diff --git a/iroh-base/Cargo.toml b/iroh-base/Cargo.toml
index 1f26441349..24ba44ef1a 100644
--- a/iroh-base/Cargo.toml
+++ b/iroh-base/Cargo.toml
@@ -48,10 +48,24 @@ serde_test = "1"
 [features]
 default = ["hash", "ticket", "relay"]
 hash = ["dep:blake3", "dep:data-encoding", "dep:postcard", "dep:derive_more", "base32"]
-ticket = ["base32", "key"]
+ticket = ["base32", "key", "hash"]
 base32 = ["dep:data-encoding", "dep:postcard"]
 redb = ["dep:redb"]
-key = ["dep:ed25519-dalek", "dep:once_cell", "dep:rand", "dep:rand_core", "dep:ssh-key", "dep:ttl_cache", "dep:aead", "dep:crypto_box", "dep:zeroize", "dep:url", "dep:derive_more", "dep:getrandom"]
+key = [
+  "dep:ed25519-dalek",
+  "dep:once_cell",
+  "dep:rand",
+  "dep:rand_core",
+  "dep:ssh-key",
+  "dep:ttl_cache",
+  "dep:aead",
+  "dep:crypto_box",
+  "dep:zeroize",
+  "dep:url",
+  "dep:derive_more",
+  "dep:getrandom",
+  "base32",
+]
 wasm = ["getrandom?/js"]
 relay = ["dep:url", "dep:derive_more"]
 
diff --git a/iroh-base/src/lib.rs b/iroh-base/src/lib.rs
index 8e74a01718..2db5732ab5 100644
--- a/iroh-base/src/lib.rs
+++ b/iroh-base/src/lib.rs
@@ -1,17 +1,30 @@
 //! Base types and utilities for Iroh
 #![cfg_attr(iroh_docsrs, feature(doc_auto_cfg))]
 
+// TODO: remove
 #[cfg(feature = "base32")]
 pub mod base32;
+
+// TODO: move to own crate
+#[cfg(feature = "ticket")]
+pub mod ticket;
+
 #[cfg(feature = "hash")]
-pub mod hash;
+mod hash;
 #[cfg(feature = "key")]
-pub mod key;
+mod key;
 #[cfg(feature = "key")]
-pub mod node_addr;
-#[cfg(feature = "relay")]
-pub mod relay_map;
+mod node_addr;
 #[cfg(feature = "relay")]
 mod relay_url;
-#[cfg(feature = "ticket")]
-pub mod ticket;
+
+#[cfg(feature = "hash")]
+pub use self::hash::{BlobFormat, Hash, HashAndFormat};
+#[cfg(feature = "key")]
+pub use self::key::{
+    KeyParsingError, NodeId, PublicKey, SecretKey, SharedSecret, Signature, PUBLIC_KEY_LENGTH,
+};
+#[cfg(feature = "key")]
+pub use self::node_addr::NodeAddr;
+#[cfg(feature = "relay")]
+pub use self::relay_url::RelayUrl;
diff --git a/iroh-base/src/node_addr.rs b/iroh-base/src/node_addr.rs
index b22b82d167..08ca55dee8 100644
--- a/iroh-base/src/node_addr.rs
+++ b/iroh-base/src/node_addr.rs
@@ -10,8 +10,7 @@ use std::{collections::BTreeSet, net::SocketAddr};
 
 use serde::{Deserialize, Serialize};
 
-use crate::key::{NodeId, PublicKey};
-pub use crate::relay_url::RelayUrl;
+use crate::{NodeId, PublicKey, RelayUrl};
 
 /// Network-level addressing information for an iroh node.
 ///
diff --git a/iroh-dns-server/benches/write.rs b/iroh-dns-server/benches/write.rs
index 52924672f3..e32db57855 100644
--- a/iroh-dns-server/benches/write.rs
+++ b/iroh-dns-server/benches/write.rs
@@ -1,6 +1,6 @@
 use anyhow::Result;
 use criterion::{criterion_group, criterion_main, BenchmarkId, Criterion, Throughput};
-use iroh::{discovery::pkarr::PkarrRelayClient, dns::node_info::NodeInfo, key::SecretKey};
+use iroh::{discovery::pkarr::PkarrRelayClient, dns::node_info::NodeInfo, SecretKey};
 use iroh_dns_server::{config::Config, server::Server, ZoneStore};
 use tokio::runtime::Runtime;
 
diff --git a/iroh-dns-server/examples/publish.rs b/iroh-dns-server/examples/publish.rs
index d22da284f1..d2a7026fac 100644
--- a/iroh-dns-server/examples/publish.rs
+++ b/iroh-dns-server/examples/publish.rs
@@ -8,8 +8,7 @@ use iroh::{
         pkarr::{PkarrRelayClient, N0_DNS_PKARR_RELAY_PROD, N0_DNS_PKARR_RELAY_STAGING},
     },
     dns::node_info::{to_z32, NodeInfo, IROH_TXT_NAME},
-    key::SecretKey,
-    NodeId,
+    NodeId, SecretKey,
 };
 use url::Url;
 
diff --git a/iroh-dns-server/src/lib.rs b/iroh-dns-server/src/lib.rs
index 4b7cf773fc..8764211b7f 100644
--- a/iroh-dns-server/src/lib.rs
+++ b/iroh-dns-server/src/lib.rs
@@ -30,7 +30,7 @@ mod tests {
     use iroh::{
         discovery::pkarr::PkarrRelayClient,
         dns::{node_info::NodeInfo, DnsResolver, ResolverExt},
-        key::SecretKey,
+        SecretKey,
     };
     use pkarr::{PkarrClient, SignedPacket};
     use testresult::TestResult;
diff --git a/iroh-net-report/src/defaults.rs b/iroh-net-report/src/defaults.rs
index ef26f4cdc6..6ac78db120 100644
--- a/iroh-net-report/src/defaults.rs
+++ b/iroh-net-report/src/defaults.rs
@@ -1,7 +1,5 @@
 //! Default values used in net_report.
 
-pub(crate) use iroh_base::relay_map::{DEFAULT_RELAY_QUIC_PORT, DEFAULT_STUN_PORT};
-
 /// Contains all timeouts that we use in `iroh-net-report`.
 pub(crate) mod timeouts {
     use std::time::Duration;
diff --git a/iroh-net-report/src/lib.rs b/iroh-net-report/src/lib.rs
index d0ac11379a..d20e09dfc1 100644
--- a/iroh-net-report/src/lib.rs
+++ b/iroh-net-report/src/lib.rs
@@ -15,10 +15,10 @@ use std::{
 use anyhow::{anyhow, Context as _, Result};
 use bytes::Bytes;
 use hickory_resolver::TokioResolver as DnsResolver;
-use iroh_base::relay_map::{RelayMap, RelayNode, RelayUrl};
+use iroh_base::RelayUrl;
 #[cfg(feature = "metrics")]
 use iroh_metrics::inc;
-use iroh_relay::protos::stun;
+use iroh_relay::{protos::stun, RelayMap};
 use netwatch::{IpFamily, UdpSocket};
 use tokio::{
     sync::{self, mpsc, oneshot},
@@ -808,16 +808,13 @@ mod test_utils {
 
     use std::sync::Arc;
 
-    use iroh_base::relay_map::QuicConfig;
-    use iroh_relay::server;
-
-    use crate::RelayNode;
+    use iroh_relay::{server, RelayNode, RelayQuicConfig};
 
     pub(crate) async fn relay() -> (server::Server, Arc<RelayNode>) {
         let server = server::Server::spawn(server::testing::server_config())
             .await
             .expect("should serve relay");
-        let quic = Some(QuicConfig {
+        let quic = Some(RelayQuicConfig {
             port: server.quic_addr().expect("server should run quic").port(),
         });
         let node_desc = RelayNode {
@@ -864,6 +861,8 @@ mod tests {
         use std::{net::IpAddr, sync::Arc};
 
         use anyhow::Result;
+        use iroh_base::RelayUrl;
+        use iroh_relay::RelayNode;
         use tokio::{
             net,
             sync::{oneshot, Mutex},
@@ -871,7 +870,6 @@ mod tests {
         use tracing::{debug, trace};
 
         use super::*;
-        use crate::{RelayMap, RelayNode, RelayUrl};
 
