Developer quickstart

Call the sealed API

Create an API key in the sealed app, export it, and make your first request. The API resolves public directory data and routes already-sealed envelopes — it never sees message plaintext.

Base URL: https://api.sealedlabs.net. Same host serves these docs and the live /api/v1/* endpoints.

Create and export an API key

In the sealed app, open Settings → API Settings, unlock Developer API access, then create a key. The secret is shown once — store it safely.

Export it in your shell:

bash

export SEALED_API_KEY="sk_live_…"

Verify the key, then resolve a recipient

GET /api/v1/me confirms your Bearer header works. Then look up a public @handle and fetch the device keys you encrypt to.

bash

curl https://api.sealedlabs.net/api/v1/me \
  -H "Authorization: Bearer $SEALED_API_KEY"

curl https://api.sealedlabs.net/api/v1/handles/alice \
  -H "Authorization: Bearer $SEALED_API_KEY"

curl https://api.sealedlabs.net/api/v1/keys/0xabc… \
  -H "Authorization: Bearer $SEALED_API_KEY"

Try it in the browser

Paste a key and call the live API on this origin. Keys stay in sessionStorage only.

Try it — resolve a handle

GET /api/v1/handles/:handle

API keyStored in sessionStorage only. Sent solely to this API host.

Handle

Submit a sealed envelope

Seal ciphertext on your device (X25519 + AES-256-GCM), then POST the opaque fields. See Envelopes for the full schema and batching.

bash

curl https://api.sealedlabs.net/api/v1/envelopes \
  -H "Authorization: Bearer $SEALED_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "toAddress": "0x…",
    "ciphertext": "…",
    "ephemeralPublicKey": "…",
    "nonce": "…",
    "asRequest": true
  }'

There is no SDK yet. Use HTTPS + Bearer auth. Never log API secrets or attempt to POST plaintext message bodies — the server will only accept sealed envelope fields.

Authentication

Bearer keys, entitlements, and safe storage.

Introspect the calling key and its entitlements.

Handles

GET /api/v1/handles/:handle reference.