Docs

Key

A Key gives code in a deployment two operations: encrypt and decrypt. The provider owns the key material; the binding accepts values up to 128 bytes.

code in deployment → key("customer-key") → AWS KMS / Cloud KMS / Key Vault

Define the resource

alien.ts
import * as alien from "@alienplatform/core"

const key = new alien.Key("customer-key").build()

export default new alien.Stack("app")
  .add(key, "frozen")
  .build()

Use it in the deployment

import { key } from "@alienplatform/bindings"

const customerKey = key("customer-key")
const plaintext = new TextEncoder().encode("small secret")

const ciphertext = await customerKey.encrypt(plaintext, {
  context: { recordType: "credential" },
})

const decrypted = await customerKey.decrypt(ciphertext, {
  context: { recordType: "credential" },
})

Use the same authenticated context at decrypt time. Changing it makes the decrypt operation fail.

For a hosted backend, either publish the Key as a Remote binding or use Encryption Gateway. Use Vault for named secrets that the application reads by name.

On this page

Define the resourceUse it in the deployment