Creating a key

Console
API
CLI
Go

Go to KMS and choose Create Key. Under Key details give it a Name and an optional Description; under Cryptography pick a Key spec and a Key usage.The spec choices are AES-256 symmetric (recommended), RSA-2048 asymmetric, RSA-4096 asymmetric and ECDSA P-256 asymmetric (sign only). Key usage is locked to whatever the chosen spec supports — an RSA spec is the only one that lets you choose between Encrypt / Decrypt and Sign / Verify.

POST https://kms.sa-saopaulo-1.basaltic.sh/v1/keys
{
  "name": "prod-master",
  "key_spec": "aes-256",
  "description": "Master key for the payments data store"
}

basaltic kms key create \
  --name prod-master --key-spec aes-256 \
  --description "Master key for the payments data store"

key, err := kms.New(cfg).CreateKey(ctx, &kms.CreateKeyRequest{
    Name:        "prod-master",
    KeySpec:     "aes-256",
    Description: basaltic.String("Master key for the payments data store"),
})

KMS is regional; a key can only be used from the region it was created in.

The call is synchronous. The response carries the key already in enabled, ready for crypto operations — there is nothing to poll. name is unique per account and lands in the CRN, so it has to be URL-safe: ^[a-zA-Z0-9][a-zA-Z0-9._-]{0,127}$. The name is fixed after creation because IAM policies address the key by its CRN. An update containing name returns a validation error, even when the value is unchanged, empty or null. Existing keys retain their current names. Deleting a key and reusing its name does not preserve the key’s identity or cryptographic material.

Specs and usages

A key is pinned to one usage at creation: either encrypt_decrypt or sign_verify. The spec decides which usages are even possible.

`key_spec`	Can encrypt	Can sign	Default usage
`aes-256`	Yes — AES-GCM	No	`encrypt_decrypt`
`rsa-2048`	Yes — OAEP-SHA256	Yes	none, you must choose
`rsa-4096`	Yes — OAEP-SHA256	Yes	none, you must choose
`ecdsa-p256`	No	Yes — SHA-256	`sign_verify`

Omit key_usage for aes-256 or ecdsa-p256 and the only usage the spec supports is applied. Omit it for an RSA spec and the request is rejected — RSA can do both, so the service will not guess.

An RSA key pinned to encrypt_decrypt refuses sign and verify, and the other way round, even though the algorithm could do either. The refusal is 400 KMS_INVALID_KEY_USAGE. Pick the usage deliberately: neither the spec nor the usage can be changed later, and PATCH /v1/keys/{key_id} only edits description and tags. To change either one, create a new key.

Find a key

Use GET /v1/keys?name=prod-master for an exact, case-sensitive name match within your account, or pass the key’s full CRN as the URL-encoded crn query parameter. These filters combine with state and pagination. A malformed CRN or one for another account, region or resource type returns an empty page.

Get started

Products

Platform

Help

Creating a key

Creating a key

Specs and usages

Find a key

​Creating a key

​Specs and usages

​Find a key

Creating a key

Specs and usages

Find a key