Java

Getting started

The SDK has two ways to load your App's encryption key. Choose one before you start, since encryption works the same way after the SDK is initialized.

• API key (recommended): the SDK fetches the encryption key from the Evervault API at runtime, so there's no key material to manage. This is the default, and the steps below use it.
• Offline JSON Web Key Set (JWK Set): for isolated networks with no route to the Evervault API, initialize the SDK with a key you supply instead. See Encrypt without network access.

Install the SDK

First, let's install the Evervault SDK using either Gradle or Maven.

1implementation 'com.evervault:lib:4.3.1'

Initialize the SDK

Now, let's initialize the SDK using our App's ID and API key. If you don't have one yet, you can get one by creating an App in the Evervault Dashboard.

1import com.evervault.Evervault;
2
3Evervault evervault = new Evervault("<APP_ID>", "<API_KEY>");

The SDK fetches your App's encryption key from the Evervault API when it initializes. To initialize it without network access instead, see Encrypt without network access.

Encrypt a string

Now that the SDK is initialized, we can encrypt a string.

1String encrypted = (String) evervault.encrypt("Hello, world!");

Encrypt without network access

Initializing the SDK with an API key is the recommended approach for every environment that can reach the Evervault API. The exception is an isolated network with no route to the public internet, such as a cardholder data environment. In those scenarios, the SDK can't fetch your App's encryption key when it starts, so you need to supply it with a key instead. To do this, download your App's public keys as a JWK Set from https://keys.evervault.com/<TEAM_UUID>/apps/<APP_ID>?format=jwks. Ship that document alongside your application and build the client from it.

1import com.evervault.Evervault;
2import com.evervault.models.EvervaultKey;
3
4EvervaultKey key = EvervaultKey.fromJwks(jwks, "<KID>");
5
6Evervault evervault = Evervault.withKey("<APP_ID>", key);

Building a client this way encrypts without making any network calls, and comes with some trade-offs:

• You're responsible for storing the JWK Set and keeping it in sync with your App.
• Encryption is the only operation that works without network access. Decrypting, running Functions, and using Outbound Relay still call the Evervault API and need an API key.

See Evervault.withKey() and EvervaultKey.fromJwks() for the full set of overloads.

Reference

Evervault()

The SDK constructor takes two parameters; your App's ID and API key.

1import com.evervault.Evervault;
2
3var evervault = new Evervault("<APP_ID>", "<API_KEY>");