         /// A drop guard to clean up test infrastructure.
         ///
diff --git a/iroh-net-report/src/reportgen.rs b/iroh-net-report/src/reportgen.rs
index e43d6e523e..67491edcac 100644
--- a/iroh-net-report/src/reportgen.rs
+++ b/iroh-net-report/src/reportgen.rs
@@ -27,9 +27,15 @@ use std::{
 
 use anyhow::{anyhow, bail, Context as _, Result};
 use hickory_resolver::TokioResolver as DnsResolver;
+use iroh_base::RelayUrl;
 #[cfg(feature = "metrics")]
 use iroh_metrics::inc;
-use iroh_relay::{http::RELAY_PROBE_PATH, protos::stun};
+use iroh_relay::{
+    defaults::{DEFAULT_RELAY_QUIC_PORT, DEFAULT_STUN_PORT},
+    http::RELAY_PROBE_PATH,
+    protos::stun,
+    RelayMap, RelayNode,
+};
 use netwatch::{interfaces, UdpSocket};
 use rand::seq::IteratorRandom;
 use tokio::{
@@ -45,10 +51,9 @@ use url::Host;
 use crate::Metrics;
 use crate::{
     self as net_report,
-    defaults::{DEFAULT_RELAY_QUIC_PORT, DEFAULT_STUN_PORT},
     dns::ResolverExt,
     ping::{PingError, Pinger},
-    RelayMap, RelayNode, RelayUrl, Report,
+    Report,
 };
 
 mod hairpin;
diff --git a/iroh-net-report/src/reportgen/probes.rs b/iroh-net-report/src/reportgen/probes.rs
index 241ad62771..ac27bef23b 100644
--- a/iroh-net-report/src/reportgen/probes.rs
+++ b/iroh-net-report/src/reportgen/probes.rs
@@ -7,10 +7,12 @@
 use std::{collections::BTreeSet, fmt, sync::Arc};
 
 use anyhow::{ensure, Result};
+use iroh_base::RelayUrl;
+use iroh_relay::{RelayMap, RelayNode};
 use netwatch::interfaces;
 use tokio::time::Duration;
 
-use crate::{RelayMap, RelayNode, RelayUrl, Report};
+use crate::Report;
 
 /// The retransmit interval used when net_report first runs.
 ///
diff --git a/iroh-relay/Cargo.toml b/iroh-relay/Cargo.toml
index 3d22bc66bd..50b6cb002d 100644
--- a/iroh-relay/Cargo.toml
+++ b/iroh-relay/Cargo.toml
@@ -38,7 +38,7 @@ http = "1"
 http-body-util = "0.1.0"
 hyper = { version = "1", features = ["server", "client", "http1"] }
 hyper-util = "0.1.1"
-iroh-base = { version = "0.29.0", path = "../iroh-base", features = ["key"] }
+iroh-base = { version = "0.29.0", path = "../iroh-base", default-features = false, features = ["key", "relay"] }
 iroh-metrics = { version = "0.29.0", default-features = false }
 libc = "0.2.139"
 num_enum = "0.7"
diff --git a/iroh-relay/src/client.rs b/iroh-relay/src/client.rs
index 4b956d4504..717d4d47c3 100644
--- a/iroh-relay/src/client.rs
+++ b/iroh-relay/src/client.rs
@@ -24,7 +24,7 @@ use hyper::{
     Request,
 };
 use hyper_util::rt::TokioIo;
-use iroh_base::key::{NodeId, PublicKey, SecretKey};
+use iroh_base::{NodeId, PublicKey, RelayUrl, SecretKey};
 use rand::Rng;
 use rustls::client::Resumption;
 use streams::{downcast_upgrade, MaybeTlsStream, ProxyStream};
@@ -46,7 +46,6 @@ use crate::{
     defaults::timeouts::*,
     http::{Protocol, RELAY_PATH},
     protos::relay::DerpCodec,
-    RelayUrl,
 };
 
 pub(crate) mod conn;
diff --git a/iroh-relay/src/client/conn.rs b/iroh-relay/src/client/conn.rs
index 4c9fbc64c4..ef316e1181 100644
--- a/iroh-relay/src/client/conn.rs
+++ b/iroh-relay/src/client/conn.rs
@@ -18,7 +18,7 @@ use futures_util::{
     stream::{SplitSink, SplitStream, StreamExt},
     SinkExt,
 };
-use iroh_base::key::{NodeId, SecretKey};
+use iroh_base::{NodeId, SecretKey};
 use tokio::sync::mpsc;
 use tokio_tungstenite_wasm::WebSocketStream;
 use tokio_util::{
diff --git a/iroh-relay/src/defaults.rs b/iroh-relay/src/defaults.rs
index 71137b4340..6a0d40a59e 100644
--- a/iroh-relay/src/defaults.rs
+++ b/iroh-relay/src/defaults.rs
@@ -1,6 +1,15 @@
 //! Default values used in the relay.
 
-pub use iroh_base::relay_map::{DEFAULT_RELAY_QUIC_PORT, DEFAULT_STUN_PORT};
+/// The default STUN port used by the Relay server.
+///
+/// The STUN port as defined by [RFC 8489](<https://www.rfc-editor.org/rfc/rfc8489#section-18.6>)
+pub const DEFAULT_STUN_PORT: u16 = 3478;
+
+/// The default QUIC port used by the Relay server to accept QUIC connections
+/// for QUIC address discovery
+///
+/// The port is "QUIC" typed on a phone keypad.
+pub const DEFAULT_RELAY_QUIC_PORT: u16 = 7842;
 
 /// The default HTTP port used by the Relay server.
 pub const DEFAULT_HTTP_PORT: u16 = 80;
diff --git a/iroh-relay/src/lib.rs b/iroh-relay/src/lib.rs
index c7e717ff41..b13d1d963b 100644
--- a/iroh-relay/src/lib.rs
+++ b/iroh-relay/src/lib.rs
@@ -37,14 +37,18 @@ pub mod quic;
 #[cfg(feature = "server")]
 pub mod server;
 
+mod relay_map;
+
 #[cfg(test)]
 mod dns;
 
-pub use iroh_base::node_addr::RelayUrl;
 pub use protos::relay::MAX_PACKET_SIZE;
 
-pub use self::client::{
-    conn::{Conn as RelayConn, ReceivedMessage},
-    Client as HttpClient, ClientBuilder as HttpClientBuilder, ClientError as HttpClientError,
-    ClientReceiver as HttpClientReceiver,
+pub use self::{
+    client::{
+        conn::{Conn as RelayConn, ReceivedMessage},
+        Client as HttpClient, ClientBuilder as HttpClientBuilder, ClientError as HttpClientError,
+        ClientReceiver as HttpClientReceiver,
+    },
+    relay_map::{RelayMap, RelayNode, RelayQuicConfig},
 };
diff --git a/iroh-relay/src/protos/relay.rs b/iroh-relay/src/protos/relay.rs
index 35e6282482..bab86791dd 100644
--- a/iroh-relay/src/protos/relay.rs
+++ b/iroh-relay/src/protos/relay.rs
@@ -16,11 +16,11 @@ use std::time::Duration;
 
 use anyhow::{bail, ensure};
 use bytes::{Buf, BufMut, Bytes, BytesMut};
-#[cfg(feature = "server")]
+#[cfg(any(test, feature = "server"))]
 use futures_lite::{Stream, StreamExt};
 use futures_sink::Sink;
 use futures_util::SinkExt;
-use iroh_base::key::{PublicKey, SecretKey, Signature, PUBLIC_KEY_LENGTH};
+use iroh_base::{PublicKey, SecretKey, Signature, PUBLIC_KEY_LENGTH};
 use postcard::experimental::max_size::MaxSize;
 use serde::{Deserialize, Serialize};
 use tokio_util::codec::{Decoder, Encoder};
diff --git a/iroh-relay/src/quic.rs b/iroh-relay/src/quic.rs
index a2fb91f22e..924cf48703 100644
--- a/iroh-relay/src/quic.rs
+++ b/iroh-relay/src/quic.rs
@@ -270,7 +270,7 @@ impl QuicClient {
     }
 }
 
-#[cfg(test)]
+#[cfg(all(test, feature = "server"))]
 mod tests {
     use std::net::Ipv4Addr;
 
diff --git a/iroh-base/src/relay_map.rs b/iroh-relay/src/relay_map.rs
similarity index 87%
rename from iroh-base/src/relay_map.rs
rename to iroh-relay/src/relay_map.rs
index cc5d75299c..6d43ee142a 100644
--- a/iroh-base/src/relay_map.rs
+++ b/iroh-relay/src/relay_map.rs
@@ -3,20 +3,10 @@
 use std::{collections::BTreeMap, fmt, sync::Arc};
 
 use anyhow::{ensure, Result};
+use iroh_base::RelayUrl;
 use serde::{Deserialize, Serialize};
 
