Skip to content
KB-1 Docs

Move from local-only to Cloud relay

Use this when you already have a KB-1 daemon running locally and now want the full self-hosted experience: Cloud login, organization membership, signed entry, and relay routing. Your machine remains the vault home.

What changes

Section titled “What changes”
  • You sign in through KB-1 Cloud.
  • The organization records and access checks live in Cloud.
  • The daemon receives relay configuration.
  • Cloud can route authorized people and agents to the daemon.

What does not change

Section titled “What does not change”
  • The vault files stay under your daemon state directory.
  • The daemon remains the content authority.
  • Local MCP stays available for local agents.
  • You still own backups, machine lifecycle, and local security.

Before you begin

Section titled “Before you begin”
  1. Start the daemon locally and open the vault.
  2. Flush pending writes before changing runtime configuration:
Terminal window
curl -fsS -X POST http://127.0.0.1:7382/api/vaults/<vault-id>/ops/flush
  1. Back up the vault folder under $KB1_HOME/vaults/<vault-id>.
  2. Sign in to KB-1 Cloud and choose or create the self-hosted organization.

Register relay access

Section titled “Register relay access”

The launch build exposes relay registration through an authenticated API and operator provisioning path, not a self-service dashboard flow. If you do not already have a self-hosted organization id and relay token, ask the KB-1 launch operator to provision the organization and mint the daemon key.

The supported registration route is:

POST /api/orgs/<org-id>/vaults/relay

It returns the daemon-scoped relay token once. Use that token and the org id to set both relay environment variables together:

Terminal window
export KB1_RELAY_URL="https://api.kb-1.ai/t/<org-id>"
export KB1_RELAY_TOKEN="<daemon-key-from-registration>"

Then restart the daemon using the same KB1_HOME as before. Do not create a new empty state directory unless you are intentionally starting a new vault home. See the self-hosted quickstart for the full API registration example.

Verify the relay

Section titled “Verify the relay”

Check the local daemon first:

Terminal window
curl -fsS http://127.0.0.1:7382/api/health
curl -fsS http://127.0.0.1:7382/api/relay/status
curl -fsS http://127.0.0.1:7382/api/vaults

The relay status should show relay.configured: true and, after the daemon connects, relay.controlConnected: true.

Then sign in to Cloud and open the self-hosted vault from the organization. The success signal is that Cloud opens the same vault content you saw locally.

Rollback

Section titled “Rollback”

Stop the daemon, remove KB1_RELAY_URL and KB1_RELAY_TOKEN from the runtime environment, and restart. The daemon returns to local-only behavior against the same local vault files.

Section titled “Related pages”