---
title: "AWS KMS"
description: "The Wallet API supports AWS KMS as a key management solution. You can utilize AWS KMS to store your cryptographic keys in a secure and scalable way."
stack: "Community Stack (open source) — version 0.21.0"
stack_version: "0.21.0"
stack_comparison: https://docs.walt.id/community-vs-enterprise.md
canonical_url: https://docs.walt.id/community-stack/wallet/key-management/aws-kms
generated: 2026-07-20
---
# AWS KMS

The Wallet API supports AWS KMS as a key management solution.
You can utilize AWS KMS to store your cryptographic keys in a secure and scalable way.

We support both AWS KMS with a rest api implementation and AWS SDK for Kotlin to manage cryptographic keys.
<!---
## AWS SDK Extension configuration for walt.id Wallet API

The extension utilizes AWS SDK's default credential provider chain for authentication, automatically detecting
credentials from multiple sources.
To use the extension, you need to add in
the [main function](https://github.com/walt-id/waltid-identity/blob/main/waltid-services/waltid-wallet-api/src/main/kotlin/id/walt/webwallet/Main.kt)
of the wallet-api,
the following code snippet:

```kotlin

suspend fun main(args: Array<String>) {
    ServiceMain(
        ServiceConfiguration("wallet"), ServiceInitialization(
            features = FeatureCatalog,
            featureAmendments = mapOf(
                CommonsFeatureCatalog.openApiFeature to walletOpenApiPluginAmendment,
                CommonsFeatureCatalog.authenticationServiceFeature to walletAuthenticationPluginAmendment
            ),
            init = {
                webWalletSetup()
                WaltidServices.minimalInit()
                WaltCryptoAws.init() // Initialize the AWS SDK extension
                Db.start()
            },
            run = WebService(Application::webWalletModule).run()
        )
    ).main(args)
}


```
-->
## Key Creation

Below you find an example call to create a key in AWS KMS and associate it with a wallet managed by the Wallet API.

The only thing that is important to note for the creation, that our system is only compatible with the following Key
types offered by the AWS KMS:

- RSA , SECP256R1, SECP256K1

**Option: USING AWS REST API**

**Endpoint:**
`/keys/generate` | [API Reference](https://wallet.demo.walt.id/swagger/index.html#/Keys/post_wallet_api_wallet__wallet__keys_generate)

**Example Request**

```bash
curl -X 'POST' \
  'https://wallet.demo.walt.id/wallet-api/wallet/f01f8f55-d098-4c53-b47b-c97552829b39/keys/generate' \
  -H 'accept: */*' \
  -H 'Content-Type: application/json' \
  -d '{
  "backend": "aws-rest-api",
  "config": {
   "auth":{
    "region": "eu-central-1",
    "accessKeyId": "accessKeyId",
    "secretKey": "secretKeyId"
  },
  "tags": {
    "key": "value"
  },
  "keyType": "secp256r1"
}'
```

**Body**

```json
{
  "backend": "aws-rest-api",
  "config": {
    "auth": {
      "region": "eu-central-1",
      "accessKeyId": "accessKeyId",
      "secretKey": "secretKeyId"
    },
    "tags": {
      "key": "value"
    }
  },
  "keyType": "secp256r1"
}
```

**Body Parameters**

- `backend`: _String_ - The location where the key is stored. In our case `aws-rest-api` as we want to store it in aws's
  kms.
- `config`
    - `region`: _String_ - The region where the key is stored.
    - `accessKeyId`: _String_ - The access key id for the AWS account.
    - `secretKey`: _String_ - The secret key for the AWS account.
    - `tags`: _Object_ - The metadata tags to add to the key for [AWS](https://docs.aws.amazon.com/kms/latest/developerguide/tagging-keys.html)
- `keyType`: _String_ - the algorithm used to generate the key. For AWS only RSA and secp256r1 and secp256k1 is
  possible.

---

**Example Response**

The API will respond with the ID of the key. This ID is the internal reference and can be used in operations such as DID
create or key delete.

```
Kki22j4lUwo1gtDfdvdCgOE0hhKcNHgIZSzSxU0CugE
```

**Option: USING AWS SDK**

**Endpoint:**
`/keys/generate` | [API Reference](https://wallet.demo.walt.id/swagger/index.html#/Keys/post_wallet_api_wallet__wallet__keys_generate)

**Example Request**

```bash
curl -X 'POST' \
  'https://wallet.demo.walt.id/wallet-api/wallet/f01f8f55-d098-4c53-b47b-c97552829b39/keys/generate' \
  -H 'accept: */*' \
  -H 'Content-Type: application/json' \
  -d '{
  "backend": "aws",
  "config": {
    "region": "eu-central-1",
    "tags": {
      "key": "value"
    }
  },
  "keyType": "secp256r1"
}'
```

**Body**

```json
{
  "backend": "aws",
  "config": {
    "region": "eu-central-1",
    "tags": {
      "key": "value"
    }
  },
  "keyType": "secp256r1"
}
```

**Body Parameters**

- `backend`: _String_ - The location where the key is stored. In our case `aws` as we want to store it in aws's kms.
- `config`
    - `region`: _String_ - The region where the key is stored.
    - `tags`: _Object_ - The metadata tags to add to the key for [AWS](https://docs.aws.amazon.com/kms/latest/developerguide/tagging-keys.html)
- `keyType`: _String_ - the algorithm used to generate the key. For AWS only RSA and secp256r1 and secp256k1 is
  possible.

---

**Example Response**

The API will respond with the ID of the key. This ID is the internal reference and can be used in operations such as DID
create or key delete.

```
Kki22j4lUwo1gtDfdvdCgOE0hhKcNHgIZSzSxU0CugE
```