# Why and how to encrypt the app key

**URL:** <https://www.thethingsnetwork.org/forum/t/why-and-how-to-encrypt-the-app-key/46494>\
**Category:** V3 Integrations\
**Created:** [April 7, 2021, 9:40pm UTC](https://www.thethingsnetwork.org/forum/t/why-and-how-to-encrypt-the-app-key/46494 "2021-04-07T21:40:24Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![haeberle](https://www.thethingsnetwork.org/forum/user_avatar/www.thethingsnetwork.org/haeberle/32/35697_2.png) [@haeberle](https://www.thethingsnetwork.org/forum/u/haeberle)\
**Post date:** [April 7, 2021, 9:40pm UTC](https://www.thethingsnetwork.org/forum/t/why-and-how-to-encrypt-the-app-key/46494/1 "2021-04-07T21:40:24Z")

</div>

I try to upgrade an application to the V3 API in which I have trigger a device creation. Understood so far, that I have to call several API endpoints to create the enddevice, works well so fare.

The thing I’m struggling is, the submission of the app\_key as an KeyEnvelope. I have to provide three values:

key (not encryted from AES)  
kek\_label (used to encrypt)  
encrypted\_key

Not clear why I have to provide those things, for security reason ? If yes, then does it make sense to submit the key, the encrypted and the kek together ? Or do I misunderstood something ?

Does anyone have a hint how I create those values with c#

Thanks a million