-pub use crate::relay_url::RelayUrl;
-
-/// The default STUN port used by the Relay server.
-///
-/// The STUN port as defined by [RFC 8489](<https://www.rfc-editor.org/rfc/rfc8489#section-18.6>)
-pub const DEFAULT_STUN_PORT: u16 = 3478;
-
-/// The default QUIC port used by the Relay server to accept QUIC connections
-/// for QUIC address discovery
-///
-/// The port is "QUIC" typed on a phone keypad.
-pub const DEFAULT_RELAY_QUIC_PORT: u16 = 7842;
+use crate::defaults::{DEFAULT_RELAY_QUIC_PORT, DEFAULT_STUN_PORT};
 
 /// Configuration of all the relay servers that can be used.
 #[derive(Debug, Clone, PartialEq, Eq)]
@@ -77,7 +67,7 @@ impl RelayMap {
                 url,
                 stun_only: false,
                 stun_port,
-                quic: Some(QuicConfig::default()),
+                quic: Some(RelayQuicConfig::default()),
             }
             .into(),
         );
@@ -138,21 +128,22 @@ pub struct RelayNode {
     /// When `None`, we will not attempt to do QUIC address discovery
     /// with this relay server.
     #[serde(default = "quic_config")]
-    pub quic: Option<QuicConfig>,
+    pub quic: Option<RelayQuicConfig>,
 }
 
-fn quic_config() -> Option<QuicConfig> {
-    Some(QuicConfig::default())
+fn quic_config() -> Option<RelayQuicConfig> {
+    Some(RelayQuicConfig::default())
 }
 
 /// Configuration for speaking to the QUIC endpoint on the relay
 /// server to do QUIC address discovery.
 #[derive(Debug, Deserialize, Serialize, Clone, Eq, PartialEq, PartialOrd, Ord)]
-pub struct QuicConfig {
+pub struct RelayQuicConfig {
+    /// The port on which the connection should be bound to.
     pub port: u16,
 }
 
-impl Default for QuicConfig {
+impl Default for RelayQuicConfig {
     fn default() -> Self {
         Self {
             port: DEFAULT_RELAY_QUIC_PORT,
diff --git a/iroh-relay/src/server.rs b/iroh-relay/src/server.rs
index e923021c45..96eaa20d1e 100644
--- a/iroh-relay/src/server.rs
+++ b/iroh-relay/src/server.rs
@@ -26,7 +26,7 @@ use http::{
 };
 use hyper::body::Incoming;
 #[cfg(feature = "test-utils")]
-use iroh_base::node_addr::RelayUrl;
+use iroh_base::RelayUrl;
 use iroh_metrics::inc;
 use tokio::{
     net::{TcpListener, UdpSocket},
@@ -760,7 +760,7 @@ mod tests {
 
     use bytes::Bytes;
     use http::header::UPGRADE;
-    use iroh_base::{key::SecretKey, node_addr::RelayUrl};
+    use iroh_base::SecretKey;
 
     use super::*;
     use crate::{
diff --git a/iroh-relay/src/server/actor.rs b/iroh-relay/src/server/actor.rs
index 40970f3e21..c853f7a16c 100644
--- a/iroh-relay/src/server/actor.rs
+++ b/iroh-relay/src/server/actor.rs
@@ -6,7 +6,7 @@ use std::{collections::HashMap, time::Duration};
 
 use anyhow::{bail, Result};
 use bytes::Bytes;
-use iroh_base::key::NodeId;
+use iroh_base::NodeId;
 use iroh_metrics::{inc, inc_by};
 use time::{Date, OffsetDateTime};
 use tokio::sync::mpsc;
@@ -244,7 +244,7 @@ impl ClientCounter {
 #[cfg(test)]
 mod tests {
     use bytes::Bytes;
-    use iroh_base::key::SecretKey;
+    use iroh_base::SecretKey;
     use tokio::io::DuplexStream;
     use tokio_util::codec::Framed;
 
diff --git a/iroh-relay/src/server/client_conn.rs b/iroh-relay/src/server/client_conn.rs
index b40e0baae1..921f921a80 100644
--- a/iroh-relay/src/server/client_conn.rs
+++ b/iroh-relay/src/server/client_conn.rs
@@ -7,7 +7,7 @@ use bytes::Bytes;
 use futures_lite::FutureExt;
 use futures_sink::Sink;
 use futures_util::{SinkExt, Stream, StreamExt};
-use iroh_base::key::NodeId;
+use iroh_base::NodeId;
 use iroh_metrics::{inc, inc_by};
 use tokio::sync::mpsc;
 use tokio_util::{sync::CancellationToken, task::AbortOnDropHandle};
@@ -511,7 +511,7 @@ impl Sink<Frame> for RateLimitedRelayedStream {
 mod tests {
     use anyhow::bail;
     use bytes::Bytes;
-    use iroh_base::key::SecretKey;
+    use iroh_base::SecretKey;
     use testresult::TestResult;
     use tokio_util::codec::Framed;
 
diff --git a/iroh-relay/src/server/clients.rs b/iroh-relay/src/server/clients.rs
index 4c08fd3619..7187ddb1af 100644
--- a/iroh-relay/src/server/clients.rs
+++ b/iroh-relay/src/server/clients.rs
@@ -4,7 +4,7 @@
 use std::collections::{HashMap, HashSet};
 
 use anyhow::{bail, Result};
-use iroh_base::key::NodeId;
+use iroh_base::NodeId;
 use iroh_metrics::inc;
 use tokio::sync::mpsc;
 use tracing::{trace, warn};
@@ -228,7 +228,7 @@ mod tests {
     use std::time::Duration;
 
     use bytes::Bytes;
-    use iroh_base::key::SecretKey;
+    use iroh_base::SecretKey;
     use tokio::io::DuplexStream;
     use tokio_util::codec::{Framed, FramedRead};
 
diff --git a/iroh-relay/src/server/http_server.rs b/iroh-relay/src/server/http_server.rs
index 767f5bb975..e5da3f3594 100644
--- a/iroh-relay/src/server/http_server.rs
+++ b/iroh-relay/src/server/http_server.rs
@@ -661,7 +661,7 @@ mod tests {
 
     use anyhow::Result;
     use bytes::Bytes;
-    use iroh_base::key::{PublicKey, SecretKey};
+    use iroh_base::{PublicKey, SecretKey};
     use reqwest::Url;
     use tokio::{sync::mpsc, task::JoinHandle};
     use tokio_util::codec::{FramedRead, FramedWrite};
diff --git a/iroh/Cargo.toml b/iroh/Cargo.toml
index 71e168b9e8..d4bc71d5e7 100644
--- a/iroh/Cargo.toml
+++ b/iroh/Cargo.toml
@@ -44,7 +44,7 @@ http-body-util = "0.1.0"
 hyper = { version = "1", features = ["server", "client", "http1"] }
 hyper-util = "0.1.1"
 igd-next = { version = "0.15.1", features = ["aio_tokio"] }
-iroh-base = { version = "0.29.0", features = ["key"], path = "../iroh-base" }
+iroh-base = { version = "0.29.0", default-features = false, features = ["key", "relay"], path = "../iroh-base" }
 iroh-relay = { version = "0.29", path = "../iroh-relay", default-features = false }
 libc = "0.2.139"
 netdev = "0.31.0"
@@ -182,10 +182,11 @@ test-utils = ["iroh-relay/test-utils", "iroh-relay/server", "dep:axum"]
 discovery-local-network = ["dep:swarm-discovery"]
 discovery-pkarr-dht = ["pkarr/dht", "dep:genawaiter"]
 examples = [
-    "dep:clap",
-    "dep:tracing-subscriber",
-    "dep:indicatif",
-    "dep:parse-size",
+  "dep:clap",
+  "dep:tracing-subscriber",
+  "dep:indicatif",
+  "dep:parse-size",
+  "iroh-base/ticket"
 ]
 
 [package.metadata.docs.rs]
diff --git a/iroh/benches/key.rs b/iroh/benches/key.rs
index f208efd612..5a57f300fa 100644
--- a/iroh/benches/key.rs
+++ b/iroh/benches/key.rs
@@ -1,6 +1,6 @@
 use criterion::{black_box, criterion_group, criterion_main, BenchmarkId, Criterion};
 use crypto_box::aead::{AeadCore, AeadInPlace, OsRng};
-use iroh::key::SecretKey;
+use iroh::SecretKey;
 use rand::RngCore;
 
 pub fn seal_to(c: &mut Criterion) {
diff --git a/iroh/examples/connect-unreliable.rs b/iroh/examples/connect-unreliable.rs
index eb2d46a235..1df35e8a54 100644
--- a/iroh/examples/connect-unreliable.rs
+++ b/iroh/examples/connect-unreliable.rs
@@ -10,7 +10,7 @@ use std::net::SocketAddr;
 use anyhow::Context;
 use clap::Parser;
 use futures_lite::StreamExt;
-use iroh::{key::SecretKey, Endpoint, NodeAddr, RelayMode, RelayUrl};
+use iroh::{Endpoint, NodeAddr, RelayMode, RelayUrl, SecretKey};
 use tracing::info;
 
