def _add_header_client_encryption_key(api_context, key, custom_headers):
    """
    :type api_context: bunq.sdk.context.ApiContext
    :type key: bytes
    :type custom_headers: dict[str, str]

    :rtype: None
    """

    public_key_server = api_context.installation_context.public_key_server
    key_cipher = PKCS1_v1_5_Cipher.new(public_key_server)
    key_encrypted = key_cipher.encrypt(key)
    key_encrypted_base64 = base64.b64encode(key_encrypted).decode()
    custom_headers[_HEADER_CLIENT_ENCRYPTION_KEY] = key_encrypted_base64