Pairing is how two phones learn each other's keys. Everything after that — every message, every photo — is sealed to those keys, and only those two phones can open it.
If they are on CHANNEL at a number, address or handle they have published, write to them. Your message goes straight to them and their accepting it is what links the two of you. There is nothing else to do and no code to copy. There are two ways in, and they end in the same place.
Everything below is for the case where that does not work — somebody who has published nothing for you to reach.
The Contacts tab has a door of its own. Add, then Link to Someone, offers everything below in one place: showing your own code, scanning theirs, entering a code they sent, sending your code, or — everywhere except a contact's own card — typing a number, handle or email into the field at the bottom and choosing Write to. A contact's own card opens the same sheet, for that one person. If the camera cannot scan, Enter Code Instead on the scanning screen lets you paste the code they sent you.
A code is two halves and both have to happen. One person shows their code; the other enters it. Showing your own code does nothing on its own — until somebody enters it, your device holds no key for them and nothing you send can reach them. When they enter it, they are added to your contacts at once, and your device asks only what to call them. CHANNEL cannot tell who is holding the other phone; a call, or a word in person, settles that. In Enter a Code They Sent, a code with quotation marks round it, as a messaging app quotes it, is read as it is, and on iPhone the system Paste control puts a copied code into the box. The button that adds them stays off until you type a name, and the screen says Type a name to add them. The Link to Someone sheet closes when the pairing finishes.
Link to Someone holds both: Show My Code, and Enter a Code They Sent.
The easiest thing to send is a link. Link to Someone, then Send My Code, opens your device's own share sheet, and the link is the first thing in the message it prepares. Pick where it goes — Messages, Mail, WhatsApp, anything on the sheet — and it only sends once you press Send there.
Whoever taps it and has CHANNEL sends you a request, with nothing to copy and nothing to type. It arrives with your other requests, and you choose Accept, Decline or Block. Their phone shows Waiting for them to accept your request until you accept, and they can send nothing in the meantime. Whoever taps it and does not have CHANNEL gets a page explaining what they were sent.
Intro video. When you open a link, CHANNEL offers to record an intro video of up to 10 seconds with the camera. The camera faces you when it opens, and Switch camera turns it around. It is strongly recommended, and Skip sends your request without one. The video is a live recording; nothing from the photo library goes in its place, and it is the one thing you can send before they accept. They see it inside your request, where it plays only when they tap it, and they can check that it is the person they expect. A request with no intro video says so, and tells them to be skeptical of a new contact who does not send one, unless they already know who it is. The video stays with the request until they choose: Accept makes it the first message in your conversation, and Decline or Block deletes it.
The link holds no secret. It carries a public key and a one-time slot number, so anyone who intercepts it learns that somebody is being invited to pair and nothing about any message. It does let a stranger who gets hold of it answer in your place — which is why it works once, expires after 24 hours, and why every answer arrives as a request that you accept or decline. Nothing has to stay on screen: until it is used or the 24 hours are up, your device answers it whenever CHANNEL is open.
The code sits underneath the link in the same message, for the case where the link does nothing. On iPhone, How to send under the code chooses One message or Split in two; two halves go by two different ways, so someone who rewrites one of them cannot fake the code.
Email It for Me, in Link to Someone for a contact with an email address, sends the link by email straight from CHANNEL rather than through your own mail app — our server learns the address it is sent to, for that one send. Texting a link goes through your device's own share sheet.
The most private way to pair, and it is made of two switches you already have.
A handle is claimed once and stays yours. Find me by is a separate switch that decides whether anyone can look you up at it. So you can turn Find me by on for your handle, tell one person, let them write to you, and turn it off again — and the name is still yours, still claimed, and nobody can find you at it.
The pairing survives, because it was never a lookup. Pairing makes keys. The handle was only how the two of you met; once you are paired, nothing in the app consults it again, and either of you can leave whenever you like — see Undoing a pairing below.
Use it when you want to be reachable by one person and by nobody else: nothing is left published afterwards, and nothing was sent through anything you do not control.
Turn off Find me by. Do not remove the number behind it. They sit near each other on your card and do opposite things: unticking Find me by hides the handle and keeps it, while removing the verified number that proves the handle is yours releases the name and somebody else may take it. You are asked first, and there is a thirty-day grace afterwards: through it the name is still reserved for you and still reaches you, so a change of mind costs nothing.
