Use Server-Side Encryption with the B2 Native API

The B2 Native API encrypts new uploads and destination copies in new buckets with SSE-B2 and AES-256 by default. 

Existing buckets are enabled gradually; once enabled, the same default applies to their new uploads and destination copies. You can omit SSE-B2 request fields and headers unless you want to make the choice explicit.

Use SSE-C headers when you want to provide the encryption key for an individual object.

Create a bucket

When defaultServerSideEncryption is omitted from b2_create_bucket, the new bucket uses SSE-B2 with AES256 as its effective default. Automatic SSE-B2 does not require writeBucketEncryption.

You can explicitly specify the same setting:

{

 "defaultServerSideEncryption": {

   "mode": "SSE-B2",

   "algorithm": "AES256"

 }

}

Explicitly specifying the setting requires writeBucketEncryption.

Update or reset the bucket default

If defaultServerSideEncryption is omitted from b2_update_bucket, the existing setting is unchanged.

The following value resets the effective default to SSE-B2. It does not disable encryption:

{

 "defaultServerSideEncryption": {

   "mode": null

 }

}

Explicitly changing or resetting this field requires writeBucketEncryption.

View the Bucket’s Default Encryption

For a caller with readBucketEncryption, bucket responses report the effective SSE-B2/AES256 default even when no explicit configuration is stored:

"defaultServerSideEncryption": {

 "isClientAuthorizedToRead": true,

 "value": {

   "algorithm": "AES256",

   "mode": "SSE-B2"

 }

}

If the caller does not have readBucketEncryption, isClientAuthorizedToRead is false and value is null. This means the value is hidden by permissions; it does not mean encryption is disabled.

Upload an SSE-B2 object

No SSE-B2 header is required. If you omit encryption headers, b2_upload_file encrypts the file with SSE-B2 when the bucket is enabled.

To make the choice explicit, include:

X-Bz-Server-Side-Encryption: AES256

Upload a large file

If serverSideEncryption is omitted from b2_start_large_file, the large file uses SSE-B2 when the bucket is enabled. Every uploaded or copied part inherits the encryption selected when the large file is started.

Copy an object

If destinationServerSideEncryption is omitted from b2_copy_file, the destination object uses SSE-B2 when the destination bucket is enabled. The encryption state of the source object does not disable encryption for the destination.

Use SSE-C

To use SSE-C, include the customer algorithm, customer key, and customer key MD5 headers required by the upload, download, or copy operation.