Deploy the relay
Go from an empty Azure subscription to a relay that answers. Everything happens in the browser: nothing to install on your workstation.
What you need
- Your three Secure Exchanges licence credentials: serial number, API user and API password, three GUIDs. See Credentials and environments.
- Your licence's environment: production or preview.
- An Azure subscription, with the Contributor role to create resources.
Step 1: open the template
The Azure portal opens on a deployment form.
Step 2: choose where to install
| Field | What you enter |
|---|---|
| Subscription | The one that will carry the costs. |
| Resource group | A dedicated group, for example rg-secure-exchanges: deleting it removes everything at once. Resources are created in its region. |
| Region | The closest to you, for example a Canadian region. |
| Function App name | Leave empty: the name se-relay- followed by a suffix specific to the resource group is generated. Otherwise, 3 to 40 characters, letters, digits and hyphens, starting and ending with a letter or a digit. |
Step 3: provide your credentials
Option A: type them
Three masked fields, one GUID each. They are secure parameters: Azure does not record them in the deployment history. They are written to the Function App's application settings, readable by people who can view that configuration. If your policy rules that out, choose option B.
Option B: read them from Azure Key Vault
Choose Read them from Azure Key Vault, select your vault (the list shows the vaults of the chosen subscription), then enter the exact name of the three secrets. The suggested names, se-serial, se-api-user and se-api-password, are only suggestions.
The values are then stored neither in the application's configuration nor in the deployment history: only a reference appears there. Azure reads the latest version of each secret with the application's managed identity and provides it at run time.
After the deployment, allow the application to read the vault. In Cloud Shell, replacing the three names:
az role assignment create --role "Key Vault Secrets User" --assignee-object-id $(az functionapp identity show --resource-group <your-group> --name <your-application> --query principalId -o tsv) --assignee-principal-type ServicePrincipal --scope $(az keyvault show --name <your-vault> --query id -o tsv)
Then restart the application.
- This command applies to a vault using the Azure RBAC permission model. If your vault uses access policies, grant the application's identity the Get permission on secrets instead.
- You must be Owner, User Access Administrator or Role Based Access Control Administrator on the vault: the Contributor role cannot assign a role.
- If the vault is behind a firewall or a private endpoint, the application must be able to reach it.
The other fields
| Field | What you enter |
|---|---|
| Secure Exchanges environment | Production, or Preview if your licence is on the preview environment |
| Default language | fr-CA or en-CA: the language of the pages your recipients see when a call does not specify one |
The Sizing tab sets the memory per instance (512, 2,048 or 4,096 MB, 512 by default) and the instance limit (40 to 1,000, 40 by default). Only change them if Secure Exchanges support asks you to.
Step 4: create
Click Review + create, then Create, and wait for the deployment to finish.
Step 5: install the code
The infrastructure is ready, but the application is empty.
- On the deployment page, open Outputs. If you closed it: resource group, Settings, Deployments, the deployment, Outputs.
- Copy the value of
step1_installationCommand. It already selects the right subscription. - Open Cloud Shell (
>_, at the top of the portal), in Bash. - Paste the command and press Enter. Wait for it to finish without errors.
Step 6: get the address and the key
| Output | Content |
|---|---|
step2_relayUrlWithKey |
The /api/enveloppe address, key included: https://<host>/api/enveloppe?code=<key> |
step4_accessKey |
The key alone |
step3_testCommand |
A ready curl command on /api/version |
The key is the Function App's default host key: it is valid for all three routes. Treat it like a password: whoever has it can create envelopes and send messages on your licence.
Warning
These outputs show the key in plain text. Anyone who can view the resource group's deployments, even with the Reader role only, can read it. Restrict access to the group, and renew the key if in doubt: see Configure and secure.
Step 7: check
Run
step3_testCommand. A 200 response proves that the code is installed and the key is valid, but not that your credentials are correct: this route does not call Secure Exchanges.Create a test envelope, replacing the host, the key and the destination address:
curl -s -X POST "https://<host>/api/enveloppe" -H "x-functions-key: <key>" -H "Content-Type: application/json" -d '{"subject":"Test","destination":"you@example.com"}'Expected response:
{"status":200,"url":"https://www.secure-exchanges.com/...","repId":"...","error":null}
The url field is the envelope link: open it to see what your recipient will see. For any other response, see Troubleshooting.