A pairing code works for whoever holds it. Send it over an end-to-end encrypted messenger, such as WhatsApp, Signal or iMessage, or give it in person. Ordinary SMS is not end-to-end encrypted, so a code sent that way gives less assurance that only the person you meant has it.
Not plain email. Email is not encrypted between servers. Most people assume it is; it is not, and it is the one common channel where a code could genuinely be read in transit.
If a code you sent is used by somebody other than the person you meant, CHANNEL tells you and does not write them to that person's card.
Linked means your messages are sealed end to end and nobody else can read them. What that is worth depends on how the code reached you — read to you across a table, sent over WhatsApp, or found at a number the person published.
Not linked means no keys have been exchanged yet and nothing can be sealed.
Each profile links on its own, so a card that appears in several profiles can be Linked in one and Not linked in another. On the card, Not linked can be tapped: it offers to write to them at an address on their card, which links you when they accept, or Link to Someone for a code.
Linked also reads Linked as of a date — the last day the link worked both ways, learned from ordinary messages and their receipts that pass between you anyway, with nothing extra sent to find out. Tap it to open Advanced, the closed row at the foot of the page, where Check Now makes their phone answer silently, with no notification on either side, and both cards show the new date; a phone that is offline answers when it is next online. If messages from them stop opening here, CHANNEL renews the link by itself, with nothing for either of you to do, and the card reads Checking meanwhile. Only when that does not work does the card say Needs linking; tap it for the ways to link. Link Again, which starts the pairing again and keeps your conversation, is under Advanced too.
Pending approval means the keys are agreed and what you send is sealed, and the other phone has not answered yet. It happens on the route that starts from a handle, a number or an address: your device builds the keys from what they published, and there is nothing to wait for on your side. It becomes Linked the moment anything of theirs arrives. The person accepting never sees it, because for them the request is the first thing that happens.
Where real confidence comes from is not the pairing at all: it is a value somebody proved they control. A handle, a phone number or an email address on their card had to survive a code sent to it before CHANNEL would publish it. That is a claim somebody had to hold something real to make, and it is worth more than any ceremony between two phones.
Before you send something where being wrong would matter, check the person, not the maths. The simplest way costs nothing:
Call them, or message them on something else, and ask them to read back the last thing you sent.
Only the person you are actually paired with can do that. It needs no codes and no numbers to compare, and it tests the thing you care about — that the conversation on your screen is reaching the person you think it is.
A contact's page has a Safety Number row in its Identity section. It opens eight groups of five digits, worked out from your key and your contact's, and the same digits show on their phone. Copy puts them on the clipboard.
Compare the digits with your contact's, in person or on a call. If they match, nobody is between you. If they do not match, tell your contact and check how you were connected. It is the check for somebody you reached at a number, address or handle they published, where our server hands over their keys.
Comparing is optional. A conversation works the same whether or not you ever open the row.
If someone reaches you at a verified number or address, or at your handle, you see a request that says who they claim to be, and the first thing they wrote.
Three choices: Accept, Decline, Block. Declining removes the request; five declines in a row from one sender at one value block them (see Repeated requests in Messages). Accepting creates the contact, named the way they sent it — rename it from the card whenever you like — and finishes the pairing there and then, opening the conversation with their first message already in it; it does not wait for their phone. Blocking refuses this request and anything else from that sender, and it holds after the request is gone. Nobody is told what you chose. An invitation that names a contact you already have is accepted only when it proves it came from them; otherwise accepting it does nothing and it leaves the list. A name you have given them stays yours when their first message arrives; their own name is kept beside it and shows only when you have not named them.
Their phone stops saying waiting the moment anything you send opens on it. That is better proof than an acknowledgement: it shows they hold the key and used it.
If CHANNEL can see that a card's key belongs to somebody else, it says so above the message box: "Messages here are not reaching …". It is not an accusation and nothing you did caused it — it is the app noticing its own mistake.
Link to Someone, on that card, starts the pairing again from the beginning — the same button as everywhere else, and the sheet says at the top that linking again replaces the old link with a fresh one. Your conversation stays exactly where it is, with everything in it. What you give up is the link: you wait for them to accept again, the same as the first time.
It works the same way when you know before the app does — open Link to Someone from the card rather than waiting for the notice.
Revoke link, under Advanced at the foot of a contact's page, throws away the session: the keys, the device list, and the record of what was sent to them. It keeps the card — their name, their numbers, everything you wrote down.
It is meant to be used casually. Nothing about it is one-way: they can ask again, you can pair again, and a block can be lifted.
English is the reference text; any translation is a convenience.
CHANNEL