---
title: "Azure Key Vault (Azure SDK)"
description: "Azure Key Vault is a managed cloud service for securely storing and using cryptographic keys, secrets, and certificates. This document describes the native Azure SDK–based integration in the walt.id platform, which…"
stack: "Community Stack (open source) — version 0.21.0"
stack_version: "0.21.0"
stack_comparison: https://docs.walt.id/community-vs-enterprise.md
canonical_url: https://docs.walt.id/community-stack/issuer/key-management/azure-kms/sdk
generated: 2026-07-20
---
# Azure Key Vault (Azure SDK)

Azure Key Vault is a managed cloud service for securely storing and using cryptographic keys, secrets, and certificates.
This document describes the **native Azure SDK–based integration** in the walt.id platform, which enables key
generation, signing, verification, and deletion directly via the Azure SDK instead of raw REST calls.

This backend is registered as **`azure`** in the key manager.  
The legacy REST-based implementation is now explicitly named **`azure-rest-api`**.

---

## Prerequisites

- An Azure account with an active subscription  
  https://azure.microsoft.com/free/
- An Azure Key Vault instance  
  https://learn.microsoft.com/azure/key-vault/general/quick-create-portal
- An Azure AD application (service principal)
- One of the following authentication methods:
    - Client Secret
    - Managed Identity (recommended for production)

---

## Supported Features

- Key generation in Azure Key Vault
- Signing using Azure-managed private keys
- Public key retrieval
- Key deletion

---

## Key Generation

Key creation is done using the standard onboarding endpoint.
The only difference is the backend type and configuration structure.

### Creation via Issuer API (Azure SDK)

**Option: Request**

**Endpoint**  
`/onboard/issuer`  
[API Reference](https://issuer.demo.walt.id/swagger/index.html#/Issuer%20onboarding/post_onboard_issuer)

**Example Request**

```bash
curl -X POST \
  'https://issuer.demo.walt.id/onboard/issuer' \
  -H 'accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "key": {
      "backend": "azure",
      "keyType": "secp256r1",
      "config": {
        "auth": {
          "keyVaultUrl": "url to the vault"
        },
        "tags": {
          "key": "value"
        }
      }
    },
    "did": {
      "method": "jwk"
    }
  }'
```
**Body Parameters**

- `key`
    - `backend`: _String_ - Must be `azure` for Azure SDK integration
    - `keyType`: _String_ - Supported: `secp256r1`, `ed25519` (depending on Key Vault capabilities)
    - `config`
        - `keyVaultUrl`: _String_ - The URL of your Azure Key Vault
        - `tags`: _Object_ - The metadata tags to add to the key for [Azure](https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/tag-resources)
- `did`
    - `method`: _String_ - Supported: `key`, `jwk`, `web`, `cheqd`

**Option: Response**

```json
{
  "issuerKey": {
    "type": "azure",
    "id": "https://<key-vault-name>.vault.azure.net/keys/issuer-key/1234567890abcdef",
    "_keyType": "secp256r1",
    "_publicKey": {
      "type": "jwk",
      "jwk": {
        "kty": "EC",
        "crv": "P-256",
        "kid": "https://<key-vault-name>.vault.azure.net/keys/issuer-key/1234567890abcdef",
        "x": "<x-coordinate>",
        "y": "<y-coordinate>",
        "key_ops": ["sign", "verify"]
      }
    }
  },
  "issuerDid": "did:jwk:..."
}
```

**Properties**

- `type`: _String_ - Always `azure` for Azure SDK keys
- `id`: _String_ - Full Azure Key Vault key identifier
- `_keyType` (optional): _String_
- `_publicKey` (optional): _Object_
- `issuerDid`: _String_

# Key Usage

Once created, Azure SDK–backed keys are used exactly like any other key backend.
The issuer API will transparently delegate cryptographic operations to Azure Key Vault.

The key reference is passed via the issuerKey object.

Example IssuerKey Object (Azure SDK) :
```json
{
  "issuerKey": {
  "type": "azure",
  "id": "https://<key-vault-name>.vault.azure.net/keys/issuer-key/1234567890abcdef"
  },
  "issuerDid": "did:jwk:..."
}
```