# Payout API Encryption & Decryption Guide

For **all Payout APIs**, it is mandatory to:

<Icon icon="remix-hashtag"color="#7b2cbf"/> **Encrypt the request payload** before sending it to Enkash.

<Icon icon="remix-hashtag"color="#7b2cbf"/> **Decrypt the response payload** received from Enkash before using it.


:::tip[]
These security measures protect sensitive data by ensuring that all requests and responses are securely transmitted.
:::

## <span style="color:#7b2cbf">Request & Response Format</span>


**Request Payload**

```json
{
    "request": "{encrypted_request_string}"
}
```

**Response Payload**

```json
{
    "request": "{encrypted_response_string}"
}
```
## <span style="color:#7b2cbf">Encryption</span>


To send data securely, you must **encrypt the request payload**.


:::note[]
**Important:**
* Use **AES encryption** (128-bit key) in `ECB`mode with`PKCS5`padding
* Always use your **client secret key** for encryption
:::

**Example Implementations**

<Tabs>

<Tab title="Java">
```java
public String encrypt(String strToEncrypt, String secretKey) {
    try {
        byte[] key = secretKey.getBytes(StandardCharsets.UTF_8);
        key = Arrays.copyOf(MessageDigest.getInstance("SHA-256").digest(key), 16);
        Cipher cipher = Cipher.getInstance("AES/ECB/PKCS5Padding");
        cipher.init(Cipher.ENCRYPT_MODE, new SecretKeySpec(key, "AES"));
        return Base64.getEncoder().encodeToString(cipher.doFinal(strToEncrypt.getBytes(StandardCharsets.UTF_8)));
    } catch (Exception e) {
        e.printStackTrace();
    }
    return null;
}
```
**Usage**
```java
String payloadJson = new ObjectMapper().writeValueAsString(request);
String encrypted = encrypt(payloadJson, "{secretKey}");
System.out.println("Encrypted Payload: " + encrypted);
```
</Tab>

<Tab title="NodeJs (Javascript)">
```js
const crypto = require('crypto');

function encrypt(jsonPayload, secretKey) {
let key = crypto.createHash('sha256').update(secretKey).digest().slice(0, 16);
const cipher = crypto.createCipheriv('aes-128-ecb', key, null);
let encrypted = cipher.update(JSON.stringify(jsonPayload), 'utf-8', 'base64');
return encrypted + cipher.final('base64');
}

````
**Usage**
```js
const encrypted = encrypt({ field1: "value1" }, "{secretKey}");
console.log("Encrypted Payload: " + encrypted);
````

</Tab>

<Tab title="PHP">
```php
function encrypt($jsonPayload, $secretKey) {
    $key = substr(hash('sha256', $secretKey, true), 0, 16);
    return base64_encode(openssl_encrypt(json_encode($jsonPayload), "AES-128-ECB", $key, OPENSSL_RAW_DATA));
}
```
**Usage**
```php
$encrypted = encrypt(["field1" => "value1"], "{secretKey}");
echo "Encrypted Payload: $encrypted";
```
</Tab>

<Tab title=".Net">
```csharp
public static string Encrypt(object jsonPayload, string secretKey) {
    string jsonString = Newtonsoft.Json.JsonConvert.SerializeObject(jsonPayload);
    byte[] key = SHA256.Create().ComputeHash(Encoding.UTF8.GetBytes(secretKey));
    Array.Resize(ref key, 16);
    using var aes = Aes.Create();
    aes.Key = key; aes.Mode = CipherMode.ECB; aes.Padding = PaddingMode.PKCS7;
    byte[] encrypted = aes.CreateEncryptor().TransformFinalBlock(Encoding.UTF8.GetBytes(jsonString), 0, jsonString.Length);
    return Convert.ToBase64String(encrypted);
}
```
**Usage**
```csharp
string encrypted = Encrypt(new { field1 = "value1" }, "{secretKey}");
Console.WriteLine(encrypted);
```
</Tab>

