Encrypt HYOK fields with the SDK

import { EncryptedCorsaClient } from "@corsa-labs/sdk";

const client = EncryptedCorsaClient.withEncryptedFields(
  {
    baseUrl: "https://api.corsa.finance",
    apiKey: `${process.env.CORSA_API_TOKEN}:${process.env.CORSA_API_SECRET}`,
    publicKey: {
      spkiBase64: process.env.CORSA_HYOK_PUBLIC_KEY_SPKI, // contents of hyok-public-key.b64
      keyId: process.env.CORSA_HYOK_KEY_ID,               // your HYOK key ARN
    },
    // Optional: fail if the configured key doesn't have this SHA-256 fingerprint
    expectedKeySpkiSha256: process.env.CORSA_HYOK_KEY_SHA256,
  },
  encryptedFieldSchema // the same field list as your workspace's encryptionFieldsList
);

await client.individualClients.createIndividualClient({
  general: { firstName: "Jane", lastName: "Doe", personalId: "AB1234567" },
  contact: { emailAddress: "jane.doe@example.com" },
});
// firstName, lastName, personalId and emailAddress leave your process encrypted

# Without the SDK, each protected field must already be an encrypted envelope
# (prefix __enc__) produced with the envelope v2 format and your public key.
curl -X POST "https://api.corsa.finance/v1/clients/individuals" \
  -H "Authorization: Bearer <API_TOKEN>:<API_SECRET>" \
  -H "Content-Type: application/json" \
  -d '{
    "general": {
      "firstName": "__enc__eyJ2ZXJzaW9uIjoy...",
      "lastName": "__enc__eyJ2ZXJzaW9uIjoy..."
    }
  }'

# The Python SDK doesn't encrypt HYOK fields yet.
# Send protected fields through the Node.js SDK, a Corsa KYC integration,
# or manual entry in the app. Plaintext for protected fields is rejected.