Concepts
Encryption
Publish sensitive files as ciphertext and decrypt them in your service.
Files on the CDN are public by URL. If a file must not be readable by anyone who finds the link, mark it as encrypted.
How it works
- Turn on the encryption flag for a file in Project settings → Encryption.
- On publish, the content is encrypted with the project key (after
$notekeys are removed). - Your service decrypts it with the same key.
Getting the key
Project admins open Project settings → Encryption → Show key. Treat it like a password: keep it in an environment variable or a secrets manager, never in the repository.
const veresk = new Veresk({
cdnUrls: ['<CDN URL>'],
version: 'default',
consumer: 'backend',
encryptSecret: process.env.VERESK_SECRET,
});
Who can decrypt
A key that ships inside a game build can be extracted from the build. Use encryption for server-side consumers. For game clients, do not rely on it to hide secrets.
Regenerating the key
Regenerate creates a new key and re-encrypts all encrypted files with it. Clients that still use the old key can no longer decrypt, so update encryptSecret everywhere first.