I am making an API that uses the following steps for encryption. All of this is implemented using libsodium.
First of all the client has to make an initial request to the server for getting his public key and client token, with that key that corresponds to an unique sealedbox he encrypts and sends all the requests bodys. Once obtained he stores it locally
Then in order for the client to send a request to the server it has to encrypt the body ( create the sealedbox ) with the public key + ephemeral private key that's destroyed right after the encryption process.
Then the server takes the request and searches for the keypair generated for that client token in order to open the sealedbox.
When the server sends the response to the client is just a plain JSON
All connections to the server uses TLS 1.2+ + HSTS Header.
What do you think? Is it secure? Is there a better solution?
Do i need to implement Key exchange https://doc.libsodium.org/key_exchange in order to get the initial public key and client token to be completelysecure ?