Get a vault's public key for browser-encrypted credential values

Returns the public key that custom credential collection web apps use to encrypt values in the browser. Use this only if you run your own credential collection web app and want values encrypted in the browser, sent to your backend still encrypted, and forwarded to Kernel’s API still encrypted. In every other case, including server-side code that already holds the plaintext, use value. The page encrypts each value to this key, your backend forwards the ciphertext unchanged as encrypted_value when creating or updating a credential item in this vault, and Kernel decrypts it.

GET /vaults/{id_or_name}/encryption_key

Get a vault's public key for browser-encrypted credential values

cURL

curl --request GET \
  --url https://api.onkernel.com/vaults/{id_or_name}/encryption_key \
  --header 'Authorization: Bearer <token>'

200

{
  "alg": "ECDH-ES",
  "enc": "A256GCM",
  "jwk": {
    "crv": "P-256",
    "kty": "EC",
    "x": "<string>",
    "true": "<string>"
  },
  "kid": "<string>"
}

Authorizations

Authorization · string · header · required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Path Parameters

id_or_name · string · required

Response

200

application/json

Vault encryption key

Public key for encrypted_value on credential fields. Use this only if you run your own credential collection web app and want values encrypted in the browser, sent to your backend still encrypted, and forwarded to Kernel's API still encrypted. In every other case, including server-side code that already holds the plaintext, use value. Each vault has its own key; a value encrypted for one vault is rejected by every other vault. The key is created on first request and stays the same for the vault's lifetime, so it may be cached.

alg · enum<string> · required

JWE key management algorithm.

Available options: ECDH-ES

enc · enum<string> · required

JWE content encryption algorithm.

Available options: A256GCM

jwk · object · required

P-256 public key in JWK form.

Show child attributes

kid · string · required

Key ID. Set it as the kid protected header of every encrypted_value.