sec-decrypt-aes Edge Function — Security

sec-decrypt-aes — Decrypt AES-256-GCM encrypted bundles

Decrypts ciphertext produced by sec-encrypt-aes using AES-256-GCM via the Web Crypto API. Throws a clear error if the key is wrong or the data has been tampered with.

---

API

POST /api/sec-decrypt-aes

Request body

Field	Type	Required	Description
encrypted	string	✅	The iv:ciphertext bundle from sec-encrypt-aes
key	string	✅	Same passphrase used during encryption

Success response (200)

{
  "success": true,
  "data": {
    "text": "sensitive data"
  }
}

Error responses

Code	HTTP	When
INVALID_INPUT	400	Missing encrypted or key
INTERNAL_ERROR	500	Wrong key, tampered data, or invalid bundle format

---

Usage

cURL

curl -X POST "$FUNCTION_URL" \
  -H "Content-Type: application/json" \
  -d '{"encrypted": "dGVzdA==:Y2lwaGVy", "key": "my-passphrase"}'

TypeScript / JavaScript (HTTP)

const response = await fetch(FUNCTION_URL, {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ encrypted: storedBundle, key: 'my-passphrase' }),
});
const { data } = await response.json();
console.log(data.text); // original plaintext

Direct import (Node / Bun / Deno)

import { decryptAes } from '@aerostack/functions/sec-decrypt-aes';

const { text } = await decryptAes({ encrypted: storedBundle, key: 'my-passphrase' });

---

Use Cases

• Recovering PII (emails, phone numbers) stored encrypted in a database
• Decrypting short-lived tokens or secrets transported in URL parameters
• Reading encrypted configuration blobs from storage
• Verifying webhook payloads were not tampered during transport

---

Notes

• Throws "Decryption failed: wrong key or tampered data" when the auth tag doesn't match — any bit flip in the ciphertext is detected
• Throws "Decryption failed: invalid encrypted bundle format" for malformed input
• Use exactly the same key string used during encryption
• Pair with sec-encrypt-aes — the bundle format is base64(iv):base64(ciphertext+authTag)