Tools Workflow Pricing Founders FAQ Docs About Get KeyFlow
Private Relay Server

Host your own review server.
Full data control.

Install a private KeyFlowStudio relay on your studio's own infrastructure. One command for Linux, one for Windows. No cloud, no third-party access, no data leaving your network.

One-line install Token-protected Web Share + Live Session Free & open
What you get

Two relays. One install.

The installer sets up both services as systemd units (Linux) or background processes (Windows). They start automatically on boot and restart on failure.

⚡

Web Share Relay

Clients and reviewers join review sessions through their browser with a link and access code. Synced timeline, annotations, chat, flag/approve.

TCP · port 9881
◆

Live Session Relay

App-to-app sync between animators' KeyFlowStudio instances. No browser needed. Lowest latency for on-team collaboration across the internet.

TCP · port 9877
🔒

Token-protected

Every room creation requires a shared secret token. No token means no room. Your studio, your rules. Rotate the token whenever you want.

Authorization: Bearer
Requirements

What you need.

OSUbuntu 22.04 / 24.04, Debian 12+
Accessroot / sudo
Python3.10 or newer (usually preinstalled)
Open ports9881/tcp, 9877/tcp
Resources1 CPU, 1 GB RAM minimum
OSWindows 10/11, Server 2019+
AccessAdministrator
Python3.8+ installed and in PATH
Open ports9881/tcp, 9877/tcp
RelaysWeb Share + Live Session
i
For 24/7 operation on Windows we recommend running the relays as Windows Services via NSSM. See Step 3 below.
Installation

Up and running in 60 seconds.

Pick your OS below. The installer downloads both relay servers, configures services, and starts them. Tokens are passed as a command-line argument.

1

Generate your token

The token is a secret string passed at install time. Anyone creating rooms on your relay needs this exact token. Make it long and random.

openssl rand -hex 32
-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 48 | ForEach-Object {[char]$_})
✓
Save this token in a password manager. You'll need it both at install time and inside KeyFlowStudio on every animator's machine.
2

Run the installer

One command sets up both relays. Replace YOUR_TOKEN with what you generated in Step 1.

curl -sL https://updates.keyflow.tools/updates/relay/install.sh | sudo bash -s YOUR_TOKEN

The installer will:

  • install Python 3, pip, and aiohttp
  • download both relay servers to /opt/keyflow-relay/
  • create keyflow-relay.service and keyflow-livesync.service
  • open firewall ports (if ufw is active)
  • enable autostart and start both services
curl -o install.bat https://updates.keyflow.tools/updates/relay/install-windows.bat install.bat YOUR_TOKEN

The installer will:

  • install aiohttp via pip
  • download both relay servers to C:\ProgramData\KeyFlowRelay\
  • create start-relay.bat and start-livesync.bat
  • add Windows Firewall rules for both ports
  • launch both relays in separate windows
3

Run as a service (Windows only)

On Linux, the installer already sets up systemd, skip this step. On Windows, the default start-relay.bat stops when you close its window. For 24/7 operation, register it as a Windows Service using NSSM.

:: Install both relays as Windows services nssm install KeyFlowRelay "C:\ProgramData\KeyFlowRelay\start-relay.bat" nssm install KeyFlowLivesync "C:\ProgramData\KeyFlowRelay\start-livesync.bat" nssm start KeyFlowRelay nssm start KeyFlowLivesync
4

Configure KeyFlowStudio

On every animator's machine, open KeyFlowStudio and fill in your relay details. The installer printed your IP, use that here.

Web Share panel

Relay URLhttp://STUDIO_IP:9881
Relay SecretYOUR_TOKEN

Live Session panel

Relay ServerSTUDIO_IP:9877
i
If you set up a domain with SSL (Step 5), use https://relay.yourstudio.com instead of http://IP:9881, no port needed.
5

Add HTTPS (optional, recommended)

If your relay is exposed on the public internet, add SSL via Let's Encrypt. You need a domain pointing to your server's IP (e.g. relay.yourstudio.com).

# Install nginx and certbot apt install -y nginx certbot python3-certbot-nginx # Create nginx config for Web Share relay cat > /etc/nginx/sites-available/keyflow-relay << 'EOF' server { listen 80; server_name relay.yourstudio.com; location / { proxy_pass http://127.0.0.1:9881; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_read_timeout 86400; client_max_body_size 0; proxy_buffering off; } } EOF ln -sf /etc/nginx/sites-available/keyflow-relay /etc/nginx/sites-enabled/ nginx -t && systemctl reload nginx certbot --nginx -d relay.yourstudio.com
!
Live Session relay (port 9877) is raw TCP, not HTTP, it does not go through nginx. Keep port 9877 open directly in the firewall.
Day-to-day

Managing the relay.

