APIs & Connections
$defineencryption--plain-english
TLDRScrambling data so the machines in the middle only see noise.
Encryption turns readable data into noise that only the right key can undo.
On the road, that is HTTPS. The padlock in the bar. Your secret, the password, the Polar token — they travel as junk until they reach the host. Coffee-shop wifi can watch the packets. It should not be able to read them. If your deploy URL is still http://, you are showing the room the card.
At rest, you encrypt what you would hate to leak from a stolen disk. Passwords are different: you hash them. One-way. You compare, you do not reverse. If you invent a scheme at 4 a.m., you will lose. Use the library. Use TLS.
The lock is not the key
Encryption protects the data, not the person you handed the key to. A phishing page, a committed .env, an agent that prints STRIPE_SECRET_KEY into the transcript — the math still works. The door is just open.
Keep keys in the env file. Put .env in .gitignore. After auth, hash. On the wire, require HTTPS in production. The CLI can scaffold the files. It cannot unsay a push.
The builder will pick Better Auth or Clerk so you do not roll this yourself. Let that be boring. Judges will type a password on a laptop they do not own. Hash it. Ship it over TLS. Do not store the leftover in a JSON fixture.
What this unlocks
A stolen packet is junk. A leaked key is not.
Scramble the data. Guard the key. Do not write the scramble.
