encryption-aes-gcm

What problem does it solve?

This Skill provides robust encryption for sensitive credentials (BYOD/BYOK) using AES-256-GCM, ensuring per-encryption IVs and authenticated data to prevent leakage and tampering.

Core Features & Use Cases

• AES-256-GCM encryption/decryption with per-encryption IVs and authentication tags to protect keys and secrets.
• BYOK pattern supports storing multiple encrypted keys (vercelGateway, openRouter, groq, deepgram) along with IVs and auth tags, enabling secure key management.
• BYOD pattern manages encrypted deployment credentials (deployment URL and deploy key) with shared IV and authTag storage, simplifying secure configuration retrieval.
• Real-world use: safeguard API keys and deployment credentials in Convex workflows while enabling secure decryption on demand.

Quick Start

Configure BYOD_ENCRYPTION_KEY in your environment. Use the encryption utilities to encrypt credentials and store the resulting encrypted value, IV, and authTag according to BYOK/BYOD flows. Then decrypt when needed, ensuring authTag verification before use.