---
title: "Azure Key Vault"
description: "Azure Key Vault is a cloud service for securely storing and managing cryptographic keys, secrets, and certificates. It provides a secure and reliable way to protect sensitive information and control access to keys used…"
stack: "Enterprise Stack (commercial) — version 0.21.0"
stack_version: "0.21.0"
stack_comparison: https://docs.walt.id/community-vs-enterprise.md
canonical_url: https://docs.walt.id/enterprise-stack/services/key-management-service/azure-key-vault
generated: 2026-07-20
---
# Azure Key Vault

Azure Key Vault is a cloud service for securely storing and managing cryptographic keys, secrets, and certificates. It
provides a secure and reliable way to protect sensitive information and control access to keys used by cloud
applications and services.

## Prerequisites

- An Azure account with an active subscription. [Create an account](https://azure.microsoft.com/en-us/free/).
- An Azure Key Vault
  instance. [Create a Key Vault](https://docs.microsoft.com/en-us/azure/key-vault/quick-create-portal).
- An Azure AD application with access to the Key
  Vault. [Create an Azure AD application](https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app).

## Setup direct azure access to Key Vault

1. **Create an Azure AD application** with access to the Key Vault. Note down the `Application (client) ID` and
   `Directory (tenant) ID`.
2. **Create a client secret** for the Azure AD application. Note down the `Client Secret`.
3. **Assign permissions** to the Azure AD application to access the Key Vault. Grant the `Key permissions` and
   `Secret permissions` to the application.
4. **Get the Key Vault URL**. Note down the `Key Vault URL` from the Azure portal.
5. **Configure the issuer API** to use the Azure Key Vault. Provide the `Key Vault URL`, `Application ID`, `Tenant ID`,
   and `Client Secret` in the issuer API configuration.
6. **Generate a key** in the Key Vault. Use the issuer API to generate a key in the Azure Key Vault.
7. **Sign and issue credentials** using the key stored in the Azure Key Vault.

## Key Generation

**Option: Request**

Endpoint:`/v1/{target}/kms-service-api/keys/generate` | [API Reference](https://enterprise.sandbox.walt.id/swagger/index.html#/Service%20%7C%20Key%20Management/post_v1__target__kms_service_api_keys_generate)

**Example Request**

```bash
curl -X 'POST' \
  'https://{orgID}.enterprise-sandbox.waltid.dev/v1/{target}/kms-service-api/keys/generate' \
  -H 'accept: */*' \
  -H 'Authorization: Bearer {yourToken}' \
  -H 'Content-Type: application/json' \
  -d '{
  "backend": "azure-rest-api",
  "keyType": "secp256r1",
  "config": {
    "auth": {
      "clientId": "your-client-id",
      "clientSecret": "your-client-secret",
      "tenantId": "your-tenant-id",
      "keyVaultUrl": "https://your-key-vault-name.vault.azure.net/"
    },
    "tags": {
      "key": "value"
    }
  }
}'
```

**Body**

```json
{
  "backend": "azure-rest-api",
  "keyType": "secp256r1",
  "config": {
    "auth": {
      "clientId": "your-client-id",
      "clientSecret": "your-client-secret",
      "tenantId": "your-tenant-id",
      "keyVaultUrl": "https://your-key-vault-name.vault.azure.net/"
    },
    "tags": {
      "key": "value"
    }
  }
}

```

**Body Parameters**

- `backend`: _String_ - Specifies the storage type of key. It can be `jwk` (managed by you), `azure-rest-api` (managed
     by Azure Key Vault using Rest api requests ) and others. Learn more about different
     types [here](https://docs.walt.id/enterprise-stack/services/key-management-service/overview.md).
- `keyType`: _String_ - the algorithm used to generate the key. Supported Azure Key Vault values are `secp256r1`, `secp384r1`, `secp521r1`, `secp256k1`, `RSA`, `RSA3072`, and `RSA4096`. `Ed25519` is not supported.
- `config`
    - `keyVaultUrl`: _String_ - The URL of the Azure Key Vault.
    - `clientId`: _String_ - The client ID of the Azure AD application.
    - `tenantId`: _String_ - The tenant ID of the Azure AD application.
    - `clientSecret`: _String_ - The client secret of the Azure AD application.
- `tags`: _Object_ - The metadata tags to add to the key for [Azure](https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/tag-resources).

**Option: Response**

**Example Response**

The generate key endpoint will return an object containing the JWK format and the Id of the key.

```json
{
  "_id": "{target}.https://waltid.vault.azure.net/keys/589323424/e135335b738f4e8cab81faa408329afe",
  "key": {
    "type": "azure-rest-api",
    "id": "https://waltid.vault.azure.net/keys/589323424/e135335b738f4e8cab81faa408329afe",
    "auth": {
      "clientId": "your-client-id",
      "clientSecret": "your-client-secret",
      "tenantId": "your-tenant-id",
      "keyVaultUrl": "https://your-key-vault-name.vault.azure.net/"
    },
    "_keyType": "secp256r1",
    "_publicKey": {
      "type": "jwk",
      "jwk": {
        "kty": "EC",
        "crv": "P-256",
        "kid": "https://waltid.vault.azure.net/keys/589323424/e135335b738f4e8cab81faa408329afe",
        "key_ops": [
          "sign",
          "verify"
        ],
        "x": "jHHX9NRLXN9ccd2a7gJFWlpQlXIFkToDT6kKR5kv_vQ",
        "y": "E1Pl9WoCZoyTE74Myr_SlvmWL_FYQPZdq_Q76pXa7Wo"
      }
    }
  },
  "parent": "{target}.https://waltid.vault.azure"
}
```

