AES-GCM encrypt

POST /api/aes-gcm-encrypt3 quota units per call · cache hits free

Authenticated encryption with AES-128/192/256 in Galois/Counter Mode. Provide a raw key or a password (PBKDF2-stretched in-line). Returns IV + ciphertext + auth tag, all base64-encoded.

Authenticated symmetric encryption with AES-GCM (Web Crypto). Authenticated = ciphertext can't be tampered without the auth tag failing on decrypt — defends against both confidentiality *and* integrity attacks. Two key modes: - `keyMode="raw"` — supply `key` as hex / base64 (128, 192, or 256 bits exactly). - `keyMode="password"` — supply `password` + `salt`; the tool PBKDF2-stretches them (SHA-256, 600 000 rounds, 256-bit) to derive the AES key. Inputs can be UTF-8 text, hex, or base64. The IV is generated randomly (12 bytes — NIST-recommended) unless `iv` is supplied. **Output:** JSON with `ciphertext`, `iv`, `tag`, `keyMode`, and `algorithm`. With `keyMode=password`, the response also echoes the salt + iteration count so the recipient can rederive the key.

Inputs

Name	Type	Default	Description
data*	string	—	Plaintext to encrypt.
dataFormat	enum (text \| hex \| base64)	"text"	Input encoding of `data`.
keyMode	enum (raw \| password)	"raw"	Whether `key` is the raw AES key or a password to stretch via PBKDF2.
key	string	—	Raw key (16/24/32 bytes as hex/base64). Required when keyMode=raw.
keyFormat	enum (hex \| base64)	"hex"	Encoding of raw `key`.
password	string	—	Password to stretch (required when keyMode=password).
salt	string	—	Salt for PBKDF2 (required when keyMode=password). UTF-8 by default; hex/base64 via saltFormat.
saltFormat	enum (text \| hex \| base64)	"text"	Encoding of `salt`.
iterations	number (1000…10000000)	600000	PBKDF2 iterations (keyMode=password only).
keyBits	number (128…256)	256	AES key length in bits (128, 192, 256).
iv	string	—	Optional explicit IV (12 bytes, hex/base64). Random if omitted.
ivFormat	enum (hex \| base64)	"hex"	Encoding of `iv` when supplied.
aad	string	—	Optional additional authenticated data (AAD).
aadFormat	enum (text \| hex \| base64)	"text"	Encoding of `aad`.

Response

Modes: json. Cache: not cacheable.

Every response carries x-cache (HIT / MISS / BYPASS), x-cache-signature (stable across identical inputs), and the rate-limit headers listed below.

Quota & limits

Cost per call	3 units against the 10,000-unit monthly quota. Cache hits are free — only cache misses decrement.
Burst limit	200 requests per rolling minute, shared across all tools.
Max request size	`4 MiB` (base64 inflates file payloads ~33% — the limit applies to the decoded bytes).
Max response size	`6 MiB`
Timeout	30s wall clock.
Rate-limit headers	`X-RateLimit-Limit`, `X-RateLimit-Remaining`, `X-RateLimit-Burst-Limit` on every response; `X-Quota-Warning` once 80% of the monthly quota is spent; `Retry-After` on 429s.

Errors

Errors are JSON with an error string; schema failures add a details object (Zod's flattened field errors).

Status	When	Body
400	Input fails the tool's schema (wrong type, missing required field, malformed base64) or the file bytes can't be parsed as the expected format.	{ "error": "invalid inputs", "details": { "fieldErrors": { … } } }
401	Missing or invalid X-Api-Key / X-Account-Id headers (or no session when called from the browser).	{ "error": "unauthorized" }
404	Unknown tool id, or calling /api/* on the website hostname instead of api.xtract.bot.	{ "error": "not found" }
413	Request body over the tool's max request size, or an image header declaring more megapixels than the tool's pixel budget.	{ "error": "…exceeds maxRequestBytes…" }
415	Content-Type isn't application/json on the json-body transport.	{ "error": "unsupported content-type; expected application/json" }
429	Monthly quota or the 200/min burst limit exhausted. Check Retry-After and the X-RateLimit-* headers.	{ "error": "monthly quota exceeded", "monthRemaining": 0, … }
5xx	Conversion engine failure. Safe to retry; if it persists, the input is hitting a bug — please report it.	{ "error": "…" }

Code samples

Built from the password-mode example.


curl -X POST https://api.xtract.bot/api/aes-gcm-encrypt \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
  -H "X-Account-Id: $XTRACT_ACCOUNT_ID" \
  -H "X-Api-Key: $XTRACT_API_KEY" \
  -d '{
  "data": "the eagle has landed",
  "keyMode": "password",
  "password": "correct horse battery staple",
  "salt": "xtract.bot-demo",
  "iterations": 100000,
  "keyBits": 256
}'