Encrypting API request payloads end-to-end with JWE (JSON Web Encryption) in AutoSend

API & SMTP Integration
1

For healthcare, fintech, or sensitive compliance requirements, how does AutoSend support end-to-end payload encryption via JWE (JSON Web Encryption) so email content is encrypted before leaving our servers?

2

End-to-End Request Body Encryption with JWE in AutoSend

AutoSend supports opt-in, per-request JWE (JSON Web Encryption) using standard asymmetric cryptography (RSA-OAEP-256 + A256GCM). This ensures sensitive fields (PII, OTPs, financial statements) remain encrypted in transit and in intermediary network proxies until decrypted directly by AutoSend’s core processing workers.

How JWE Encryption Works in AutoSend

  1. Fetch AutoSend’s public encryption JWK from your dashboard / settings.
  2. Encrypt your normal JSON request payload (e.g. POST /v1/mails/send body) into a compact JWE string using jose or Web Crypto.
  3. Send the compact JWE string with Content-Type: application/jose or pass the encrypted token in the request body.

Example Implementation (Node.js / TypeScript):

import { CompactEncrypt, importJWK } from "jose";

// AutoSend Public Encryption Key (from AutoSend Dashboard -> Security Settings)
const AUTOSEND_PUBLIC_JWK = {
  kty: "RSA",
  e: "AQAB",
  use: "enc",
  alg: "RSA-OAEP-256",
  n: "..." // AutoSend Public Key Modulus
};

async function sendEncryptedEmail() {
  const publicKey = await importJWK(AUTOSEND_PUBLIC_JWK, "RSA-OAEP-256");

  const rawPayload = JSON.stringify({
    from: { email: "security@yourdomain.com", name: "Fintech Security" },
    to: { email: "client@example.com" },
    subject: "Your Monthly Account Statement",
    html: "<p>Your confidential portfolio statement is attached.</p>",
  });

  // Encrypt payload to Compact JWE
  const jwe = await new CompactEncrypt(new TextEncoder().encode(rawPayload))
    .setProtectedHeader({ alg: "RSA-OAEP-256", enc: "A256GCM" })
    .encrypt(publicKey);

  const res = await fetch("https://api.autosend.com/v1/mails/send", {
    method: "POST",
    headers: {
      "Authorization": `Bearer ${process.env.AUTOSEND_API_KEY}`,
      "Content-Type": "application/jose",
    },
    body: jwe,
  });

  return await res.json();
}

When to use JWE:

  • HIPAA / SOC2 / PCI-DSS compliance where payload logs in forward proxies must be zero-knowledge.
  • Transactional OTPs and password resets with zero internal server logging exposure.

Relevant Documentation