 // An example ALPN that we are using to communicate over the `Endpoint`
diff --git a/iroh/examples/connect.rs b/iroh/examples/connect.rs
index ec287903b2..936b605502 100644
--- a/iroh/examples/connect.rs
+++ b/iroh/examples/connect.rs
@@ -10,7 +10,7 @@ use std::net::SocketAddr;
 use anyhow::Context;
 use clap::Parser;
 use futures_lite::StreamExt;
-use iroh::{key::SecretKey, Endpoint, NodeAddr, RelayMode, RelayUrl};
+use iroh::{Endpoint, NodeAddr, RelayMode, RelayUrl, SecretKey};
 use tracing::info;
 
 // An example ALPN that we are using to communicate over the `Endpoint`
diff --git a/iroh/examples/dht_discovery.rs b/iroh/examples/dht_discovery.rs
index ffe4b542dd..4682329ba0 100644
--- a/iroh/examples/dht_discovery.rs
+++ b/iroh/examples/dht_discovery.rs
@@ -61,7 +61,7 @@ fn build_discovery(args: Args) -> iroh::discovery::pkarr::dht::Builder {
 }
 
 async fn chat_server(args: Args) -> anyhow::Result<()> {
-    let secret_key = iroh::key::SecretKey::generate();
+    let secret_key = iroh::SecretKey::generate();
     let node_id = secret_key.public();
     let discovery = build_discovery(args)
         .secret_key(secret_key.clone())
@@ -107,7 +107,7 @@ async fn chat_server(args: Args) -> anyhow::Result<()> {
 
 async fn chat_client(args: Args) -> anyhow::Result<()> {
     let remote_node_id = args.node_id.unwrap();
-    let secret_key = iroh::key::SecretKey::generate();
+    let secret_key = iroh::SecretKey::generate();
     let node_id = secret_key.public();
     // note: we don't pass a secret key here, because we don't need to publish our address, don't spam the DHT
     let discovery = build_discovery(args).build()?;
diff --git a/iroh/examples/listen-unreliable.rs b/iroh/examples/listen-unreliable.rs
index 6f38827e52..956c383f0f 100644
--- a/iroh/examples/listen-unreliable.rs
+++ b/iroh/examples/listen-unreliable.rs
@@ -5,7 +5,7 @@
 //!     $ cargo run --example listen-unreliable
 use anyhow::Context;
 use futures_lite::StreamExt;
-use iroh::{key::SecretKey, Endpoint, RelayMode};
+use iroh::{Endpoint, RelayMode, SecretKey};
 use tracing::{info, warn};
 
 // An example ALPN that we are using to communicate over the `Endpoint`
diff --git a/iroh/examples/listen.rs b/iroh/examples/listen.rs
index a27b5f3067..9876a08889 100644
--- a/iroh/examples/listen.rs
+++ b/iroh/examples/listen.rs
@@ -7,7 +7,7 @@ use std::time::Duration;
 
 use anyhow::Context;
 use futures_lite::StreamExt;
-use iroh::{endpoint::ConnectionError, key::SecretKey, Endpoint, RelayMode};
+use iroh::{endpoint::ConnectionError, Endpoint, RelayMode, SecretKey};
 use tracing::{debug, info, warn};
 
 // An example ALPN that we are using to communicate over the `Endpoint`
diff --git a/iroh/examples/locally-discovered-nodes.rs b/iroh/examples/locally-discovered-nodes.rs
index 45c9b924e4..5706520209 100644
--- a/iroh/examples/locally-discovered-nodes.rs
+++ b/iroh/examples/locally-discovered-nodes.rs
@@ -6,8 +6,7 @@
 use std::time::Duration;
 
 use iroh::{
-    discovery::local_swarm_discovery::LocalSwarmDiscovery, endpoint::Source, key::SecretKey,
-    Endpoint,
+    discovery::local_swarm_discovery::LocalSwarmDiscovery, endpoint::Source, Endpoint, SecretKey,
 };
 
 #[tokio::main]
diff --git a/iroh/examples/transfer.rs b/iroh/examples/transfer.rs
index 5f7c2e22c2..a292ea4977 100644
--- a/iroh/examples/transfer.rs
+++ b/iroh/examples/transfer.rs
@@ -9,9 +9,9 @@ use clap::{Parser, Subcommand};
 use futures_lite::StreamExt;
 use indicatif::HumanBytes;
 use iroh::{
-    endpoint::ConnectionError, key::SecretKey, ticket::NodeTicket, Endpoint, NodeAddr, RelayMap,
-    RelayMode, RelayUrl,
+    endpoint::ConnectionError, Endpoint, NodeAddr, RelayMap, RelayMode, RelayUrl, SecretKey,
 };
+use iroh_base::ticket::NodeTicket;
 use tracing::info;
 // Transfer ALPN that we are using to communicate over the `Endpoint`
 const TRANSFER_ALPN: &[u8] = b"n0/iroh/transfer/example/0";
diff --git a/iroh/src/defaults.rs b/iroh/src/defaults.rs
index ac81b01cdc..9c910f003e 100644
--- a/iroh/src/defaults.rs
+++ b/iroh/src/defaults.rs
@@ -1,20 +1,17 @@
 //! Default values used in [`iroh`][`crate`]
 
-use iroh_base::relay_map::QuicConfig;
 /// The default QUIC port used by the Relay server to accept QUIC connections
 /// for QUIC address discovery
 ///
 /// The port is "QUIC" typed on a phone keypad.
-pub use iroh_base::relay_map::DEFAULT_RELAY_QUIC_PORT;
+pub use iroh_relay::defaults::DEFAULT_RELAY_QUIC_PORT;
 /// The default STUN port used by the Relay server.
 ///
 /// The STUN port as defined by [RFC
 /// 8489](<https://www.rfc-editor.org/rfc/rfc8489#section-18.6>)
-pub use iroh_base::relay_map::DEFAULT_STUN_PORT;
+pub use iroh_relay::defaults::DEFAULT_STUN_PORT;
 use url::Url;
 
-use crate::{RelayMap, RelayNode};
-
 /// The default HTTP port used by the Relay server.
 pub const DEFAULT_HTTP_PORT: u16 = 80;
 
@@ -26,7 +23,7 @@ pub const DEFAULT_METRICS_PORT: u16 = 9090;
 
 /// Production configuration.
 pub mod prod {
-    use iroh_base::relay_map::QuicConfig;
+    use iroh_relay::{RelayMap, RelayNode, RelayQuicConfig};
 
     use super::*;
 
@@ -57,7 +54,7 @@ pub mod prod {
             url: url.into(),
             stun_only: false,
             stun_port: DEFAULT_STUN_PORT,
-            quic: Some(QuicConfig::default()),
+            quic: Some(RelayQuicConfig::default()),
         }
     }
 
@@ -71,7 +68,7 @@ pub mod prod {
             url: url.into(),
             stun_only: false,
             stun_port: DEFAULT_STUN_PORT,
-            quic: Some(QuicConfig::default()),
+            quic: Some(RelayQuicConfig::default()),
         }
     }
 
@@ -85,7 +82,7 @@ pub mod prod {
             url: url.into(),
             stun_only: false,
             stun_port: DEFAULT_STUN_PORT,
-            quic: Some(QuicConfig::default()),
+            quic: Some(RelayQuicConfig::default()),
         }
     }
 }
@@ -96,6 +93,8 @@ pub mod prod {
 ///
 /// Note: we have staging servers in EU and NA, but no corresponding staging server for AP at this time.
 pub mod staging {
+    use iroh_relay::{RelayMap, RelayNode, RelayQuicConfig};
+
     use super::*;
 
     /// Hostname of the default NA relay.
@@ -119,7 +118,7 @@ pub mod staging {
             url: url.into(),
             stun_only: false,
             stun_port: DEFAULT_STUN_PORT,
-            quic: Some(QuicConfig::default()),
+            quic: Some(RelayQuicConfig::default()),
         }
     }
 
@@ -133,7 +132,7 @@ pub mod staging {
             url: url.into(),
             stun_only: false,
             stun_port: DEFAULT_STUN_PORT,
-            quic: Some(QuicConfig::default()),
+            quic: Some(RelayQuicConfig::default()),
         }
     }
 }
diff --git a/iroh/src/disco.rs b/iroh/src/disco.rs
index 0f64f94756..5d06f73c42 100644
--- a/iroh/src/disco.rs
+++ b/iroh/src/disco.rs
@@ -24,13 +24,10 @@ use std::{
 };
 
 use anyhow::{anyhow, bail, ensure, Context, Result};
-use iroh_relay::RelayUrl;
+use iroh_base::{PublicKey, RelayUrl};
 use serde::{Deserialize, Serialize};
 use url::Url;
 
