---
title: "Overview"
description: "The Key Management Service (KMS) is used for creating, storing, and managing cryptographic keys. It is used by various other services, including:"
stack: "Enterprise Stack (commercial) — version 0.21.0"
stack_version: "0.21.0"
stack_comparison: https://docs.walt.id/community-vs-enterprise.md
canonical_url: https://docs.walt.id/enterprise-stack/services/key-management-service/overview
generated: 2026-07-20
---
# Overview

The Key Management Service (KMS) is used for creating, storing, and managing cryptographic keys. It is used by
various other services, including:

- The Decentralized Identifier (DID) service, which creates DIDs.
- The Issuer Service, which signs and issues credentials.
- The Verifier Service, which verifies credentials.
- The Credential Status Service, which signs status credentials.

When setting up the KMS, you have the option to choose where to store your keys. You can either use a local key
store, which uses the database of the Enterprise Stack, or you can opt for an external KMS solution, such
as AWS KMS, Azure Key Vault, HashiCorp Vault Transit Secrets Engine, or Oracle KMS. For production use-cases we recommend the usage of an external KMS.

## External KMS Key Type Support

The Enterprise Stack accepts walt.id key type names in `keyType` and maps them to each provider's native key type names
when creating or resolving external KMS keys.

| Backend | Supported `keyType` values | Notes |
|---|---|---|
| `tse` | `Ed25519`, `secp256r1`, `secp384r1`, `secp521r1`, `RSA`, `RSA3072`, `RSA4096` | Uses HashiCorp Vault Transit Secrets Engine. `secp256k1` is not supported by the TSE integration. |
| `aws` / `aws-rest-api` | `secp256r1`, `secp384r1`, `secp521r1`, `secp256k1`, `RSA`, `RSA3072`, `RSA4096` | `Ed25519` is not supported by AWS KMS signing keys. |
| `azure` / `azure-rest-api` | `secp256r1`, `secp384r1`, `secp521r1`, `secp256k1`, `RSA`, `RSA3072`, `RSA4096` | `secp256k1` maps to Azure's `P-256K` curve. `Ed25519` is not supported. |
| `jwk` | `Ed25519`, `secp256k1`, `secp256r1`, `secp384r1`, `secp521r1`, `RSA`, `RSA3072`, `RSA4096` | Keys are generated and stored by the walt.id KMS service. |

**Info:**

Provider support only covers key generation and signing operations that the backing KMS exposes. If a provider rejects a
key type, the API returns an explicit unsupported key type error instead of making a failing provider request.

## Get Started

- [**Local**](https://docs.walt.id/enterprise-stack/services/key-management-service/local.md): Manage and store keys in the Enterprise database.
- [**AWS KMS**](https://docs.walt.id/enterprise-stack/services/key-management-service/aws-kms.md): Connect the service to AWS Key Management Service.
- [**HashiCorp Vault**](https://docs.walt.id/enterprise-stack/services/key-management-service/hashicorp-vault.md): Manage and store keys in HashiCorp Vault.
- [**Azure Key Vault**](https://docs.walt.id/enterprise-stack/services/key-management-service/azure-key-vault.md): Manage and store keys in Azure Key Vault.