Seal your first payload in four calls

# 1 · register a key-pair (public material only — the private key never leaves you)
curl -X POST https://kryptapi.com/v1/keys \
  -H "Authorization: Bearer sk_live_2f8a…" \
  -H "X-Krypt-Api-Version: 2026-05-01" \
  -H "Content-Type: application/json" \
  -d '{
        "label": "ops-dashboard",
        "curve": "P-256",
        "public_jwk": { "kty":"EC","crv":"P-256","x":"8f2a…","y":"d901…" },
        "rotation_days": 90
      }'

# 2 · attest the peer you are about to send to
curl -X POST https://kryptapi.com/v1/attest \
  -H "Authorization: Bearer sk_live_2f8a…" \
  -d '{ "route": "rt_2d55", "peer": "ops-dashboard", "challenge": "9f42a1c7b3d40e11" }'

# 3 · seal and relay — "ct" is ciphertext you produced locally
curl -X POST https://kryptapi.com/v1/envelopes \
  -H "Authorization: Bearer sk_live_2f8a…" \
  -H "Idempotency-Key: 7c4a1f90-2b33-4e55-9a11-0d8e6b2f5c31" \
  -d '{
        "route": "rt_2d55",
        "hdr": { "hop":1, "kid":"key_form_1d90", "alg":"ECDH-ES+A256GCM", "iv":"9pQm1xTf0Ad2" },
        "epk": { "kty":"EC","crv":"P-256","x":"b2c8…","y":"7d19…" },
        "aad": "hop=1;route=rt_2d55;ts=1786553527",
        "ct":  "k9RtQ2b…"
      }'

# -> 201 Created
# { "env":"env_9f42a1c7b3d4c1a7", "state":"relayed", "bytes":41208,
#   "commit":"0x8c31…f19d", "attested":true }

# 4 · collect the receipt (proof of open, hash-chained)
curl https://kryptapi.com/v1/envelopes/env_9f42a1c7b3d4c1a7/receipt \
  -H "Authorization: Bearer sk_live_2f8a…"

import { Krypt } from "@kryptapi/node";

const krypt = new Krypt({
  apiKey: process.env.KRYPT_API_KEY,
  apiVersion: "2026-05-01",
  // the private JWK stays on this machine; the SDK never transmits it
  identity: JSON.parse(process.env.KRYPT_IDENTITY_JWK)
});

// 1 · register the destination's key-pair once, at provisioning time
const key = await krypt.keys.create({
  label: "ops-dashboard",
  curve: "P-256",
  rotationDays: 90
});

// 2 · attest the peer — throws AttestationError if the peer cannot prove itself
await krypt.attest({ route: "rt_2d55", peer: "ops-dashboard" });

// 3 · seal locally, relay the ciphertext
const envelope = await krypt.envelopes.seal({
  route: "rt_2d55",
  to: key.fingerprint,                 // "8f2a…d901"
  content: Buffer.from(JSON.stringify(intake)),
  aad: { retain: "7y", classification: "pii" },
  idempotencyKey: intake.id
});

console.log(envelope.env);            // env_9f42a1c7b3d4c1a7
console.log(envelope.commit);         // 0x8c31…f19d

// 4 · receipt of open, whenever the destination collects it
const receipt = await krypt.envelopes.receipt(envelope.env);
if (receipt.state === "opened") {
  console.log("opened at", receipt.opened_at, "by", receipt.opened_by_fp);
}

import os, json
from kryptapi import Krypt, AttestationError

krypt = Krypt(
    api_key=os.environ["KRYPT_API_KEY"],
    api_version="2026-05-01",
    identity=json.loads(os.environ["KRYPT_IDENTITY_JWK"]),  # stays local
)

# 1 · register the destination key-pair
key = krypt.keys.create(
    label="ops-dashboard",
    curve="P-256",
    rotation_days=90,
)

# 2 · attest before you send. No attestation, no envelope.
try:
    krypt.attest(route="rt_2d55", peer="ops-dashboard")
except AttestationError as e:
    # amber, never crimson: this is an operational state, not a catastrophe
    log.warning("peer refused attestation: %s", e.code)
    raise

# 3 · seal locally and relay
envelope = krypt.envelopes.seal(
    route="rt_2d55",
    to=key.fingerprint,
    content=json.dumps(intake).encode(),
    aad={"retain": "7y", "classification": "pii"},
    idempotency_key=intake["id"],
)
print(envelope.env, envelope.commit)   # env_9f42a1c7b3d4c1a7 0x8c31…f19d

# 4 · receipt
receipt = krypt.envelopes.receipt(envelope.env)
print(receipt.state, receipt.opened_at)