Sessions
¶ Baileys auth state becomes one encrypted object
Baileys multi-file auth state is serialized, encrypted with AES-256-GCM under CHANNEL_SESSION_KEY, and stored as one object.
Object path
channels/{id}/auth.binSession and media storage model
¶ Storage and Encryption
ReplyBox keeps WhatsApp session state and media bytes in object storage, but encrypts them as separate domains. The paths look similar on purpose; the keys must not.
Media
¶ Media bytes use their own object key
Media is encrypted separately under MEDIA_OBJECT_KEY using the same AES-256-GCM envelope layout as sessions.
Object path
channels/{id}/media/{message_id}Envelope layout
¶ Both domains write the same byte shape
The encrypted object body is stored as an initialization vector, authentication tag, and ciphertext. The layout is shared; the key domain is not.
iv12 bytes
tag16 bytes
ciphertextencrypted payload
[iv(12) | tag(16) | ciphertext]
Workspace logos
¶ Re-encoded on upload, then served through the API
Uploaded logos are validated (PNG, JPG, and WebP only), decoded, resized to a maximum of 256×256, and re-encoded as WebP before being written to object storage. SVG and other document formats are rejected.
Object path
org-logos/{organization_id}/{uuid}.webp
A fresh address per uploadEach upload is stored under a unique object key, so replacements get a new address. The API deletes the previous object on replace or remove.
Served by the API, not the bucketLogos are served via the API rather than direct bucket URLs, with cache-busting handled by the object key. This prevents stale client and CDN caching, and keeps every byte in the bucket one our service produced.
Boundary rule
¶ Do not merge the keys
The two keys protect separate domains. Keeping them distinct means leaking either key does not automatically compromise the other class of object.
Keep separateUse
CHANNEL_SESSION_KEY only for session blobs and MEDIA_OBJECT_KEY only for media objects.
Do not consolidateA shared key collapses the session and media blast radius into one domain.