-use super::key::PublicKey;
-use crate::key;
-
 // TODO: custom magicn
 /// The 6 byte header of all discovery messages.
 pub const MAGIC: &str = "TS💬"; // 6 bytes: 0x54 53 f0 9f 92 ac
@@ -47,7 +44,7 @@ const TX_LEN: usize = 12;
 /// Header: Type | Version
 const HEADER_LEN: usize = 2;
 
-const PING_LEN: usize = TX_LEN + key::PUBLIC_KEY_LENGTH;
+const PING_LEN: usize = TX_LEN + iroh_base::PUBLIC_KEY_LENGTH;
 const EP_LENGTH: usize = 16 + 2; // 16 byte IP address + 2 byte port
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
@@ -209,7 +206,7 @@ impl Ping {
         // Deliberately lax on longer-than-expected messages, for future compatibility.
         ensure!(p.len() >= PING_LEN, "message too short");
         let tx_id: [u8; TX_LEN] = p[..TX_LEN].try_into().expect("length checked");
-        let raw_key = &p[TX_LEN..TX_LEN + key::PUBLIC_KEY_LENGTH];
+        let raw_key = &p[TX_LEN..TX_LEN + iroh_base::PUBLIC_KEY_LENGTH];
         let node_key = PublicKey::try_from(raw_key)?;
         let tx_id = stun_rs::TransactionId::from(tx_id);
 
@@ -404,8 +401,9 @@ const fn msg_header(t: MessageType, ver: u8) -> [u8; HEADER_LEN] {
 
 #[cfg(test)]
 mod tests {
+    use iroh_base::SecretKey;
+
     use super::*;
-    use crate::key::SecretKey;
 
     #[test]
     fn test_to_from_bytes() {
diff --git a/iroh/src/discovery.rs b/iroh/src/discovery.rs
index e0ea5d32c1..9a87cd4578 100644
--- a/iroh/src/discovery.rs
+++ b/iroh/src/discovery.rs
@@ -50,8 +50,7 @@
 //! ```no_run
 //! use iroh::{
 //!     discovery::{dns::DnsDiscovery, pkarr::PkarrPublisher, ConcurrentDiscovery},
-//!     key::SecretKey,
-//!     Endpoint,
+//!     Endpoint, SecretKey,
 //! };
 //!
 //! # async fn wrapper() -> anyhow::Result<()> {
@@ -85,7 +84,7 @@
 //! # use iroh::discovery::local_swarm_discovery::LocalSwarmDiscovery;
 //! # use iroh::discovery::pkarr::PkarrPublisher;
 //! # use iroh::discovery::ConcurrentDiscovery;
-//! # use iroh::key::SecretKey;
+//! # use iroh::SecretKey;
 //! #
 //! # async fn wrapper() -> anyhow::Result<()> {
 //! # let secret_key = SecretKey::generate();
@@ -99,7 +98,7 @@
 //! # }
 //! ```
 //!
-//! [`RelayUrl`]: crate::relay::RelayUrl
+//! [`RelayUrl`]: crate::RelayUrl
 //! [`Builder::discovery`]: crate::endpoint::Builder::discovery
 //! [`DnsDiscovery`]: dns::DnsDiscovery
 //! [Number 0]: https://n0.computer
@@ -116,12 +115,11 @@ use std::{collections::BTreeSet, net::SocketAddr, time::Duration};
 
 use anyhow::{anyhow, ensure, Result};
 use futures_lite::stream::{Boxed as BoxStream, StreamExt};
-use iroh_base::node_addr::NodeAddr;
-use iroh_relay::RelayUrl;
+use iroh_base::{NodeAddr, NodeId, RelayUrl};
 use tokio::{sync::oneshot, task::JoinHandle};
 use tracing::{debug, error_span, warn, Instrument};
 
-use crate::{Endpoint, NodeId};
+use crate::Endpoint;
 
 pub mod dns;
 
@@ -145,7 +143,7 @@ pub mod static_provider;
 /// discovery information changes. If a discovery mechanism requires a periodic
 /// refresh, it should start its own task.
 ///
-/// [`RelayUrl`]: crate::relay::RelayUrl
+/// [`RelayUrl`]: crate::RelayUrl
 pub trait Discovery: std::fmt::Debug + Send + Sync {
     /// Publishes the given [`RelayUrl`] and direct addreesses to the discovery mechanism.
     ///
@@ -447,12 +445,13 @@ mod tests {
         time::SystemTime,
     };
 
+    use iroh_base::SecretKey;
     use parking_lot::Mutex;
     use rand::Rng;
     use tokio_util::task::AbortOnDropHandle;
 
     use super::*;
-    use crate::{key::SecretKey, RelayMode};
+    use crate::RelayMode;
 
     type InfoStore = HashMap<NodeId, (Option<RelayUrl>, BTreeSet<SocketAddr>, u64)>;
 
@@ -738,7 +737,8 @@ mod test_dns_pkarr {
     use std::time::Duration;
 
     use anyhow::Result;
-    use iroh_base::key::SecretKey;
+    use iroh_base::{NodeAddr, SecretKey};
+    use iroh_relay::RelayMap;
     use tokio_util::task::AbortOnDropHandle;
 
     use crate::{
@@ -749,7 +749,7 @@ mod test_dns_pkarr {
             pkarr_dns_state::State,
             run_relay_server, DnsPkarrServer,
         },
-        Endpoint, NodeAddr, RelayMap, RelayMode,
+        Endpoint, RelayMode,
     };
 
     const PUBLISH_TIMEOUT: Duration = Duration::from_secs(10);
diff --git a/iroh/src/discovery/dns.rs b/iroh/src/discovery/dns.rs
index def6e148c1..9e45ea201d 100644
--- a/iroh/src/discovery/dns.rs
+++ b/iroh/src/discovery/dns.rs
@@ -2,12 +2,13 @@
 
 use anyhow::Result;
 use futures_lite::stream::Boxed as BoxStream;
+use iroh_base::NodeId;
 
 use crate::{
     discovery::{Discovery, DiscoveryItem},
     dns::ResolverExt,
     endpoint::force_staging_infra,
-    Endpoint, NodeId,
+    Endpoint,
 };
 
 /// The n0 testing DNS node origin, for production.
diff --git a/iroh/src/discovery/local_swarm_discovery.rs b/iroh/src/discovery/local_swarm_discovery.rs
index 99e0638c6c..4ccabe9b61 100644
--- a/iroh/src/discovery/local_swarm_discovery.rs
+++ b/iroh/src/discovery/local_swarm_discovery.rs
@@ -40,8 +40,7 @@ use anyhow::Result;
 use derive_more::FromStr;
 use futures_lite::stream::Boxed as BoxStream;
 use futures_util::FutureExt;
-use iroh_base::{key::PublicKey, node_addr::NodeAddr};
-use iroh_relay::RelayUrl;
+use iroh_base::{NodeAddr, NodeId, PublicKey, RelayUrl};
 use swarm_discovery::{Discoverer, DropGuard, IpClass, Peer};
 use tokio::{
     sync::mpsc::{
@@ -56,7 +55,7 @@ use watchable::Watchable;
 
 use crate::{
     discovery::{Discovery, DiscoveryItem},
-    Endpoint, NodeId,
+    Endpoint,
 };
 
 /// The n0 local swarm node discovery name
@@ -401,6 +400,7 @@ mod tests {
     /// tests)
     mod run_in_isolation {
         use futures_lite::StreamExt;
+        use iroh_base::SecretKey;
         use testresult::TestResult;
 
         use super::super::*;
@@ -480,7 +480,7 @@ mod tests {
         }
 
         fn make_discoverer() -> Result<(PublicKey, LocalSwarmDiscovery)> {
-            let node_id = crate::key::SecretKey::generate().public();
+            let node_id = SecretKey::generate().public();
             Ok((node_id, LocalSwarmDiscovery::new(node_id)?))
         }
     }
diff --git a/iroh/src/discovery/pkarr.rs b/iroh/src/discovery/pkarr.rs
index 1e40518803..4912dbb797 100644
--- a/iroh/src/discovery/pkarr.rs
+++ b/iroh/src/discovery/pkarr.rs
@@ -38,9 +38,9 @@
 //! [pkarr]: https://pkarr.org
 //! [DNS Resource Records]: https://en.wikipedia.org/wiki/Domain_Name_System#Resource_records
 //! [Mainline DHT]: https://en.wikipedia.org/wiki/Mainline_DHT
-//! [`SecretKey`]: crate::key::SecretKey
-//! [`PublicKey`]: crate::key::PublicKey
-//! [`NodeId`]: crate::key::NodeId
+//! [`SecretKey`]: crate::SecretKey
+//! [`PublicKey`]: crate::PublicKey
+//! [`NodeId`]: crate::NodeId
 //! [`DnsDiscovery`]: crate::discovery::dns::DnsDiscovery
 //! [`DhtDiscovery`]: dht::DhtDiscovery
 
