Encryption API: Encrypt and Decrypt Data with One HTTP Call

An encryption API does the encryption on a server that holds the keys. Your application sends data and a key ID and gets back ciphertext; it never sees or stores the key. This guide explains when that is worth it, then walks through the AMARACUS API with curl.

Why use an API instead of a library

• Keys never sit in your application's memory, config or logs, so a leaked environment file or memory dump doesn't expose them.
• Rotating a key is one call. New data uses the new key version, and old data still decrypts because each envelope records the version it was made with.
• Every operation is logged with the credential that made it, so you can answer "who decrypted this?"
• One policy decides which algorithms are allowed, instead of each service choosing its own.

The trade-off: each operation is a network round trip, and the data you encrypt travels to the API over TLS. For large records or files, encrypt locally and send only the data key. That pattern is in encrypting database fields.

Step 1: Get an API key and a managed key

Create an account and choose a plan, then create an API key in the console under API keys. Create an encryption key in the console, or with the API:

curl -X POST https://api.amaracus.tech/v1/keys \
  -H "Authorization: Bearer $AMARACUS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "name": "customer-pii", "algorithm": "AES-256-GCM", "purpose": "ENCRYPTION" }'

The response's data.id is the key ID you use in the next steps.

Step 2: Encrypt

curl -X POST https://api.amaracus.tech/v1/encrypt \
  -H "Authorization: Bearer $AMARACUS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "key": "'"$AMARACUS_KEY_ID"'", "data": "[email protected]" }'

{
  "data": {
    "envelope": "eyJ2IjoxLCJhbGciOiJBRVMtMjU2LUdDTSIs...",
    "algorithm": "AES-256-GCM",
    "keyId": "key_ab12cd34",
    "keyVersion": 1,
    "format": "v1"
  },
  "operationId": "op_1761800000000_9f3a2b1c",
  "status": "COMPLETED"
}

Store data.envelope in your database. It holds the ciphertext, IV, authentication tag and key version, so it is the only value you need to keep.

Step 3: Decrypt

curl -X POST https://api.amaracus.tech/v1/decrypt \
  -H "Authorization: Bearer $AMARACUS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "key": "'"$AMARACUS_KEY_ID"'", "envelope": "<data.envelope from step 2>" }'

The original value comes back in data.plaintext.

Calling it from your code

This helper works in Node.js 18 and later, Deno, Bun and serverless functions, since they all have fetch built in:

const API = "https://api.amaracus.tech/v1";
const headers = {
  Authorization: `Bearer ${process.env.AMARACUS_API_KEY}`,
  "Content-Type": "application/json",
};

async function call(path, body) {
  const res = await fetch(API + path, { method: "POST", headers, body: JSON.stringify(body) });
  const json = await res.json();
  if (!res.ok) throw new Error(json.error?.message ?? `HTTP ${res.status}`);
  return json.data;
}

export async function encrypt(value) {
  return (await call("/encrypt", { key: process.env.AMARACUS_KEY_ID, data: value })).envelope;
}

export async function decrypt(envelope) {
  return (await call("/decrypt", { key: process.env.AMARACUS_KEY_ID, envelope })).plaintext;
}

What it costs

Plans start at $2 a month for 15,000 operations (Starter), or pay as you go at $0.15 per 1,000. Each encrypt or decrypt call is one operation. See pricing.