How to do encryption in Base

Some values need to travel or be stored without being readable by whoever holds them in between. A token you hand to a client and expect back later, a piece of state you keep but should not expose in the clear. Base gives you encryption as a service so you can protect those values without assembling a crypto stack or hand-rolling key handling, which is exactly the kind of code you do not want to get subtly wrong.

Encryption as a service, not a library call

The mistake encryption invites is treating it as a one-off: reach for a crypto primitive, pick an algorithm, manage a key in a variable, and move on. That is how you end up with keys in the wrong place and a scheme that looked fine and was not. Base instead gives you encryption through services you inject, the same way you inject anything else, so the safe path is the default path.

Two services carry the work. A key service is responsible for the encryption keys: where they come from and how they are managed, so key handling is centralized rather than scattered. A token service uses those keys to encrypt and decrypt values. You ask for the service you need, and you encrypt or decrypt through it, without owning the key plumbing yourself.

The token pattern

The shape Base supports directly is the encrypted token: take a value, encrypt it into a token you can safely hand out or store, and later decrypt that token back into the original value. The classic use is a value you give a client and expect to receive again, where you want to read it back but do not want the client to read or forge it in the meantime.

Because this runs through an injected service backed by the key service, the encryption and the key it uses stay consistent across your worker. You are not re-deriving a key in three places or hoping they match. The service is the single place that knows how, and your code just asks it to encrypt or decrypt.

Why this belongs in the framework

Cryptography is the canonical example of code that is dangerous to write yourself. The primitives are easy to misuse, the failures are silent, and the cost of getting it wrong is high. By making encryption a first-class service with managed keys, Base moves the risky decisions into the framework and leaves you with a small, safe interface: encrypt this, decrypt that. That is the same philosophy as the rest of Base, applied where the stakes are highest.

The mental model to keep

Encryption in Base is an injected service, not a pile of primitives you wire yourself. A key service manages the keys; a token service encrypts and decrypts values through them. Reach for it to protect values that travel or rest where they should not be readable, ask the service to do the work, and let the framework hold the parts that are dangerous to hand-roll.