Encryption and decryption of Request and response for REST API I am working on encryption/decryption for the rest of the API.
The client here can be mobile, desktop, web browsers, etc and all the requests will be made to an https endpoint.
The main goal here is that the encryption/decryption has to be performed in client-side applications. The user himself should not be able to monitor the request/response made from his device(phone, browser, etc) and be able to perform encryption/decryption by himself. He should not be able to see the request/response in cleartext. Everything should happen in the client-side application.
For every request it should follow the steps as follows :

Client application encrypts the request data and makes an API call
Server decrypts the data and performs operations
Before sending the response back to the client application, the server encrypts the response and sends it
Client application decrypts the response and uses it

I had planned to use AES-256 but faced the following problems :

Secret key has to be stored hardcoded in the client-side applications. Doing so won't be safe
Getting the secret key every time from a rest API is not safe either as the request can be monitored and the key can be fetched from the response

I had planned to use AWS KMS service but faced the following problems :

For every encryption/decryption to be performed the client side has to login to AWS and then use the KMS service
If the login request is made then the request can be monitored again and the access key and secret key can be fetched from the response/request and then once the login access is gained, anyone can use the KMS service to encrypt/decrypt data

I did check articles where the secret key should be separate for each user and should be based on password but in my case User can log into to client-side application as a guest user so there won't be any password, email that has to be provided.
Not very sure how separate keys can be used for each user as the encryption/decryption has to be performed every time on both the client and server-side.
AES-256 is considered to be safe but I still didn't find any ways on how can a private key be managed on the client-side.
Any help here on how can AES, KMS be used? Any other solutions would be fine too.
In case you want to use AWS KMS without the raised issues, you can use AnonyFlow API for encryption/decryption. it is using the AWS KMS in the background and manage the private keys for you in order to avoid the keys issues you have raised, therefore you enjoy the service without worries.
It's very easy to consume the api, you can use the anony-value for encrypting one or more string values (string array) or use the anony-packet for encrypting json data - you can even define specific keys in order not to encrypt the entire json.
the best practice would be to consume it in your server side code. you can even create a serverless service on aws or any other platform to handle it.
Disclosure: I'm part of AnonyFlow creators.