Expand description
AES-256-GCM encryption for provider API keys stored at rest.
Keys are encrypted with a 32-byte key sourced from the
CREDENTIAL_ENCRYPTION_KEY environment variable (either 32 raw ASCII bytes
or 64 hex characters). The ciphertext is stored as
base64(12-byte-nonce || ciphertext) so that each encryption produces a
unique result even for identical plaintexts.
Structsยง
- Credential
Encryption - Holds the AES-256-GCM cipher derived from
CREDENTIAL_ENCRYPTION_KEY.