)
    .build();
```

### Enable E2EE via SessionConfig

Turn on E2EE when building your `SessionConfig`:

```kotlin
val sessionConfig: SessionConfig = SessionConfig.Builder()
    .setE2eEncryptionEnabled(true)
    .build()
```
```java
SessionConfig sessionConfig = new SessionConfig.Builder()
    .setE2eEncryptionEnabled(true)
    .build();
```

### Start Onboarding

Pass the `SessionConfig` to [startOnboarding](/sdk-reference/android-configure-flows-locally-and-run-end-to-end/), [setupOnboardingSession](/sdk-reference/android-configure-flows-locally-and-run-step-by-step/), [startFlow](/sdk-reference/android-run-flows-configured-online/), or [startWorkflow](/sdk-reference/android-run-flows-configured-online/), depending on your integration approach.

<br />