Client-side Vault encryption and decryption, layered on the WorkOS data-key
API (WorkOS.Vault.create_data_key/3 and WorkOS.Vault.create_decrypt/3).
{:ok, result} =
WorkOS.Vault.Crypto.encrypt(client, "my secret", %{"org" => "org_123"})
{:ok, "my secret"} =
WorkOS.Vault.Crypto.decrypt(client, result.encrypted_data)Data is encrypted locally with AES-256-GCM; only the data key is exchanged
with the API. The wire format (before base64) is
LEB128(byte_size(encrypted_keys)) || encrypted_keys || nonce(12) || ciphertext || tag(16),
interoperable with the other WorkOS SDKs.
Summary
Functions
Decrypts data produced by encrypt/5 by first decrypting the embedded data
key via the API.
Generates a data key for key_context and encrypts data locally.
Decrypts data with AES-256-GCM using a pre-fetched data key
(WorkOS.DecryptResponse). No HTTP request is made.
Encrypts data with AES-256-GCM using a pre-fetched data key pair
(WorkOS.CreateDataKeyResponse). No HTTP request is made.
Types
Functions
@spec decrypt(WorkOS.Client.t(), String.t(), String.t() | nil, keyword()) :: {:ok, String.t()} | {:error, WorkOS.Error.error() | term()}
Decrypts data produced by encrypt/5 by first decrypting the embedded data
key via the API.
@spec encrypt(WorkOS.Client.t(), String.t(), map(), String.t() | nil, keyword()) :: {:ok, encrypt_result()} | {:error, WorkOS.Error.error() | term()}
Generates a data key for key_context and encrypts data locally.
associated_data is optional AES-GCM additional authenticated data — the
same value must be passed to decrypt/4.
@spec local_decrypt(String.t(), WorkOS.DecryptResponse.t(), String.t() | nil) :: {:ok, String.t()} | {:error, term()}
Decrypts data with AES-256-GCM using a pre-fetched data key
(WorkOS.DecryptResponse). No HTTP request is made.
@spec local_encrypt(String.t(), WorkOS.CreateDataKeyResponse.t(), String.t() | nil) :: {:ok, String.t()} | {:error, term()}
Encrypts data with AES-256-GCM using a pre-fetched data key pair
(WorkOS.CreateDataKeyResponse). No HTTP request is made.