Create a project key

A project key (projectKey) connects your website or app to relyo.de. You create it yourself, with no account and no email: through your coding agent via the MCP server, via the API, or with a single curl.

Creating a project returns two values:

• key (pk_…): public, goes into Relyo.init({ projectKey }).
• manageToken (rpm_…): secret, shown only once. You need it to change origins and the name, rotate the key or delete the project. Keep it in a password manager or secret store, never in code or the repository.

With a coding agent (MCP)

relyo.de runs an MCP server at https://relyo.de/mcp (Streamable HTTP, no sign-in). Add it to Claude Code like this:

claude mcp add --transport http relyo https://relyo.de/mcp

Other agents (Cursor, VS Code, Windsurf …) add it to their MCP configuration:

{
  "mcpServers": {
    "relyo": { "type": "http", "url": "https://relyo.de/mcp" }
  }
}

Then just ask, for example: “Use the Relyo MCP server to create a project for https://example.com and add Relyo.” The server offers these tools:

Tool	Effect
create_project	create a project, returns key and manageToken
get_project	show the project
update_project	rename it or replace the list of origins
rotate_project_key	issue a new key; the old one stops working immediately
delete_project	delete the project; the key stops working, sessions end

Via the API

curl -X POST https://relyo.de/api/projects \
  -H 'content-type: application/json' \
  -d '{"name": "My shop", "origins": ["https://example.com", "https://www.example.com"]}'

Response (201):

{
  "key": "pk_3f9c0a71d2e84b5c6a10",
  "name": "My shop",
  "origins": ["https://example.com", "https://www.example.com"],
  "limits": { "maxSessions": 3, "maxSessionMinutes": 60, "idleMinutes": 10 },
  "createdAt": "2026-10-25T13:00:00.000Z",
  "updatedAt": "2026-10-25T13:00:00.000Z",
  "manageToken": "rpm_…"
}

Manage it with the manageToken as a bearer token:

Request	Effect
GET /api/project	show the project
PATCH /api/project	change name and/or origins (the list is replaced)
POST /api/project/rotate-key	issue a new key, the token stays
DELETE /api/project	delete the project

curl -X PATCH https://relyo.de/api/project \
  -H "authorization: Bearer $RELYO_MANAGE_TOKEN" \
  -H 'content-type: application/json' \
  -d '{"origins": ["https://example.com", "https://staging.example.com"]}'

The full description is available as OpenAPI.

Origins

• Websites: add every address the SDK loads from, meaning scheme, host and port without a path (https://example.com, https://www.example.com, http://localhost:5173 for development). At most 20.
• Flutter and native apps send no origin and need no entry. A project without origins works for apps only.
• If a page connects from an origin that is not listed, relyo.de rejects it and the SDK shows “Der Support-Code konnte nicht angefordert werden.” (the support code could not be requested).

Limits on relyo.de

Self-created projects use the free demo service without warranty (see terms of use):

• at most 3 concurrent sessions per project, each at most 60 minutes, ending after 10 minutes without activity;
• sessions start only via the code the user reads out (no device list);
• at most 10 new projects per hour and address.

The response lists the current values under limits. If you need more, run the relay yourself.

Lost or leaked key

The key is part of your website’s or app’s code anyway; it is not a secret. The list of origins stops other websites from using it. To replace it anyway, use rotate_project_key or POST /api/project/rotate-key and ship the new key.

If you lose the manageToken, the project can no longer be changed. Create a new one instead.