**Properties**

- `type`: _String_ - the type of key can be either "aws" when using AWS KMS or "jwk" when providing the key in
  full as JWK.
-`auth`: _Object_ - The authentication configuration for the Azure Key Vault.
     - `clientId`: _String_ - The client ID of the Azure AD application.
     - `tenantId`: _String_ - The tenant ID of the Azure AD application.
     - `clientSecret`: _String_ - The client secret of the Azure AD application.
     - `keyVaultUrl`: _String_ - The URL of the Azure Key Vault.
- `_publicKey` (optional): _Array_ - The public key can be fetched by the issuer API or directly provided, saving
  resources and reducing network requests.
- `_keyType` (optional): _String_ - The key type can be fetched by the issuer API or directly provided, saving resources
  and reducing network requests.

**Response Codes**

- `201` - Key created and stored in KMS.

## Setup environment managed access to Key Vault 

- An Azure account with an active subscription  
  https://azure.microsoft.com/free/
- An Azure Key Vault instance  
  https://learn.microsoft.com/azure/key-vault/general/quick-create-portal
- An Azure AD application (service principal)
- Managed Identity authentication (recommended for production)

## Key Generation

**Option: Request**

Endpoint:`/v1/{target}/kms-service-api/keys/generate` | [API Reference](https://enterprise.sandbox.walt.id/swagger/index.html#/Service%20%7C%20Key%20Management/post_v1__target__kms_service_api_keys_generate)

**Example Request**

```bash
curl -X 'POST' \
  'https://{orgID}.enterprise-sandbox.waltid.dev/v1/{target}/kms-service-api/keys/generate' \
  -H 'accept: */*' \
  -H 'Authorization: Bearer {yourToken}' \
  -H 'Content-Type: application/json' \
  -d '{
  "backend": "azure",
  "keyType": "secp256r1",
  "config": {
    "auth": {
      "keyVaultUrl": "https://your-key-vault-name.vault.azure.net/"
    },
    "tags": {
      "key": "value"
    }
  }
}'
```

**Body**

```json
{
  "backend": "azure",
  "keyType": "secp256r1",
  "config": {
    "auth": {
      "keyVaultUrl": "https://your-key-vault-name.vault.azure.net/"
    },
    "tags": {
      "key": "value"
    }
  }
}

```

**Body Parameters**

- `backend`: _String_ - Specifies the storage type of key. It can be `jwk` (managed by you), `azure` (managed
  by Azure Key Vault using Rest api requests ) and others. Learn more about different
  types [here](https://docs.walt.id/enterprise-stack/services/key-management-service/overview.md).
- `keyType`: _String_ - the algorithm used to generate the key. Supported Azure Key Vault values are `secp256r1`, `secp384r1`, `secp521r1`, `secp256k1`, `RSA`, `RSA3072`, and `RSA4096`. `Ed25519` is not supported.
- `config`
    - `auth`: _Object_ - The authentication configuration for the Azure Key Vault.
      - `keyVaultUrl`: _String_ - The URL of the Azure Key Vault.
    - `tags`: _Object_ - The metadata tags to add to the key for [Azure](https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/tag-resources).

**Option: Response**

**Example Response**

The generate key endpoint will return an object containing the JWK format and the Id of the key.

```json
{
  "_id": "{target}.https://waltid.vault.azure.net/keys/589323424/e135335b738f4e8cab81faa408329afe",
  "key": {
    "type": "azure",
    "id": "https://waltid.vault.azure.net/keys/589323424/e135335b738f4e8cab81faa408329afe",
    "config": {
      "auth" : {
        "keyVaultUrl": "https://your-key-vault-name.vault.azure.net/"
      }
    },
    "_keyType": "secp256r1",
    "_publicKey": {
      "type": "jwk",
      "jwk": {
        "kty": "EC",
        "crv": "P-256",
        "kid": "https://waltid.vault.azure.net/keys/589323424/e135335b738f4e8cab81faa408329afe",
        "key_ops": [
          "sign",
          "verify"
        ],
        "x": "jHHX9NRLXN9ccd2a7gJFWlpQlXIFkToDT6kKR5kv_vQ",
        "y": "E1Pl9WoCZoyTE74Myr_SlvmWL_FYQPZdq_Q76pXa7Wo"
      }
    }
  },
  "parent": "{target}.https://waltid.vault.azure"
}
```

**Properties**

- `type`: _String_ - the type of key can be either "aws" when using AWS KMS or "jwk" when providing the key in
  full as JWK.
  -`config`: _Object_ - The authentication configuration for the Azure Key Vault.
     - `keyVaultUrl`: _String_ - The URL of the Azure Key Vault.
- `_publicKey` (optional): _Array_ - The public key can be fetched by the issuer API or directly provided, saving
  resources and reducing network requests.
- `_keyType` (optional): _String_ - The key type can be fetched by the issuer API or directly provided, saving resources
  and reducing network requests.

**Response Codes**

- `201` - Key created and stored in KMS.