@@ -48,7 +48,7 @@ use std::{collections::BTreeSet, net::SocketAddr, sync::Arc};
 
 use anyhow::{anyhow, bail, Result};
 use futures_util::stream::BoxStream;
-use iroh_relay::RelayUrl;
+use iroh_base::{NodeId, RelayUrl, SecretKey};
 use pkarr::SignedPacket;
 use tokio::{
     task::JoinHandle,
@@ -62,8 +62,7 @@ use crate::{
     discovery::{Discovery, DiscoveryItem},
     dns::node_info::NodeInfo,
     endpoint::force_staging_infra,
-    key::SecretKey,
-    Endpoint, NodeId,
+    Endpoint,
 };
 
 #[cfg(feature = "discovery-pkarr-dht")]
@@ -111,7 +110,7 @@ pub const DEFAULT_REPUBLISH_INTERVAL: Duration = Duration::from_secs(60 * 5);
 ///
 /// [pkarr]: https://pkarr.org
 /// [module docs]: crate::discovery::pkarr
-/// [`RelayUrl`]: crate::relay::RelayUrl
+/// [`RelayUrl`]: crate::RelayUrl
 /// [`ConcurrentDiscovery`]: super::ConcurrentDiscovery
 #[derive(derive_more::Debug, Clone)]
 pub struct PkarrPublisher {
diff --git a/iroh/src/discovery/pkarr/dht.rs b/iroh/src/discovery/pkarr/dht.rs
index 7a829551f8..91dc42a682 100644
--- a/iroh/src/discovery/pkarr/dht.rs
+++ b/iroh/src/discovery/pkarr/dht.rs
@@ -14,8 +14,7 @@ use std::{
 
 use futures_lite::{stream::Boxed, StreamExt};
 use genawaiter::sync::{Co, Gen};
-use iroh_base::node_addr::NodeAddr;
-use iroh_relay::RelayUrl;
+use iroh_base::{NodeAddr, NodeId, RelayUrl, SecretKey};
 use pkarr::{
     PkarrClient, PkarrClientAsync, PkarrRelayClient, PkarrRelayClientAsync, PublicKey,
     RelaySettings, SignedPacket,
@@ -29,8 +28,7 @@ use crate::{
         Discovery, DiscoveryItem,
     },
     dns::node_info::NodeInfo,
-    key::SecretKey,
-    Endpoint, NodeId,
+    Endpoint,
 };
 
 /// Republish delay for the DHT.
@@ -405,7 +403,7 @@ impl Discovery for DhtDiscovery {
 mod tests {
     use std::collections::BTreeSet;
 
-    use iroh_base::node_addr::RelayUrl;
+    use iroh_base::RelayUrl;
     use pkarr::mainline::dht::DhtSettings;
     use testresult::TestResult;
 
diff --git a/iroh/src/discovery/static_provider.rs b/iroh/src/discovery/static_provider.rs
index be620ce860..aa7585bc6e 100644
--- a/iroh/src/discovery/static_provider.rs
+++ b/iroh/src/discovery/static_provider.rs
@@ -7,8 +7,7 @@ use std::{
 };
 
 use futures_lite::stream::{self, StreamExt};
-use iroh_base::{key::NodeId, node_addr::NodeAddr};
-use iroh_relay::RelayUrl;
+use iroh_base::{NodeAddr, NodeId, RelayUrl};
 
 use super::{Discovery, DiscoveryItem};
 
@@ -39,22 +38,25 @@ impl StaticProvider {
     ///
     /// Example:
     /// ```rust
-    /// use std::str::FromStr;
+    /// use std::{net::SocketAddr, str::FromStr};
     ///
-    /// use iroh_base::ticket::NodeTicket;
-    /// use iroh::{Endpoint, discovery::static_provider::StaticProvider};
+    /// use iroh::{discovery::static_provider::StaticProvider, Endpoint, NodeAddr};
     ///
-    /// # async fn example() -> anyhow::Result<()> {
-    /// # #[derive(Default)] struct Args { tickets: Vec<NodeTicket> }
-    /// # let args = Args::default();
-    /// // get tickets from command line args
-    /// let tickets: Vec<NodeTicket> = args.tickets;
-    /// // create a StaticProvider from the tickets. Ticket info will be combined if multiple tickets refer to the same node.
-    /// let discovery = StaticProvider::from_node_addrs(tickets);
+    /// # fn get_addrs() -> Vec<NodeAddr> {
+    /// #     Vec::new()
+    /// # }
+    /// # #[tokio::main]
+    /// # async fn main() -> anyhow::Result<()> {
+    /// // get addrs from somewhere
+    /// let addrs = get_addrs();
+    ///
+    /// // create a StaticProvider from the list of addrs.
+    /// let discovery = StaticProvider::from_node_addrs(addrs);
     /// // create an endpoint with the discovery
     /// let endpoint = Endpoint::builder()
     ///     .add_discovery(|_| Some(discovery))
-    ///     .bind().await?;
+    ///     .bind()
+    ///     .await?;
     /// # Ok(())
     /// # }
     /// ```
diff --git a/iroh/src/dns.rs b/iroh/src/dns.rs
index 0a98c871b0..9f39cb4f0f 100644
--- a/iroh/src/dns.rs
+++ b/iroh/src/dns.rs
@@ -14,7 +14,7 @@ use std::{
 use anyhow::Result;
 use futures_lite::{Future, StreamExt};
 use hickory_resolver::{IntoName, Resolver, TokioResolver};
-use iroh_base::{key::NodeId, node_addr::NodeAddr};
+use iroh_base::{NodeAddr, NodeId};
 use once_cell::sync::Lazy;
 
 pub mod node_info;
diff --git a/iroh/src/dns/node_info.rs b/iroh/src/dns/node_info.rs
index bd5f0330a5..4f5134323e 100644
--- a/iroh/src/dns/node_info.rs
+++ b/iroh/src/dns/node_info.rs
@@ -28,7 +28,7 @@
 //! [Pkarr]: https://app.pkarr.org
 //! [z-base-32]: https://philzimmermann.com/docs/human-oriented-base-32-encoding.txt
 //! [RFC1464]: https://www.rfc-editor.org/rfc/rfc1464
-//! [`RelayUrl`]: iroh_base::node_addr::RelayUrl
+//! [`RelayUrl`]: crate::RelayUrl
 //! [`N0_DNS_NODE_ORIGIN_PROD`]: crate::discovery::dns::N0_DNS_NODE_ORIGIN_PROD
 //! [`N0_DNS_NODE_ORIGIN_STAGING`]: crate::discovery::dns::N0_DNS_NODE_ORIGIN_STAGING
 
@@ -42,10 +42,9 @@ use std::{
 
 use anyhow::{anyhow, ensure, Result};
 use hickory_resolver::{proto::ProtoError, Name, TokioResolver};
+use iroh_base::{NodeAddr, NodeId, SecretKey};
 use url::Url;
 
-use crate::{key::SecretKey, NodeAddr, NodeId};
-
 /// The DNS name for the iroh TXT record.
 pub const IROH_TXT_NAME: &str = "_iroh";
 
@@ -408,7 +407,7 @@ fn node_domain(node_id: &NodeId, origin: &str) -> Result<Name> {
 mod tests {
     use std::str::FromStr;
 
-    use iroh_base::key::SecretKey;
+    use iroh_base::SecretKey;
 
     use super::NodeInfo;
 
diff --git a/iroh/src/endpoint.rs b/iroh/src/endpoint.rs
index cfe457b8cb..3d795cb04f 100644
--- a/iroh/src/endpoint.rs
+++ b/iroh/src/endpoint.rs
@@ -24,7 +24,8 @@ use std::{
 use anyhow::{anyhow, bail, Context, Result};
 use derive_more::Debug;
 use futures_lite::{Stream, StreamExt};
-use iroh_base::relay_map::RelayMap;
+use iroh_base::{NodeAddr, NodeId, PublicKey, RelayUrl, SecretKey};
+use iroh_relay::RelayMap;
 use pin_project::pin_project;
 use tokio_util::sync::CancellationToken;
 use tracing::{debug, instrument, trace, warn};
@@ -35,15 +36,12 @@ use crate::{
         dns::DnsDiscovery, pkarr::PkarrPublisher, ConcurrentDiscovery, Discovery, DiscoveryTask,
     },
     dns::{default_resolver, DnsResolver},
-    key::{PublicKey, SecretKey},
     magicsock::{self, Handle, QuicMappedAddr},
-    tls, NodeId, RelayUrl,
+    tls,
 };
 
 mod rtt_actor;
 
