E2EE integration checklist

​

Before you ship

• Register an OAuth app and request e2ee:symmetric or e2ee:asymmetric in your authorize URL scope list.
• Request the E2EE scope in your authorize URL (one per sign-in). Legacy apps with supportsE2ee still work without an explicit scope.
• For asymmetric mode, plan to store app_private_key locally and app_public_key on your user record.

​

Redirect and URL fragment

• Plaintext keys are delivered in the #fragment, not in JSON token bodies.
• Symmetric: app_key. Asymmetric: app_public_key + app_private_key.
• Normalize + when parsing base64 from URLSearchParams.
• Use mergeAppEncryptionFromUrl / completeOAuthCallback, then stripSensitiveFragmentParams.
• AveSession: getAppKeyBase64(), getAppPublicKeyBase64(), getAppPrivateKeyBase64().

​

Multi-user encryption

• Look up recipients with /api/encryption/app-lookup or SDK lookupAppPublicKeyByHandle.
• Encrypt with encryptForAppHandle; decrypt with decryptFromAppSender and the stored private key.

​

Identity isolation

• Use a separate encrypted data domain per Ave identity. Switching identity must switch key context.

​

Related

• App encryption SDK
• Scopes and claims