Everything, written down.

Two servers, one network — connect to either and you're everywhere. TLS is required (both speak TLS 1.3 with post-quantum key exchange; certificates are real, no self-signed warnings).

Server	Port	Notes
eshmaki.me	6697 (TLS)	home node · also serves Onyx
ircx.us	6697 (TLS)	mesh peer · same accounts, same channels

WeeChat

/server add onyx eshmaki.me/6697 -tls
/set irc.server.onyx.sasl_mechanism scram-sha-256
/set irc.server.onyx.sasl_username you
/set irc.server.onyx.sasl_password yourpassword
/connect onyx
/join #root

irssi

/network add -sasl_username you -sasl_password yourpassword -sasl_mechanism SCRAM-SHA-256 onyx
/server add -auto -tls -network onyx eshmaki.me 6697
/connect onyx

mIRC

/server -m eshmaki.me +6697

Then in Options → Connect → Servers, enable SASL with method SCRAM-SHA-256. mIRC detects IRCX automatically and unlocks its IRCX features against this network.

No account yet?

Just connect and pick a nick — guests are welcome. Registration (next guide) protects your nick and unlocks personas, session sync, and channel ownership.

Accounts are built into the server — every command below is a real server verb, not a message to a bot.

Register

/REGISTER you your@email.com yourpassword
/VERIFY you 123456        ; code arrives by email

From then on, log in automatically with SASL (see the client snippets above), or manually with /IDENTIFY yourpassword.

Two-factor

/TOTP ENROLL              ; shows a secret for your authenticator app
/TOTP CONFIRM 123456      ; activates it

Passwordless login with certificates

Generate a client certificate once, and the server recognizes you by its fingerprint — no password crosses the wire:

openssl req -x509 -newkey ed25519 -keyout me.key -out me.crt \
  -days 3650 -nodes -subj "/CN=you"
# connect with the cert loaded, logged in, then:
/CERTADD                  ; binds the current cert to your account
/CERTLIST                 ; see bindings   ·   /CERTDEL <fp> removes one

With a bound cert, SASL EXTERNAL logs you in the moment the TLS handshake finishes. RSA and ECDSA certs work too, over TLS 1.2 or 1.3.

Device encryption keys

Modern Onyx clients can publish the browser's E2EE public key to your account and ask the server for the credential transparency root. The commands are plain account verbs, so scripts and other clients can inspect the same state:

/E2EEKEY STATUS
/E2EEKEY LIST
/E2EEKEY ADD browser tsumugi-p256 <public-key>
/E2EEKEY DEL browser
/KEYTRANS STATUS
/KEYTRANS PROOF 42

The Onyx account panel exposes those as device-key and transparency controls; server replies stay in account notices.

Nick trouble

/GHOST yournick           ; disconnects a stale session holding your nick
/RECOVER yournick         ; takes the nick back and holds it briefly
/SETPASS newpassword      ; change password (logged in)

Sessions that follow you

Onyx and other modern clients get an opaque session token on login — refresh the tab or hop devices and you resume where you were, scrollback and all. The mesh keeps your session valid even if a node restarts.

Nobody on Onyx sees your IP. Every connection gets a hierarchical HMAC cloak by default, and logged-in users wear a stable friendly host instead:

you!user@you.users.ircxnet

— the same host on every device, every network path, every day.

The wardrobe

Guise lets one account keep several named personas — different vhosts for different moods:

/VHOST LIST               ; your wardrobe
/VHOST USE nightshift     ; switch instantly, mid-session
/VHOST CLAIM poets.society/you
                          ; self-claim from templates staff have offered

Each persona records where it came from — granted by staff, claimed from an offer, or verified as yours. Staff see provenance; the room just sees the face you chose.

Join a channel that doesn't exist and it's yours — you get the founder prefix (!) on the spot. Register it so it stays yours:

/join #yourhall
/CHANNEL REGISTER #yourhall

The prefix ladder

Prefix	Rank	Means
*	oper	network staff (derived, not grantable)
!	founder	the channel is registered to them
.	owner	full control, can appoint hosts
@	host / op	day-to-day moderation
+	voice	may speak in moderated rooms

The key ladder — IRCX's best idea

Set write-only keys on the channel; anyone who presents a key on join walks in at that rank. No access lists to maintain, just a secret to share:

/PROP #yourhall OWNERKEY :sesame-owner
/PROP #yourhall HOSTKEY  :sesame-host
/PROP #yourhall MEMBERKEY :sesame     ; doubles as the +k join key
# a friend joins as host, no ceremony:
/join #yourhall sesame-host

Access lists, when you want them

/ACCESS #yourhall ADD OWNER account:alice
/ACCESS #yourhall ADD DENY *!*@spam.example.*
/ACCESS #yourhall LIST

Encryption policy

Channels can publish their expected message privacy posture through the encryption-policy property. Onyx shows it in channel settings and ops can change it without memorizing the raw command:

/PROP #yourhall encryption-policy optional
/PROP #yourhall encryption-policy required
/PROP #yourhall encryption-policy off

When the server offers orochi/e2ee, Onyx marks sealed encrypted DMs with the +orochi/e2ee message tag so the server can enforce policy without reading payloads.

Modes worth knowing

Mode	Effect
AUDITORIUM	members see only hosts — town-hall style rooms
OPMODERATE	quiet-but-not-silent: filtered messages go to ops for review
KNOCK	let people request an invite to a closed room
AUTHONLY	registered accounts only
NOCOMICDATA	politely declines Comic Chat panels (+V)

Query anything by name with /MODEX #yourhall — no mode-letter memorization required.

Calls are part of the protocol — any channel can become a stage for up to 64 people. In Onyx it's one click: join a channel, hit the headphones. Under the hood:

MEDIA JOIN #yourhall voice     ; or: video
MEDIA MUTE #yourhall
MEDIA ROSTER #yourhall         ; who's on stage
MEDIA LEAVE #yourhall

Audio and video ride the same encrypted WebSocket as your chat, framed by the network's own KaguraVox and KaguraVis codecs, with each participant's stream authenticated by a per-stream MAC key. Hardware devices can bridge in through the media gateway.

Nothing to sign up for, no third-party servers, and when you leave the stage, the stream is gone — calls aren't recorded.