# Production Usage (Cloud Relay)

In production builds, Metro isn't available. The cloud relay enables AI agents to control the app over the network.

## Architecture

```
┌──────────┐        ┌───────────────┐        ┌──────────────┐
│  CLI /   │◄──WS──►│  Relay Server │◄──WS──►│   RN App     │
│ AI Agent │        │  (Node.js)    │        │ (production) │
└──────────┘        └───────────────┘        └──────────────┘
```

## 1. Start the Relay Server

```bash
# Default port 8347
npx react-native-agentkit-relay

# Custom port
npx react-native-agentkit-relay --port=9000
```

## 2. Configure the App

```tsx
<AgentKitProvider
  relayUrl="ws://your-relay-host:8347"
  channelId="my-app"
  channelSecret="your-shared-secret"
>
  <YourApp />
</AgentKitProvider>
```

## 3. Connect via CLI

```bash
# Interactive REPL
npx react-native-agentkit connect --relay=ws://your-relay-host:8347 --channel=my-app --secret=your-shared-secret

# Execute a command
npx react-native-agentkit exec list --relay=ws://your-relay-host:8347 --channel=my-app --secret=your-shared-secret

# Pipe mode (for AI agents)
echo '{"cmd":"list"}' | npx react-native-agentkit pipe --relay=ws://your-relay-host:8347 --secret=your-shared-secret
```

## Authentication

The relay supports shared-secret authentication to prevent unauthorized access:

- **Dev mode (default):** Auth is optional. If no secret is set, anyone can connect to the channel.
- **Production:** Set `channelSecret` in the app and `--secret` in the CLI. The first client to join a channel with a secret "locks" that channel — subsequent clients must present matching secrets.
- **Enforced auth:** Start the relay with `--require-auth` to reject all unauthenticated connections.

```bash
# Start relay with enforced auth
npx react-native-agentkit-relay --require-auth
```

> 💡 **Tip**: Use a unique `channelId` + `channelSecret` per app/device for isolation and security.