portal-api/app/Support/ResponseCipher.php

<?php

namespace App\Support;

use RuntimeException;

class ResponseCipher
{
    public static function encrypt(?string $value): ?string
    {
        if ($value === null || $value === '') {
            return $value;
        }

        $key = (string) config('services.client_api.response_key');
        if (!preg_match('/^[a-fA-F0-9]{64}$/', $key)) {
            throw new RuntimeException('CLIENT_RESPONSE_KEY must be a 64-character hex string');
        }

        $iv = random_bytes(12);
        $ciphertext = openssl_encrypt($value, 'aes-256-gcm', hex2bin($key), OPENSSL_RAW_DATA, $iv, $tag);

        return base64_encode($iv . $ciphertext . $tag);
    }
}