# Go

_Encrypt data server-side, invoke Functions, Enclaves and proxy requests through Relay._

> Encrypting/Decrypting data with our backend SDKs may expose you to greater
>   compliance burden because your server needs to handle plaintext data. Instead,
>   we recommend using [Relay](/relay) or our [Client-Side SDKs](/sdks) to encrypt
>   data.

## Getting started

### Install the SDK

```bash
go get github.com/evervault/evervault-go
```

### Initialize the SDK

Now, let's initialize the SDK using our App's ID and API key. If you don't have one yet, you can get one by creating an App in the [Evervault Dashboard](https://app.evervault.com).

```go
import "github.com/evervault/evervault-go"

evClient, err := evervault.MakeClient("<APP_ID>", "<API_KEY>")
```

### Encrypt a string

Now that the SDK is initialized, we can encrypt a string.

```go
encrypted := evClient.Encrypt("Hello, world!");
```

## Connecting to an Enclave

The returned client will be configured to connect to the Enclave and attest the connection on each request with the pcrs provided.

```go
enclaveURL = "my-enclave.<APP_UUID>.enclave.evervault.com"
expectedPCRs := evervault.PCRs{PCR8: "..."}

enclaveClient, err := evClient.EnclaveClient(
    enclaveURL,
    []evervault.PCRs{expectedPCRs}
)

if err != nil {
    log.Fatal(err)
}

payload, err := json.Marshal(fmt.Sprintf(`{"encrypted": "%s"}`, encrypted))
if err != nil {
    log.Fatal(err)
}

req, _ := http.NewRequest(
    http.MethodPost,
    fmt.Sprintf("https://%s/", enclaveURL
    ),
    bytes.NewBuffer(payload)
)
req.Close = true
req.Header.Set("API-KEY", "<API_KEY>")
req.Header.Set("Content-Type", "application/json; charset=UTF-8")

resp, err := enclaveClient.Do(req)
```

To keep your clients in sync with your Enclave across deployments, you can use the `EnclaveClientWithProvider`. This allows you to define a callback function which returns a list of PCRs. This can be used to load the latest set of PCRs for your Deployed Enclave from a trusted source without a redeploy of your client.

```go

import (
    "github.com/evervault/evervault-go",
    "github.com/evervault/evervault-go/attestation"
)

evClient, err := evervault.MakeClient("<APP_ID>", "<API_KEY>")
if err != nil {
    log.Fatal(err)
}

enclaveURL = "my-enclave.<APP_UUID>.enclave.evervault.com"
expectedPCRs := attestation.PCRs{PCR8: "..."}

func GetPCRsFromApi() ([]attestation.PCRs, error) {
  // Logic to load PCRs from an API/CDN etc.
  return pcrs, nil
}

enclaveClient, err := evClient.EnclaveClientWithProvider(enclaveURL, GetPCRsFromApi)
if err != nil {
    log.Fatal(err)
}

payload, err := json.Marshal(fmt.Sprintf(`{"encrypted": "%s"}`, encrypted))
if err != nil {
    log.Fatal(err)
}

req, _ := http.NewRequest(
    http.MethodPost,
    fmt.Sprintf("https://%s/", enclaveURL),
    bytes.NewBuffer(payload)
)
req.Close = true
req.Header.Set("API-KEY", "<API_KEY>")
req.Header.Set("Content-Type", "application/json; charset=UTF-8")

resp, err := enclaveClient.Do(req)
```

## Reference

The full reference is available on [Go pkg](https://pkg.go.dev/github.com/evervault/evervault-go).

### Encrypt

Encrypts data using [Evervault Encryption](/developers/evervault-encryption). Evervault Strings can be used across all of our products. The encrypted data can be stored in your database as normal and can be used with any of Evervault’s other services.

```go
encrypted := evClient.Encrypt("Hello, world!");
```

**Parameters**

- `data` _(required)_ — The data to encrypt.

### Decrypt

Decrypt data previously encrypted with the `Encrypt` function or through [Relay](/relay). An API key with the `decrypt` permission must be used to perform this operation.

```go
encrypted := evClient.Encrypt("Hello, world!");

dataToDecrypt := make(map[string]any);
dataToDecrypt["encryptedData"] = encrypted;

decrypted := evClient.Decrypt(dataToDecrypt);
```

> **PCI Compliance**
>
> Decrypting data with our backend SDKs is not available if you are part of the PCI or HIPAA compliance use cases. Instead you can:
>
> - Use [Relay](/relay) to decrypt data before it reaches third-party services.
> - Use [Functions](/functions) or [Enclaves](/enclaves) to process encrypted data.

### CreateClientSideDecryptToken

Client Side Decrypt Tokens are versatile and short-lived tokens that frontend applications can utilise to decrypt data previously encrypted through Evervault. Client Side Decrypt Tokens are restricted to specific payloads.

By default, a Client Side Decrypt Token will live for 5 minutes into the future. The maximum time to live of the token is 10 minutes into the future.

```go
token := evClient.CreateClientSideDecryptToken(encryptedData)
```

**Parameters**

- `payload` `string` _(required)_ — The payload containing encrypted data that the token will be used to decrypt.
- `expiry` `time.Time` — The time the token will expire. Defaults to 5 minutes in the future.

### RunFunction

Invoke an [Evervault Function](/functions) with a given payload.

```go
result := evClient.RunFunction(functionName, payload)
```

**Parameters**

- `functionName` `string` _(required)_ — The name of the function to invoke.
- `payload` `map[string]any` _(required)_ — The payload containing encrypted data that will be passed as an argument to the Function.