---
title: "Get a vault's public key for browser-encrypted credential values"
method: GET
path: "/vaults/{id_or_name}/encryption_key"
tags: ["Vaults"]
---

# Get a vault's public key for browser-encrypted credential values

`GET /vaults/{id_or_name}/encryption_key`

## Request

- Base URL: `https://api.onkernel.com`
- URL: `https://api.onkernel.com/vaults/{id_or_name}/encryption_key`
- Auth: HTTP bearer

Returns the public key that custom credential collection web apps use to encrypt values in the browser. Use this only if you run your own credential collection web app and want values encrypted in the browser, sent to your backend still encrypted, and forwarded to Kernel's API still encrypted. In every other case, including server-side code that already holds the plaintext, use value. The page encrypts each value to this key, your backend forwards the ciphertext unchanged as encrypted_value when creating or updating a credential item in this vault, and Kernel decrypts it.

## Response `200`

Vault encryption key

- VaultEncryptionKey: Public key for encrypted_value on credential fields. Use this only if you run your own credential collection web app and want values encrypted in the browser, sent to your backend still encrypted, and forwarded to Kernel's API still encrypted. In every other case, including server-side code that already holds the plaintext, use value. Each vault has its own key; a value encrypted for one vault is rejected by every other vault. The key is created on first request and stays the same for the vault's lifetime, so it may be cached.
  - `alg` 'ECDH-ES', required: JWE key management algorithm.
  - `enc` 'A256GCM', required: JWE content encryption algorithm.
  - `jwk` VaultEncryptionPublicJWK, required: P-256 public key in JWK form.
    - `crv` 'P-256', required
    - `kty` 'EC', required
    - `true` string: Base64url-encoded y coordinate.
    - `x` string, required: Base64url-encoded x coordinate.
  - `kid` string, required: Key ID. Set it as the kid protected header of every encrypted_value.

## Other responses

- `401`: Unauthorized – missing or invalid authorization token
- `404`: Resource not found
- `500`: Internal Server Error

## Changes

- **2026-10-10** `04ae87133aab`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/onkernel/apis/kernel-api/changes/vaults/:id_or_name/encryption_key/get.md)

---

[API](https://skmtc.dev/onkernel/apis/kernel-api.md) - [All operations](https://skmtc.dev/onkernel/apis/kernel-api/llms.txt) - [OpenAPI document](https://skmtc.dev/onkernel/apis/kernel-api/revisions/0f6cf4f58fe6?raw)