Security and network model

RelayTV is local-first, not security-free. It can start playback, accept media, control a display, and connect to other services. Treat it as a capable local service.

Trusted-LAN default

Without RELAYTV_API_TOKEN, compatible local clients keep working without an account or login. This is intended for a network whose members are already trusted.

Do not expose the unauthenticated API directly to the public internet.

Optional bearer token

Set RELAYTV_API_TOKEN in the runtime environment to require compatible clients to send:

Authorization: Bearer YOUR_TOKEN

The token is an operator secret. Keep it out of settings files, screenshots, logs, shell history, URLs, and source control.

Remote access

Prefer one of these patterns:

1. a trusted VPN into the home network
2. an authenticated HTTPS reverse proxy plus the RelayTV API token
3. a network policy that restricts access to known controller subnets

Automatic mDNS discovery generally stays local to one broadcast domain. Add the server URL manually when a routed or VPN network does not relay discovery.

Upstream credentials

Jellyfin, Emby, Seerr, and other integrations have their own credentials and trust models. Scope each credential to its task, rotate it after accidental exposure, and avoid placing credential-bearing media URLs in automation logs.

Privacy claims

The RelayTV application has no RelayTV account, advertising SDK, or app telemetry. The public relaytv.app website uses cookieless Matomo analytics to measure pages and installer downloads; that is separate from the installed app.

Canonical server source: installation network model and repository security constraints. Reviewed 2026-08-29.