Please bear with me as I am not an expert in security. I have a server and a client. On the server I am encrypting a very secret message (using AES256-GCM to hide the information and protect it's integrity) that I will send to the client. The client though will never decrypt this message, they will only receive it from the server and send it back to the server with their requests. My server will then decrypt and get the secret message which it needs to process other information. I need to ensure the client will never know of the contents inside the message. I am using javascript (NodeJS) for my server code and it looks like this (hopefully it is simple to read and easy to understand):

var crypto = require('crypto'); //get crypto library
var algorithm = 'aes-256-gcm'; // select which algorithm I want to use
var password = '3zTvzr3p67VC61jmV54rIYu1545x4TlY'; //Random generated 256bit key

function encrypt(text) {
  var iv = crypto.randomBytes(128) // generate a random 128bit iv for every encryption
  var cipher = crypto.createCipheriv(algorithm, password, iv)
  var encrypted = cipher.update(text, 'utf8', 'hex')
  encrypted += cipher.final('hex');
  var tag = cipher.getAuthTag();
  var enc = {
    content: encrypted,
    tag: tag.toString('hex')
  };

sendToClientOverInternet(enc,iv); //send the encrypted content + the iv to client over the internet
  
}

function decrypt(encrypted) {
  var decipher = crypto.createDecipheriv(algorithm, password, iv)
  decipher.setAuthTag(new Buffer(encrypted.tag, 'hex'));
  var dec = decipher.update(encrypted.content, 'hex', 'utf8')
  dec += decipher.final('utf8');
  return dec;
}

I am concerned more of the process and encryption methods opposed to infrastructure security. With that lets assume my server is completely safe and the hard coded password in my code will never be accessed and the transportation of data over the internet is over ssl.

My code with my questions:

1) First I generated a global securely random 32bit key.

Q: Is this the correct size? Any way to improve the key?

2) I have an encrypt method which takes some text and encrypts it using AES256-GCM. It then takes this encrypted object and along with the iv(128 bit securley random generated for every message) sends it to the client. The client if they wanted to then could now see this encrypted object and the iv.

Q: Is protecting the integrity of the data using GCM necessary? If I use CTR instead wouldn't it be impossible for the hacker to decrypt and change the message anyways without the key? So is GCM 'overkill'? Is sending the iv and having it accessible to the user safe? Is a 128 bit iv long enough? Any big improvements I can make here?.

3) I have a decrypt method which takes my encrypted string and decrypts it.

Q: (I don't think anything here needs to be improved).

Any improvements or suggestions would be greatly appreciated.