Impreza now brings Tor client authorization, protection profiles and encrypted onion identity export into the portal, REST API and MCP workflow for eligible Impreza Agent applications. These controls extend onion publishing with ways to decide who can connect, tune protection and prepare identity recovery.
Choose who can reach your onion app
An onion address alone does not restrict visitors. Add named Tor clients using their public keys, inspect the access list and revoke a client when access is no longer needed. Keep your application's own login and permissions: Tor authorization controls the connection, not what a signed-in user may do.
Check the command result and test both an authorized client and a separate unauthorized client. Removing the final client makes the service public to Tor visitors again. Access changes restart the shared Tor daemon and can briefly interrupt onion connections for other apps on the same server.
Configure protection and protect your address
Choose standard, hardened or max protection where supported. Hardened adds stream limits; max requires a Tor build with proof-of-work support. These settings do not replace application security or provide a guarantee against every attack.
Encrypted identity export protects the keys behind your onion address. The export is sealed to a recipient key you control and is retrieved once. Save the recipient private key and the encrypted result securely. App data backups are separate. Rotation changes the onion address, and moving an already-used identity requires coordination with support because address reservations persist.
Start with an eligible server
Existing servers require an explicit update to Impreza Agent 0.6.19 or later, with the capability advertised for each operation. Local MCP requires 0.41.0 or later. The portal, REST API and hosted MCP also expose the controls. A nondefault initial deployment profile requires the corresponding initial-profile capability.
This is the Impreza Agent workflow. Hosting with aaPanel, Tor Manager and Onion Guard remains a distinct setup; do not assume that every Tor hosting plan includes every agent operation.
Start with the onion publishing guide, then follow client authorization and identity recovery. For a compatible connection through Tor, our MCP over Tor guide lists the portal, API, MCP and documentation onion addresses.
Planning a new application? Explore private onion app hosting and confirm the agent requirements before choosing your server.
