Share Encrypted Data with a Third-Party API

Using Encryption as a Service allows you to keep sensitive data encrypted at all times: at rest, in transit and in use. Although this is a powerful security enhancement, third-party APIs need data in plaintext. We need a way to decrypt that data after it leaves our infrastructure, and before it reaches a third-party endpoint. We can achieve this using the Relay Primitive.

Relay is a network proxy that can be configured to decrypt data during a request. If we proxy our request to a third-party endpoint through Relay, we can configure it so that any encrypted data in the payload will be decrypted, allowing the request to be processed as normal.

Create a Relay

We’ll use RequestBin to simulate a third-party API. In practice, this could be an endpoint from any third-party service. We can create a RequestBin by navigating to requestbin.com/r, where we will be given a temporary endpoint that we can send requests to. To create a Relay for your RequestBin endpoint, navigate to the Relays tab in the Evervault Dashboard and click Create Relay. Add the RequestBin endpoint to the destination field.

Integrate the Proxy

If you run the snippet, you’ll see the request in your RequestBin logs. You’ll notice that the email and password fields are still encrypted. Next, we’ll configure Relay to decrypt any encrypted data that gets sent to this endpoint.

Configure the Proxy

Once you have included the Evervault SDK in your application, We can confifgure a Relay to perform encryption and decryption operations for our RequestBin endpoint. In our case, we want to use Relay to decrypt any encrypted data as it's proxied to our RequestBin endpoint. In the Evervault dashboard, navigate to the Relay you created, and click the Add Route button to configure a new route. We want to decrypt any data being sent to this endpoint, so we can enter "/**" in the path field to match all requests sent to the Relay. Next, we can add a request action to decrypt all fields in the request body. Select Add Request Action -> Decrypt -> JSON, and enter $..* in the fields to decrypt. JSON requests use JSONPath to match fields in the request body and $..* will match all fields in the request body. Learn More

If you send the request again, you’ll notice that the values for email and password are now decrypted by Relay before being forwarded on to the RequestBin endpoint.

Summary

Using Relay means you can still interact with any third-party API that requires sensitive data in plaintext, while keeping it encrypted at all times within your application.