<Tab title="Python">
```python
from Crypto.Cipher import AES
from Crypto.Hash import SHA256
import base64, json

def encrypt(jsonPayload, secretKey):
key = SHA256.new(secretKey.encode()).digest()\[:16]
cipher = AES.new(key, AES.MODE\_ECB)
data = json.dumps(jsonPayload)
pad\_len = 16 - len(data) % 16
padded = data + chr(pad\_len) \* pad\_len
return base64.b64encode(cipher.encrypt(padded.encode())).decode()

````
**Usage**
```python
encrypted = encrypt({"field1": "value1"}, "your_secret_key")
print(encrypted)
````

</Tab>

</Tabs>

## <span style="color:#7b2cbf">Decryption</span>

When you receive an encrypted response from Enkash, use your **client secret key** to decrypt.

**Example Implementations**

<Tabs>

<Tab title="Java">
```java
public String decrypt(String strToDecrypt, String secretKey) {
    try {
        byte[] key = Arrays.copyOf(MessageDigest.getInstance("SHA-256").digest(secretKey.getBytes(StandardCharsets.UTF_8)), 16);
        Cipher cipher = Cipher.getInstance("AES/ECB/PKCS5Padding");
        cipher.init(Cipher.DECRYPT_MODE, new SecretKeySpec(key, "AES"));
        return new String(cipher.doFinal(Base64.getDecoder().decode(strToDecrypt.getBytes(StandardCharsets.UTF_8))));
    } catch (Exception e) {
        e.printStackTrace();
    }
    return null;
}
```
**Usage**
```java
String decrypted = decrypt("YourEncryptedPayload", "{secretKey}");
System.out.println("Decrypted: " + decrypted);
```
</Tab>

<Tab title="NodeJs">
```js
function decrypt(strToDecrypt, secretKey) {
    let key = crypto.createHash('sha256').update(secretKey).digest().slice(0, 16);
    const decipher = crypto.createDecipheriv('aes-128-ecb', key, null);
    let decrypted = decipher.update(strToDecrypt, 'base64', 'utf-8');
    return decrypted + decipher.final('utf-8');
}
```
</Tab>

<Tab title="PHP">
```php
function decrypt($strToDecrypt, $secretKey) {
    $key = substr(hash('sha256', $secretKey, true), 0, 16);
    return openssl_decrypt(base64_decode($strToDecrypt), "AES-128-ECB", $key, OPENSSL_RAW_DATA);
}
```
</Tab>

<Tab title=".Net">
```csharp
public static string Decrypt(string strToDecrypt, string secretKey) {
    byte[] key = SHA256.Create().ComputeHash(Encoding.UTF8.GetBytes(secretKey));
    Array.Resize(ref key, 16);
    using var aes = Aes.Create();
    aes.Key = key; aes.Mode = CipherMode.ECB; aes.Padding = PaddingMode.PKCS7;
    byte[] decrypted = aes.CreateDecryptor().TransformFinalBlock(Convert.FromBase64String(strToDecrypt), 0, Convert.FromBase64String(strToDecrypt).Length);
    return Encoding.UTF8.GetString(decrypted);
}
```
</Tab>

<Tab title="Python">
```python
def decrypt(strToDecrypt, secretKey):
    key = SHA256.new(secretKey.encode()).digest()[:16]
    cipher = AES.new(key, AES.MODE_ECB)
    decrypted = cipher.decrypt(base64.b64decode(strToDecrypt)).decode()
    pad = ord(decrypted[-1])
    return json.loads(decrypted[:-pad])
```
</Tab>

</Tabs>

## <span style="color:#7b2cbf">Best Practices</span>

* Store the **secret key securely**, never hardcode in codebases.
* Always validate the decrypted payload to handle unexpected data.
* Use updated libraries for cryptographic operations to maintain security.