In my smart contract, I want to use the random.org API to generate a random number, but when publishing the verified source code I don't want anyone to see what API key I'm using. The etheroll contract uses the random.org API and does this as follows:

bytes32 rngId = oraclize_query("nested", "[URL] ['json(https://api.random.org/json-rpc/1/invoke).result.random[\"serialNumber\",\"data\"]', '\\n{\"jsonrpc\":\"2.0\",\"method\":\"generateSignedIntegers\",\"params\":{\"apiKey\":${[decrypt] BLTr+ZtMOLP2SQVXx8GRscYuXv+3wY5zdFgrQZNMMY3oO/6C7OoQkgu3KgfBuiJWW1S3U/+ya10XFGHv2P7MB7VYwFIZd3VOMI/Os8o1uJCdGGZgpR0Dkm5QoNH7MbDM0wa2RewBqlVLFGoZX1PJC+igBPNoHC4=},\"n\":1,\"min\":1,\"max\":100,\"replacement\":true,\"base\":10${[identity] \"}\"},\"id\":1${[identity] \"}\"}']", gasForOraclize);

I'm confused how this is working - where does decrypt come from and, if this works, how do I get an encrypted version of my API key that I can use decrypt on like the above?

1 Answer 1


This is explained in detail in the Oracalize Docs in Ethereum > Adavanced Topics > Encrypted Queries

You use a supplied python script to encrypt a string with Oracalize public key listed in that section and only Oracalize can decrypt it. You're limited to one encrypted query parameter only.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.