# Check status systemctl status keyflow-relay keyflow-livesync # Live logs journalctl -u keyflow-relay -f journalctl -u keyflow-livesync -f # Restart systemctl restart keyflow-relay keyflow-livesync # Stop systemctl stop keyflow-relay keyflow-livesync
:: Status nssm status KeyFlowRelay nssm status KeyFlowLivesync :: Restart nssm restart KeyFlowRelay nssm restart KeyFlowLivesync :: Stop nssm stop KeyFlowRelay nssm stop KeyFlowLivesync

Updating to a new version

Re-download the relay files and restart services. Or just re-run the installer, same one-liner.

curl -sL https://updates.keyflow.tools/updates/relay/keyflow-relay.py -o /opt/keyflow-relay/keyflow-relay.py curl -sL https://updates.keyflow.tools/updates/relay/livesync-relay.py -o /opt/keyflow-relay/livesync-relay.py systemctl restart keyflow-relay keyflow-livesync

Rotating your token

Edit the systemd unit and reload. Every animator also needs to update their Relay Secret in KeyFlowStudio.

# Edit Environment=RELAY_SECRET=... line nano /etc/systemd/system/keyflow-relay.service systemctl daemon-reload systemctl restart keyflow-relay
Troubleshooting

Something's not working?

Common issues and how to fix them. Still stuck? Email admin@keyflow.tools.

"Connection refused" in KeyFlowStudio

Check each of these in order:

1. The service is actually running: systemctl status keyflow-relay

2. The port is listening: ss -tlnp | grep 9881

3. Local firewall allows it: ufw status (Linux) or Windows Firewall

4. Cloud Security Group allows it (AWS, GCP, Azure, OVH, Hetzner, open port 9881 and 9877 TCP inbound)

5. The URL in KeyFlowStudio matches your server IP exactly, including http:// prefix

"Unauthorized 401" when creating a room

Your Relay Secret doesn't match the token the server was installed with. The token is case-sensitive and must be identical.

Check what the server has:

systemctl show keyflow-relay -p Environment

Compare against the Relay Secret field in KeyFlowStudio. If they differ, update one or the other.

Stream lags or drops frames

Web Share at 30 FPS uses roughly 20–50 Mbit/s upload from the host animator's machine. Check the host's upload speed, not the server's.

On the server, check CPU/RAM: top, free -h. A single relay uses ~30 MB RAM at idle; load scales with active rooms.

Check logs for errors: journalctl -u keyflow-relay -n 100

Live Session won't connect but Web Share works

These are two separate services on two separate ports:

Web Share → port 9881 (HTTP/WebSocket, proxied through nginx if you set up SSL)

Live Session → port 9877 (raw TCP, direct, never through nginx)

If only Web Share works, port 9877 is likely blocked. Open it in both your local firewall and cloud Security Group.

Verify the service: systemctl status keyflow-livesync

The installer finished but services show "inactive"

Check what went wrong in the journal:

journalctl -u keyflow-relay -n 50 --no-pager

Common causes: Python version too old, aiohttp failed to install, port already in use by another service.

Try manually: python3 /opt/keyflow-relay/keyflow-relay.py 9881, the error will print directly.

How do I uninstall the relay?

Linux:

systemctl stop keyflow-relay keyflow-livesync systemctl disable keyflow-relay keyflow-livesync rm /etc/systemd/system/keyflow-relay.service rm /etc/systemd/system/keyflow-livesync.service systemctl daemon-reload rm -rf /opt/keyflow-relay

Windows:

nssm remove KeyFlowRelay confirm nssm remove KeyFlowLivesync confirm rmdir /s /q "C:\ProgramData\KeyFlowRelay"
Security

Best practices.

🔐

Protect your token

Never send the token in plaintext emails or Slack. Use a shared password manager (Bitwarden, 1Password). Rotate every few months.

🌐

Always use SSL

If your relay is exposed to the public internet, set up HTTPS (Step 5). Without SSL, tokens travel in plaintext and can be intercepted.

🛡️

Or lock it to VPN

If all animators are on studio VPN, close 9881/9877 on the public internet entirely. Relay remains reachable only through VPN.

Ready to host your own relay?

One command. 60 seconds. Your review pipeline stays on your network.

Start installation → Talk to us