Encrypted Profile Fields
Manage encrypted profile fields without exposing plaintext email or display name values to Literal.
Literal stores profile data in two categories: server-visible account fields and client-encrypted profile fields.
Server-visible fields support account routing and lifecycle behavior, such as user ID, email verification status, key version, creation time, and last login time. Client-encrypted fields, such as email and display name, are stored as opaque ciphertext and decrypted only by the client.
Endpoint sequence:
GET /v1/users/mePATCH /v1/users/me
Use the API Reference for exact request fields, response bodies, and errors.
Visibility Model
| Data type | Visibility | Purpose |
|---|---|---|
| Account identifiers and timestamps | Server-visible | Account routing, session lifecycle, and operational metadata |
| Email verification status | Server-visible | Verification state, not the plaintext email address |
| Key version | Server-visible | Client-side decryption and rotation context |
| Encrypted email | Opaque ciphertext | Decrypted locally by the client |
| Encrypted display name | Opaque ciphertext | Decrypted locally by the client |
Literal stores encrypted profile fields exactly as submitted. The application server does not encrypt profile values on the client’s behalf.
Read An Encrypted Profile Field
- Fetch the authenticated profile.
- Treat encrypted fields as opaque ciphertext.
- Decrypt encrypted values locally using the User Master Key and the required AEAD context.
- Display plaintext only in the client.
Update An Encrypted Profile Field
- Validate the new value locally.
- Encrypt it with the current User Master Key and profile-field AEAD context.
- Submit the ciphertext to Literal.
- Store or display the decrypted value only on the client.
Updating display_name_encrypted replaces the stored ciphertext. Literal does not merge, inspect, or transform the encrypted value.
Encrypt profile values before sending them. If a client sends plaintext in an encrypted field, Literal stores that plaintext verbatim.
Related Resources
- Authentication — obtain and refresh access tokens.
- Key Hierarchy — understand how the User Master Key protects encrypted fields.
- API Reference — exact schemas for profile endpoints.
Last updated on