azure-security-keyvault-keys-dotnet

name	azure-security-keyvault-keys-dotnet
description	Azure Key Vault Keys SDK for .NET. Client library for managing cryptographic keys in Azure Key Vault and Managed HSM. Use for key creation, rotation, encryption, decryption, signing, and verification.
type	skill
created	2026-02-27T00:00:00.000Z
domain	cloud-infrastructure
category	azure
risk	unknown
source	community
tags	["skill","cloud-infrastructure","azure","security","keyvault"]

Azure.Security.KeyVault.Keys (.NET)

Client library for managing cryptographic keys in Azure Key Vault and Managed HSM.

Installation

dotnet add package Azure.Security.KeyVault.Keys
dotnet add package Azure.Identity

Current Version: 4.7.0 (stable)

Environment Variables

KEY_VAULT_NAME=<your-key-vault-name>
# Or full URI
AZURE_KEYVAULT_URL=https://<vault-name>.vault.azure.net

Client Hierarchy

KeyClient (key management)
├── CreateKey / CreateRsaKey / CreateEcKey
├── GetKey / GetKeys
├── UpdateKeyProperties
├── DeleteKey / PurgeDeletedKey
├── BackupKey / RestoreKey
└── GetCryptographyClient() → CryptographyClient

CryptographyClient (cryptographic operations)
├── Encrypt / Decrypt
├── WrapKey / UnwrapKey
├── Sign / Verify
└── SignData / VerifyData

KeyResolver (key resolution)
└── Resolve(keyId) → CryptographyClient

Authentication

DefaultAzureCredential (Recommended)

using Azure.Identity;
using Azure.Security.KeyVault.Keys;

var keyVaultName = Environment.GetEnvironmentVariable("KEY_VAULT_NAME");
var kvUri = $"https://{keyVaultName}.vault.azure.net";

var client = new KeyClient(new Uri(kvUri), new DefaultAzureCredential());

Service Principal

var credential = new ClientSecretCredential(
    tenantId: "<tenant-id>",
    clientId: "<client-id>",
    clientSecret: "<client-secret>");

var client = new KeyClient(new Uri(kvUri), credential);

Key Management

Create Keys

// Create RSA key
KeyVaultKey rsaKey = await client.CreateKeyAsync("my-rsa-key", KeyType.Rsa);
Console.WriteLine();


 rsaOptions =  CreateRsaKeyOptions()
{
    KeySize = ,
    HardwareProtected = , 
    ExpiresOn = DateTimeOffset.UtcNow.AddYears(),
    NotBefore = DateTimeOffset.UtcNow,
    Enabled = 
};
rsaOptions.KeyOperations.Add(KeyOperation.Encrypt);
rsaOptions.KeyOperations.Add(KeyOperation.Decrypt);

KeyVaultKey rsaKey2 =  client.CreateRsaKeyAsync(rsaOptions);


 ecOptions =  CreateEcKeyOptions()
{
    CurveName = KeyCurveName.P256,
    HardwareProtected =  
};
KeyVaultKey ecKey =  client.CreateEcKeyAsync(ecOptions);


 octOptions =  CreateOctKeyOptions()
{
    KeySize = ,
    HardwareProtected = 
};
KeyVaultKey octKey =  client.CreateOctKeyAsync(octOptions);