DocsSDKsAPI
Dashboard

SDKs

Go SDK

You can use our Go SDK to:

  • Encrypt data server-side including files
  • Decrypt data server-side
  • Invoke Functions
  • Invoke Enclaves
  • Proxy requests through Relay

Encrypting/Decrypting data with our backend SDKs instead of Relay may expose you to greater compliance burden because because your server handles plaintext data.

Instead you can:

  • Use a Relay to encrypt data before it reaches your server.
  • Use our client-side SDKs to encrypt data before sending it to your server.

Quickstart

Install SDK

Initialize SDK

Now, let's initialize the SDK using our App's ID and API key. If you don't have one yet, you can get one by creating an App in the Evervault Dashboard.

Encrypt data

Now that the SDK is initialized, we can encrypt a string.

Decrypt data

Decrypt data previously encrypted using the Encrypt() function or through Relay.

An API key with the decrypt permission must be used to perform this operation.

Decrypting data with our backend SDKs is not available if you are part of the PCI or HIPAA compliance use cases

Instead you can:

  • Use Relay to decrypt data before it reaches third-party services.
  • Use Functions or Enclaves to process encrypted data.

Creating Client Side Decrypt Tokens

Client Side Decrypt Tokens are versatile and short-lived tokens that frontend applications can utilise to decrypt data previously encrypted through Evervault. Client Side Decrypt Tokens are restricted to specific payloads.

By default, a Client Side Decrypt Token will live for 5 minutes into the future. The maximum time to live of the token is 10 minutes into the future.

Parameters
payloadRequiredany

The payload containing encrypted data that the token will be used to decrypt.

expirytime.Time

The time the token will expire.

Run a Function

Invoke an Evervault Function with a given payload.

Parameters
functionNameRequiredany

The name of the Function to invoke.

payloadRequiredany

The payload containing encrypted data that will be passed as an argument to the Function.

Encrypt with Relay

Use a HTTP client, in this example net/http to proxy request through Relay. For the ssn to successfully encrypt, you must have a Relay configured in the Evervault dashboard.

Decrypt with Relay

Decryption with Relay is similar to encryption with Relay. You will need to configure a Relay in the Evervault dashboard and set a response action to decrypt the data you want to share. Setting the x-evervault-api-key and x-evervault-app-id headers is required if Relay authentication is enabled.

Response

Successful Function runs will return a FunctionRunResponse containing a Function Run ID and the result from your Function.

Construct a http.Client for connecting to an Enclave

The returned client will be configured to connect to the Enclave and attest the connection on each request with the pcrs provided.

To keep your clients in sync with your Enclave across deployments, you can use the EnclaveClientWithProvider. This allows you to define a callback function which returns a list of PCRs. This can be used to load the latest set of PCRs for your Deployed Enclave from a trusted source without a redeploy of your client.

Full example

Pulling all of this together leaves us with the following working example. You can copy and paste the code below (using a sandbox API key), run it in your own environment and run the encryption for yourself.

Reference

The full reference is available on Go pkg