-pub use bytes::Bytes;
-pub use iroh_base::node_addr::NodeAddr;
 // Missing still: SendDatagram and ConnectionClose::frame_type's Type.
 pub use quinn::{
     AcceptBi, AcceptUni, AckFrequencyConfig, ApplicationClose, Chunk, ClosedStream, Connection,
diff --git a/iroh/src/endpoint/rtt_actor.rs b/iroh/src/endpoint/rtt_actor.rs
index d72fdc61dd..2315bbfd26 100644
--- a/iroh/src/endpoint/rtt_actor.rs
+++ b/iroh/src/endpoint/rtt_actor.rs
@@ -4,7 +4,7 @@ use std::collections::HashMap;
 
 use futures_concurrency::stream::stream_group;
 use futures_lite::StreamExt;
-use iroh_base::key::NodeId;
+use iroh_base::NodeId;
 use iroh_metrics::inc;
 use tokio::{
     sync::{mpsc, Notify},
diff --git a/iroh/src/lib.rs b/iroh/src/lib.rs
index 05aeedbb85..50106e40f7 100644
--- a/iroh/src/lib.rs
+++ b/iroh/src/lib.rs
@@ -184,7 +184,7 @@
 //! ```no_run
 //! use anyhow::{Context, Result};
 //! use futures_lite::StreamExt;
-//! use iroh::{ticket::NodeTicket, Endpoint, NodeAddr};
+//! use iroh::{Endpoint, NodeAddr};
 //!
 //! async fn accept() -> Result<()> {
 //!     // To accept connections at least one ALPN must be configured.
@@ -212,15 +212,14 @@
 //!
 //! [QUIC]: https://quickwg.org
 //! [bi-directional streams]: crate::endpoint::Connection::open_bi
-//! [`NodeTicket`]: crate::ticket::NodeTicket
 //! [hole punching]: https://en.wikipedia.org/wiki/Hole_punching_(networking)
 //! [socket addresses]: https://doc.rust-lang.org/stable/std/net/enum.SocketAddr.html
 //! [STUN]: https://en.wikipedia.org/wiki/STUN
 //! [ALPN]: https://en.wikipedia.org/wiki/Application-Layer_Protocol_Negotiation
 //! [HTTP3]: https://en.wikipedia.org/wiki/HTTP/3
-//! [`SecretKey`]: crate::key::SecretKey
-//! [`PublicKey`]: crate::key::PublicKey
-//! [`RelayUrl`]: crate::relay::RelayUrl
+//! [`SecretKey`]: crate::SecretKey
+//! [`PublicKey`]: crate::PublicKey
+//! [`RelayUrl`]: crate::RelayUrl
 //! [`discovery`]: crate::endpoint::Builder::discovery
 //! [`DnsDiscovery`]: crate::discovery::dns::DnsDiscovery
 //! [number 0]: https://n0.computer
@@ -233,26 +232,22 @@
 #![deny(missing_docs, rustdoc::broken_intra_doc_links)]
 #![cfg_attr(iroh_docsrs, feature(doc_auto_cfg))]
 
-pub mod defaults;
 mod disco;
+mod magicsock;
+
+pub(crate) mod util;
+
+pub mod defaults;
 pub mod discovery;
 pub mod dns;
 pub mod endpoint;
-mod magicsock;
 pub mod metrics;
 pub mod protocol;
 mod tls;
 
-pub(crate) mod util;
-
-pub use endpoint::{Endpoint, NodeAddr, RelayMode};
-pub use iroh_base::{
-    hash, key,
-    key::NodeId,
-    relay_map::{RelayMap, RelayNode, RelayUrl},
-    ticket,
-};
-pub use iroh_relay as relay;
+pub use endpoint::{Endpoint, RelayMode};
+pub use iroh_base::{KeyParsingError, NodeAddr, NodeId, PublicKey, RelayUrl, SecretKey};
+pub use iroh_relay::{RelayMap, RelayNode};
 
 #[cfg(any(test, feature = "test-utils"))]
 pub mod test_utils;
diff --git a/iroh/src/magicsock.rs b/iroh/src/magicsock.rs
index 4c390a1122..6e3cf6d9c2 100644
--- a/iroh/src/magicsock.rs
+++ b/iroh/src/magicsock.rs
@@ -34,9 +34,9 @@ use bytes::Bytes;
 use concurrent_queue::ConcurrentQueue;
 use futures_lite::{FutureExt, Stream, StreamExt};
 use futures_util::{stream::BoxStream, task::AtomicWaker};
-use iroh_base::key::NodeId;
+use iroh_base::{NodeAddr, NodeId, PublicKey, RelayUrl, SecretKey, SharedSecret};
 use iroh_metrics::{inc, inc_by};
-use iroh_relay::protos::stun;
+use iroh_relay::{protos::stun, RelayMap};
 use netwatch::{interfaces, ip::LocalAddresses, netmon, UdpSocket};
 use quinn::AsyncUdpSocket;
 use rand::{seq::SliceRandom, Rng, SeedableRng};
@@ -65,9 +65,6 @@ use crate::{
     disco::{self, CallMeMaybe, SendAddr},
     discovery::{Discovery, DiscoveryItem},
     dns::DnsResolver,
-    endpoint::NodeAddr,
-    key::{PublicKey, SecretKey, SharedSecret},
-    RelayMap, RelayUrl,
 };
 
 mod metrics;
diff --git a/iroh/src/magicsock/node_map.rs b/iroh/src/magicsock/node_map.rs
index 64c1351e7b..4cc835203c 100644
--- a/iroh/src/magicsock/node_map.rs
+++ b/iroh/src/magicsock/node_map.rs
@@ -8,9 +8,8 @@ use std::{
 };
 
 use futures_lite::stream::Stream;
-use iroh_base::key::NodeId;
+use iroh_base::{NodeAddr, NodeId, PublicKey, RelayUrl};
 use iroh_metrics::inc;
-use iroh_relay::RelayUrl;
 use parking_lot::Mutex;
 use serde::{Deserialize, Serialize};
 use stun_rs::TransactionId;
@@ -23,11 +22,7 @@ use self::{
 use super::{
     metrics::Metrics as MagicsockMetrics, ActorMessage, DiscoMessageSource, QuicMappedAddr,
 };
-use crate::{
-    disco::{CallMeMaybe, Pong, SendAddr},
-    key::PublicKey,
-    NodeAddr,
-};
+use crate::disco::{CallMeMaybe, Pong, SendAddr};
 
 mod best_addr;
 mod node_state;
@@ -654,8 +649,9 @@ impl IpPort {
 mod tests {
     use std::net::Ipv4Addr;
 
+    use iroh_base::SecretKey;
+
     use super::{node_state::MAX_INACTIVE_DIRECT_ADDRESSES, *};
-    use crate::key::SecretKey;
 
     impl NodeMap {
         #[track_caller]
diff --git a/iroh/src/magicsock/node_map/node_state.rs b/iroh/src/magicsock/node_map/node_state.rs
index 3a0e351e5e..a0b0104a60 100644
--- a/iroh/src/magicsock/node_map/node_state.rs
+++ b/iroh/src/magicsock/node_map/node_state.rs
@@ -5,8 +5,9 @@ use std::{
     time::{Duration, Instant},
 };
 
+use iroh_base::{NodeAddr, NodeId, PublicKey, RelayUrl};
 use iroh_metrics::inc;
-use iroh_relay::{protos::stun, RelayUrl};
+use iroh_relay::protos::stun;
 use netwatch::ip::is_unicast_link_local;
 use serde::{Deserialize, Serialize};
 use tokio::sync::mpsc;
@@ -21,10 +22,8 @@ use super::{
 };
 use crate::{
     disco::{self, SendAddr},
-    key::PublicKey,
     magicsock::{ActorMessage, MagicsockMetrics, QuicMappedAddr, Timer, HEARTBEAT_INTERVAL},
     util::relay_only_mode,
-    NodeAddr, NodeId,
 };
 
 /// Number of addresses that are not active that we keep around per node.
@@ -1430,12 +1429,10 @@ mod tests {
     use std::{collections::BTreeMap, net::Ipv4Addr};
 
     use best_addr::BestAddr;
+    use iroh_base::SecretKey;
 
     use super::*;
-    use crate::{
-        key::SecretKey,
-        magicsock::node_map::{NodeMap, NodeMapInner},
-    };
+    use crate::magicsock::node_map::{NodeMap, NodeMapInner};
 
