# Flow Security (/docs/products/ussd-flows/security)

When a flow calls your server, it sends the caller's answers and session details. Monime encrypts each request with a public key you add to the flow, so only your server, which holds the matching private key, can read it. Your server's reply must be encrypted too. Developers can read how this works in the [Encryption Model](/docs/products/ussd-flows/developers/security/overview).

## When You Need a Key

You need a key if any page in the flow calls your server:

- a page with `on_done` action `"exchange"`, or
- a `dynamic` page.

Flows that never call your server don't need a key.

If the flow needs a key and has none, you can't publish it. The **Security** section on the flow's page shows **Action required**.

## Adding Your Public Key



## One Key per Flow

Each flow has one public key. It covers every page in that flow that calls your server, so you don't need a key per URL.

## Changing the Key

Monime starts using a new public key as soon as you save it. To change keys without breaking live sessions:

1. Set up your server to accept both the old and the new private key.
2. Paste the new public key and save.
3. Remove the old private key from your server.

## Problems

**Saving the key fails**

The message says what's wrong:

- **Invalid public key.** The text isn't a public key. Paste the whole public key, with its first and last lines, and nothing else. Check it isn't the private key.
- **public key must be RSA.** Make an RSA key pair.
- **public key must be 2048 bits.** Make a new pair with a 2048-bit key.

**My server can't decrypt requests**

The private key on your server doesn't match the public key on the flow. Make sure both come from the same key pair. If in doubt, make a new pair, paste the new public key and put the new private key on your server.

**The flow stops after my server replies**

Your server must reply with HTTP 200 within 10 seconds, and the reply must be encrypted. A plain JSON reply, a slow reply or any other failure ends the caller's session with an error. See [Security Troubleshooting](/docs/products/ussd-flows/developers/security/troubleshooting).

## Next Steps

- [**Encryption Model**](/docs/products/ussd-flows/developers/security/overview)

  How requests and replies are encrypted, with code for your server.

- [**Exchange & Dynamic API**](/docs/products/ussd-flows/developers/exchange-api/overview)

  What Monime sends to your server and what it expects back.