Encryption API Overview

The Redeyed KMS is a self-hosted, managed-key encryption service — the same model as AWS/GCP KMS, running on our own infrastructure. It uses only standard, audited primitives (XChaCha20-Poly1305 for encryption, Ed25519 for signatures). There are no invented algorithms and no third-party crypto services.

Two ways to use it

• Direct encrypt/decrypt — for small secrets (≤ 64 KB): API keys, tokens, PII fields. Send the plaintext, get back self-describing ciphertext.
• Envelope encryption (data keys) — for anything larger: ask for a data key, encrypt your data locally with it, then store the returned wrapped key beside the data. Your plaintext never has to reach us.

Keys

Create a symmetric key (encrypt/decrypt + data keys) or a signing key (Ed25519). Each key is referenced by an alias you choose. Redeyed holds the key material wrapped under a root master key that never leaves the server — you call the API to use a key without ever handling raw key material.

Scopes & billing

Grant an API key the scopes it needs in the developer portal:

Key management reads are free; each crypto operation costs one credit (quota first, then credits), like the rest of the API.