> ## Documentation Index
> Fetch the complete documentation index at: https://docs.basaltic.sh/llms.txt
> Use this file to discover all available pages before exploring further.

# Bucket encryption

> What is encrypted by default, and binding a bucket to a key of your own.

## Encryption

Server-side encryption is **opt-in**, and it is off until you turn it on. Two
ways:

<Tabs>
  <Tab title="Console">
    The **Default encryption** card on the bucket's **Settings** tab is a
    switch and a **Save**. It sets the bucket default and nothing else — the
    console's upload page has no encryption field, so encrypting a single
    object against a bucket with no default is API only.
  </Tab>

  <Tab title="API">
    Per bucket, which is the one to reach for:

    ```bash theme={null}
    PUT /v1/buckets/{bucket}/encryption
    { "encryption": { "rules": [ { "default": { "sse_algorithm": "AES256" } } ] } }
    ```

    Or per object, on the write itself:

    ```bash theme={null}
    PUT /v1/buckets/{bucket}/objects/{key}
    X-Amz-Server-Side-Encryption: AES256
    ```
  </Tab>

  <Tab title="CLI">
    ```bash theme={null}
    basaltic storage bucket set-encryption <bucket> --from-file encryption.json
    ```

    The body is the same JSON the API takes; `--from-file -` reads stdin.
  </Tab>

  <Tab title="Go">
    ```go theme={null}
    err := storage.New(cfg).PutBucketEncryption(ctx, bucket,
        &storage.PutBucketEncryptionRequest{Encryption: enc})
    ```
  </Tab>
</Tabs>

The bucket default applies to writes that carry no header of their own — a
per-request header wins over it. Only `AES256` is supported; `aws:kms` and
customer-provided keys are rejected with a clear error rather than being
silently downgraded.

<Info>
  A multipart upload carries no encryption header of its own on each part: the
  decision is made when the upload is created and survives to the assembled
  object. Check `ServerSideEncryption` on a `HEAD` of the finished object, not
  on the create response.
</Info>