Skip to main content
AutoSend optionally accepts JWE-encrypted request bodies on the public API. You encrypt your JSON payload with AutoSend’s public key, and the backend decrypts it transparently. Your business logic and the API response are unchanged. Plaintext requests keep working exactly as before, so encryption is fully opt-in, per request.
Transport is already protected by HTTPS/TLS. JWE adds an application-layer of protection so the payload stays encrypted end-to-end (for example, through logs, proxies, or intermediaries) until it reaches AutoSend.

​
How it works

1

Fetch the public key

Get AutoSend’s public key from the JWKS endpoint and cache it. The recommended (active) key is always listed first.
2

Encrypt your payload

Encrypt the complete JSON body into a JWE compact string using RSA-OAEP-256 for key management and A256GCM for content encryption.
3

Send the encrypted request

POST { "encryptedData": "<JWE>" } to any public endpoint with the X-Payload-Encryption: jwe and X-Key-Id headers.

​
Encryption standard

FieldValue
Key management (alg)RSA-OAEP-256
Content encryption (enc)A256GCM
SerializationJWE Compact
Key sizeRSA 2048-bit

​
Public key endpoint (JWKS)

Fetch AutoSend’s public key from the JWKS endpoint: 
GET https://api.autosend.com/v1/jwks.json

{
	"keys": [
		{
			"kty": "RSA",
			"n": "…",
			"e": "AQAB",
			"kid": "key_2026_06",
			"alg": "RSA-OAEP-256",
			"use": "enc"
		}
	]
}
Fetch the JWKS periodically and cache it. Use the kid of the key you encrypt with. AutoSend supports multiple keys at once so keys can rotate without breaking in-flight requests.

​
Node.js example

This example fetches the public key, encrypts a contact payload, and calls the contacts API. It uses the jose library. 
npm install jose
Any language with a JWE library works. Equivalent libraries exist for Python (jwcrypto / python-jose), Go, Java, Ruby, and more. Always use alg = RSA-OAEP-256 and enc = A256GCM.

​
Request format

Send the JWE as encryptedData, with the encryption headers: 
POST /v1/contacts/email
Authorization: Bearer AS_xxx.yyy
Content-Type: application/json
X-Payload-Encryption: jwe
X-Key-Id: key_2026_06

{ "encryptedData": "eyJhbGciOiJSU0EtT0FFUC0yNTYi..." }
​
X-Payload-Encryption
string
Set to jwe for encrypted requests. Omit (or use none) for plaintext.
​
X-Key-Id
string
The kid of the public key you encrypted with. If omitted, AutoSend reads the kid from the JWE protected header.
​
encryptedData
string
required
The JWE compact string containing your complete JSON payload.

​
Works with any public endpoint

The encrypted request format is the same for every /v1 endpoint. Just put the JWE inside { "encryptedData": "…" } and add the headers. For example, to send an email: 
POST /v1/mails/send
Authorization: Bearer AS_xxx.yyy
Content-Type: application/json
X-Payload-Encryption: jwe
X-Key-Id: key_2026_06

{ "encryptedData": "eyJhbGciOiJSU0EtT0FFUC0yNTYi..." }

​
Error handling

If the encrypted payload is malformed, the key id is unknown, or decryption fails, the API responds with HTTP 400: 
{
	"success": false,
	"error": {
		"message": "Invalid encrypted payload",
		"code": "INVALID_ENCRYPTED_PAYLOAD",
		"status": 400
	}
}
The encryptedData value is not a valid JWE compact string. Re-encrypt the payload with the public key from the JWKS endpoint.
The kid doesn’t match any active AutoSend key. Refresh the JWKS and use the kid from the returned key.
The payload was encrypted with the wrong key or a different algorithm. Use RSA-OAEP-256 + A256GCM and AutoSend’s current public key.

​
FAQ

No. It’s optional and per request. Endpoints accept plaintext bodies exactly as before. Only requests with the jwe header or an encryptedData field are decrypted.
Cache it and refresh periodically (for example, daily or weekly). AutoSend supports key rotation, so always encrypt with the kid from the latest JWKS.
Any language with a JWE library. The example uses Node.js with jose; equivalent libraries exist for Python (jwcrypto / python-jose), Go, Java, Ruby, and more. Use alg = RSA-OAEP-256 and enc = A256GCM.
Yes. JWE complements transport security, it does not replace it. Always call AutoSend over HTTPS and add JWE on top when you need application-layer encryption.
https://mintcdn.com/autosend-13920f5c/nx_wYfWx3qeZwg1C/icons/api-key.svg?fit=max&auto=format&n=nx_wYfWx3qeZwg1C&q=85&s=901e030c43bc15e040cb524638069800

API Keys

Create and manage the API keys you authenticate requests with.
https://mintcdn.com/autosend-13920f5c/nx_wYfWx3qeZwg1C/icons/api.svg?fit=max&auto=format&n=nx_wYfWx3qeZwg1C&q=85&s=a257e726f0f001df70664b740dcd5af6

API Reference

Explore every public endpoint you can send encrypted payloads to.
https://mintcdn.com/autosend-13920f5c/nx_wYfWx3qeZwg1C/icons/contacts.svg?fit=max&auto=format&n=nx_wYfWx3qeZwg1C&q=85&s=93b686fb3cb253812d2ab70168336374

Upsert Contact

The contacts endpoint used in the encryption example above.
https://mintcdn.com/autosend-13920f5c/nx_wYfWx3qeZwg1C/icons/email-activity.svg?fit=max&auto=format&n=nx_wYfWx3qeZwg1C&q=85&s=2ecad7369f217ee7d03c3d8dfdd36d22

Send Email

Send transactional emails, with or without an encrypted body.