# External encryption method


> [!WARNING]
> This file is not an end-user documentation, it is intended for developers. Please follow the user documentation on the OpenTofu website unless you want to work on the encryption code.

This directory contains the `external` encryption method. You can configure it like this:

```hcl
terraform {
  encryption {
    method "external" "foo" {
      keys = key_provider.some.provider
      encrypt_command = ["/path/to/binary", "arg1", "arg2"]
      decrypt_command = ["/path/to/binary", "arg1", "arg2"]
    }
  }
}
```

The external method must implement the following protocol:

1. On start, the method binary must emit the header line matching [the header schema](protocol/header.schema.json) on the standard output.
2. OpenTofu supplies the input metadata matching [the input schema](protocol/input.schema.json) on the standard input.
3. The method binary must emit the output matching [the output schema](protocol/output.schema.json) on the standard output.