> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aveid.net/llms.txt
> Use this file to discover all available pages before exploring further.

# E2EE integration checklist

> Encryption scopes, fragment handling, and identity isolation for apps that encrypt data.

Use this checklist alongside [End-to-end encryption](/guides/end-to-end-encryption) and [Encryption model and key lifecycle](/security/encryption-model-and-key-lifecycle).

## Before you ship

* Register an OAuth app and request **`e2ee:symmetric`** or **`e2ee:asymmetric`** in your authorize URL scope list.
* Request the E2EE scope in your authorize URL (one per sign-in). Legacy apps with `supportsE2ee` still work without an explicit scope.
* For asymmetric mode, plan to store `app_private_key` locally and `app_public_key` on your user record.

## Redirect and URL fragment

* Plaintext keys are delivered in the **`#fragment`**, not in JSON token bodies.
* Symmetric: `app_key`. Asymmetric: `app_public_key` + `app_private_key`.
* Normalize **`+`** when parsing base64 from `URLSearchParams`.
* Use **`mergeAppEncryptionFromUrl`** / **`completeOAuthCallback`**, then **`stripSensitiveFragmentParams`**.
* **`AveSession`**: `getAppKeyBase64()`, `getAppPublicKeyBase64()`, `getAppPrivateKeyBase64()`.

## Multi-user encryption

* Look up recipients with `/api/encryption/app-lookup` or SDK `lookupAppPublicKeyByHandle`.
* Encrypt with `encryptForAppHandle`; decrypt with `decryptFromAppSender` and the stored private key.

## Identity isolation

* Use a separate encrypted data domain per Ave identity. Switching identity must switch key context.

## Related

* [App encryption SDK](/sdk/sdk-identity-keys)
* [Scopes and claims](/guides/scopes-and-claims)