     #[test]
     fn test_remote_infos() {
diff --git a/iroh/src/magicsock/node_map/path_state.rs b/iroh/src/magicsock/node_map/path_state.rs
index 66e9ea991d..8279bf7cbd 100644
--- a/iroh/src/magicsock/node_map/path_state.rs
+++ b/iroh/src/magicsock/node_map/path_state.rs
@@ -6,7 +6,7 @@ use std::{
     time::{Duration, Instant},
 };
 
-use iroh_base::key::NodeId;
+use iroh_base::NodeId;
 use iroh_relay::protos::stun;
 use tracing::{debug, event, Level};
 
diff --git a/iroh/src/magicsock/relay_actor.rs b/iroh/src/magicsock/relay_actor.rs
index 86aed8d708..a239f8296e 100644
--- a/iroh/src/magicsock/relay_actor.rs
+++ b/iroh/src/magicsock/relay_actor.rs
@@ -13,8 +13,9 @@ use std::{
 use anyhow::Context;
 use backoff::backoff::Backoff;
 use bytes::{Bytes, BytesMut};
+use iroh_base::{NodeId, RelayUrl, PUBLIC_KEY_LENGTH};
 use iroh_metrics::{inc, inc_by};
-use iroh_relay::{self as relay, client::ClientError, ReceivedMessage, RelayUrl, MAX_PACKET_SIZE};
+use iroh_relay::{self as relay, client::ClientError, ReceivedMessage, MAX_PACKET_SIZE};
 use tokio::{
     sync::{mpsc, oneshot},
     task::{JoinHandle, JoinSet},
@@ -23,9 +24,8 @@ use tokio::{
 use tokio_util::sync::CancellationToken;
 use tracing::{debug, error, info, info_span, trace, warn, Instrument};
 
-use crate::{
-    key::{NodeId, PUBLIC_KEY_LENGTH},
-    magicsock::{MagicSock, Metrics as MagicsockMetrics, RelayContents, RelayDatagramsQueue},
+use crate::magicsock::{
+    MagicSock, Metrics as MagicsockMetrics, RelayContents, RelayDatagramsQueue,
 };
 
 /// How long a non-home relay connection needs to be idle (last written to) before we close it.
diff --git a/iroh/src/magicsock/udp_conn.rs b/iroh/src/magicsock/udp_conn.rs
index 8626c3fcec..c4ed67a9f5 100644
--- a/iroh/src/magicsock/udp_conn.rs
+++ b/iroh/src/magicsock/udp_conn.rs
@@ -132,17 +132,18 @@ impl quinn::UdpPoller for IoPoller {
 #[cfg(test)]
 mod tests {
     use anyhow::Result;
+    use iroh_base::SecretKey;
     use netwatch::IpFamily;
     use tokio::sync::mpsc;
     use tracing::{info_span, Instrument};
 
     use super::*;
-    use crate::{key, tls};
+    use crate::tls;
 
     const ALPN: &[u8] = b"n0/test/1";
 
-    fn wrap_socket(conn: impl AsyncUdpSocket) -> Result<(quinn::Endpoint, key::SecretKey)> {
-        let key = key::SecretKey::generate();
+    fn wrap_socket(conn: impl AsyncUdpSocket) -> Result<(quinn::Endpoint, SecretKey)> {
+        let key = SecretKey::generate();
         let quic_server_config = tls::make_server_config(&key, vec![ALPN.to_vec()], false)?;
         let server_config = quinn::ServerConfig::with_crypto(Arc::new(quic_server_config));
         let mut quic_ep = quinn::Endpoint::new_with_abstract_socket(
diff --git a/iroh/src/test_utils.rs b/iroh/src/test_utils.rs
index dbbd5a4ead..ce31859a90 100644
--- a/iroh/src/test_utils.rs
+++ b/iroh/src/test_utils.rs
@@ -4,12 +4,14 @@ use std::net::Ipv4Addr;
 use anyhow::Result;
 pub use dns_and_pkarr_servers::DnsPkarrServer;
 pub use dns_server::create_dns_resolver;
-use iroh_relay::server::{
-    CertConfig, QuicConfig, RelayConfig, Server, ServerConfig, StunConfig, TlsConfig,
+use iroh_base::RelayUrl;
+use iroh_relay::{
+    server::{CertConfig, QuicConfig, RelayConfig, Server, ServerConfig, StunConfig, TlsConfig},
+    RelayMap, RelayNode, RelayQuicConfig,
 };
 use tokio::sync::oneshot;
 
-use crate::{defaults::DEFAULT_STUN_PORT, RelayMap, RelayNode, RelayUrl};
+use crate::defaults::DEFAULT_STUN_PORT;
 
 /// A drop guard to clean up test infrastructure.
 ///
@@ -94,7 +96,7 @@ pub async fn run_relay_server_with(
         .unwrap();
     let quic = server
         .quic_addr()
-        .map(|addr| iroh_base::relay_map::QuicConfig { port: addr.port() });
+        .map(|addr| RelayQuicConfig { port: addr.port() });
     let m = RelayMap::from_nodes([RelayNode {
         url: url.clone(),
         stun_only: false,
@@ -109,7 +111,7 @@ pub(crate) mod dns_and_pkarr_servers {
     use std::{net::SocketAddr, time::Duration};
 
     use anyhow::Result;
-    use iroh_base::key::{NodeId, SecretKey};
+    use iroh_base::{NodeId, SecretKey};
     use url::Url;
 
     use super::{create_dns_resolver, CleanupDropGuard};
@@ -380,13 +382,13 @@ pub(crate) mod pkarr_dns_state {
     };
 
     use anyhow::{bail, Result};
+    use iroh_base::NodeId;
     use parking_lot::{Mutex, MutexGuard};
     use pkarr::SignedPacket;
 
     use crate::{
         dns::node_info::{node_id_from_hickory_name, NodeInfo},
         test_utils::dns_server::QueryHandler,
-        NodeId,
     };
 
     #[derive(Debug, Clone)]
diff --git a/iroh/src/tls.rs b/iroh/src/tls.rs
index 2f8e806ea1..ef22a33692 100644
--- a/iroh/src/tls.rs
+++ b/iroh/src/tls.rs
@@ -5,11 +5,11 @@
 
 use std::sync::Arc;
 
+use iroh_base::{PublicKey, SecretKey};
 use quinn::crypto::rustls::{NoInitialCipherSuite, QuicClientConfig, QuicServerConfig};
 use tracing::warn;
 
 use self::certificate::AlwaysResolvesCert;
-use crate::key::{PublicKey, SecretKey};
 
 pub mod certificate;
 mod verifier;
diff --git a/iroh/src/tls/certificate.rs b/iroh/src/tls/certificate.rs
index f728ea704c..9903cd5253 100644
--- a/iroh/src/tls/certificate.rs
+++ b/iroh/src/tls/certificate.rs
@@ -8,10 +8,9 @@
 use std::sync::Arc;
 
 use der::{asn1::OctetStringRef, Decode, Encode, Sequence};
+use iroh_base::{PublicKey, SecretKey, Signature};
 use x509_parser::prelude::*;
 
-use crate::key::{PublicKey, SecretKey, Signature};
-
 /// The libp2p Public Key Extension is a X.509 extension
 /// with the Object Identifier 1.3.6.1.4.1.53594.1.1,
 /// allocated by IANA to the libp2p project at Protocol Labs.
@@ -138,10 +137,10 @@ pub struct P2pCertificate<'a> {
 /// and a signature performed using the private host key.
 #[derive(Debug)]
 pub struct P2pExtension {
-    public_key: crate::key::PublicKey,
+    public_key: PublicKey,
     /// This signature provides cryptographic proof that the peer was
     /// in possession of the private host key at the time the certificate was signed.
-    signature: crate::key::Signature,
+    signature: Signature,
 }
 
 /// An error that occurs during certificate generation.
diff --git a/iroh/src/tls/verifier.rs b/iroh/src/tls/verifier.rs
index 333e66d1b0..8841d778aa 100644
--- a/iroh/src/tls/verifier.rs
+++ b/iroh/src/tls/verifier.rs
@@ -7,6 +7,7 @@
 //! Technologies (UK) Ltd.
 use std::sync::Arc;
 
+use iroh_base::PublicKey;
 use rustls::{
     client::danger::{HandshakeSignatureValid, ServerCertVerified, ServerCertVerifier},
     pki_types::CertificateDer as Certificate,
@@ -16,7 +17,6 @@ use rustls::{
 };
 
 use super::certificate;
-use crate::key::PublicKey;
 
 /// The protocol versions supported by this verifier.
 ///