Make an AES-256 key from quantum entropy

python3 -m venv .venv && .venv/bin/pip install requests cryptography python-dotenv

# Qrypt quickstart (Python): 1 KiB of quantum entropy -> AES-256-GCM key.
# Setup: pip install requests cryptography python-dotenv
# Then put QRYPT_API_KEY=<your token> in a .env file next to this script.
import base64
import os
import sys

import requests
from cryptography.hazmat.primitives.ciphers.aead import AESGCM
from dotenv import load_dotenv

API = os.getenv("QRYPT_BASE_URL", "https://api-eus.qrypt.com")  # mock override

# One friendly message per failure. We never retry automatically.
HELP = {None: "QRYPT_API_KEY is missing: add it to .env (see .env.example).",
        400: "400: size must be 1-512. It counts KiB, not bytes.",
        401: "401: Authorization header missing, malformed or expired.",
        403: "403: Token invalid OR monthly quota used. Check the token first.",
        429: "429: rate limited. Live can return 429 about 1 s after a single "
             "prior call; wait 10 s or more and never loop."}
# 500, 503 and anything else: Qrypt is busy or erroring, so try again later.

# Step 1: read the token from .env. Never print or log it.
load_dotenv()
token = os.getenv("QRYPT_API_KEY") or sys.exit(HELP[None])

# Step 2: fetch 1 KiB of entropy. A custom User-Agent avoids Cloudflare's
# block on Python's urllib; X-Qrypt-Client tags quickstart traffic.
headers = {
    "Authorization": f"Bearer {token}", "Accept": "application/json",
    "User-Agent": "qrypt-quickstart/1.0", "X-Qrypt-Client": "quickstart-py/1.0"}
try:
    resp = requests.get(f"{API}/api/v1/quantum-entropy", params={"size": 1},
                        headers=headers, timeout=15)
    if resp.status_code != 200:
        sys.exit(HELP.get(resp.status_code, f"{resp.status_code}: Qrypt is "
                          "busy or erroring. Try again shortly."))
    entropy_b64 = resp.json()["random"][0]
except (requests.RequestException, ValueError):
    sys.exit("Network error or non-JSON reply: check proxy/TLS, retry soon.")

# Step 3: decode first, then keep 32 bytes as the AES-256 key.
key = base64.b64decode(entropy_b64)[:32]

# Step 4: encrypt and decrypt a sample message with AES-256-GCM.
aes, nonce, message = AESGCM(key), os.urandom(12), b"hello, quantum entropy"
assert aes.decrypt(nonce, aes.encrypt(nonce, message, None), None) == message
print("Success: AES-256-GCM round trip with a Qrypt key (not shown).")

.venv/bin/python quickstart.py

// Qrypt quickstart (Node 20.12+): 1 KiB of quantum entropy -> AES-256-GCM key.
// No dependencies. Put QRYPT_API_KEY=<your token> in a .env file here.
import assert from "node:assert";
import { existsSync } from "node:fs";
import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";

const API = process.env.QRYPT_BASE_URL ?? "https://api-eus.qrypt.com"; // mock

// One friendly message per failure. We never retry automatically.
const HELP = { missing: "QRYPT_API_KEY is missing: add it to .env.",
  network: "Network error or non-JSON reply: check proxy/TLS, retry soon.",
  400: "400: size must be 1-512. It counts KiB, not bytes.",
  401: "401: Authorization header missing, malformed or expired.",
  403: "403: Token invalid OR monthly quota used. Check the token first.",
  429: "429: rate limited. Live can return 429 about 1 s after a single " +
    "prior call; wait 10 s or more and never loop." };
// 500, 503 and anything else: Qrypt is busy or erroring, so try again later.
const fail = (msg) => { console.error(msg); process.exit(1); };

// Step 1: read the token from .env. Never print or log it.
if (existsSync(".env")) process.loadEnvFile(".env");
const token = process.env.QRYPT_API_KEY || fail(HELP.missing);

// Step 2: fetch 1 KiB of entropy (size counts KiB, not bytes).
const headers = { Authorization: `Bearer ${token}`, Accept: "application/json",
  "User-Agent": "qrypt-quickstart/1.0", "X-Qrypt-Client": "quickstart-js/1.0" };
const url = `${API}/api/v1/quantum-entropy?size=1`;
const res = await fetch(url, { headers }).catch(() => fail(HELP.network));
if (res.status !== 200) fail(HELP[res.status] ??
  `${res.status}: Qrypt is busy or erroring. Try again shortly.`);
const body = await res.json().catch(() => fail(HELP.network));

// Step 3: decode first, then keep 32 bytes as the AES-256 key.
const key = Buffer.from(body.random[0], "base64").subarray(0, 32);

// Step 4: encrypt and decrypt a sample message with AES-256-GCM.
const GCM = "aes-256-gcm", iv = randomBytes(12), message = "hello, quantum";
const enc = createCipheriv(GCM, key, iv);
const sealed = Buffer.concat([enc.update(message, "utf8"), enc.final()]);
const dec = createDecipheriv(GCM, key, iv).setAuthTag(enc.getAuthTag());
assert.equal(dec.update(sealed, null, "utf8") + dec.final("utf8"), message);
console.log("Success: AES-256-GCM round trip with a Qrypt key (not shown).");

node quickstart.mjs