Quickstart

Turn it onCopy Anchor Link

Turn on customer-managed keys for the project and create an API key that can only call the Encrypt/Decrypt API, which encrypts with each customer's key:

alien projects capabilities enable encryption
alien api-keys create --for encryption-gateway --description local-quickstart

The secret is shown once. Save it, with the external ID you'll use for this test customer:

export ALIEN_ENCRYPTION_API_KEY="..."
export CUSTOMER_ID="org_test"

Connect a test keyCopy Anchor Link

Create a setup link for the test customer:

alien onboard "Test customer" --external-id "$CUSTOMER_ID" --setup-items keys

Open the printed link. In the deployment portal, the branded setup page Alien hosts, connect a key from an AWS, Google Cloud, or Azure account you control.

Encrypt a valueCopy Anchor Link

Print a ready-to-run request for your environment:

alien examples encryption-gateway --operation encrypt --key-id customer-data

Run the printed command. It's equivalent to the request below. The API takes and returns base64: aGVsbG8= is hello.

curl "https://encryption.alien.dev/v1/encrypt" \
  -H "Authorization: Bearer $ALIEN_ENCRYPTION_API_KEY" \
  -H "X-Alien-External-ID: $CUSTOMER_ID" \
  -H "Content-Type: application/json" \
  -d '{"key": {"keyId": "customer-data"}, "plaintext": "aGVsbG8="}'

Save the returned ciphertext:

export CIPHERTEXT="..."

Decrypt itCopy Anchor Link

alien examples encryption-gateway --operation decrypt --key-id customer-data

The printed request reads ALIEN_ENCRYPTION_API_KEY, CUSTOMER_ID, and CIPHERTEXT. The response holds the plaintext as base64.

Disable the keyCopy Anchor Link

1. Disable the test key in your cloud console.
2. Wait longer than 5 minutes, the time Alien caches the customer's encryption root.
3. Decrypt again. It fails with KEY_UNAVAILABLE.
4. Re-enable the key and confirm decrypt works again.