Skip to main content
Version: v0.25.0 (Latest)

Key Management: Keys

Catalog id: resource.kms.keys

Lists cryptographic key aliases across every runtime provider for the tenant. Operators work with aliases; the opaque kid is on the key detail page. Private material stays in KMS and is never shown in the console.

Whether any keys already appear depends on product onboarding. Some products pre-create aliases for AS, issuer, or verifier; others leave this table empty until an operator generates or imports keys.

Open it​

NavigationResources > Key Management > Keys
Deep link#resource=kms&rarea=keys
ScopePlatform and tenant

Keys list​

Toolbar: search, Import, Generate key. Columns: Alias, Key type, Signature algorithm.

Click a row to open key detail. Use Generate key or Import when the table is empty or you need an additional key.

Lifecycle guide

Key Management Keys list

Generate key​

Opens a dialog from the Keys toolbar.

FieldMeaning
ProviderRuntime provider that will hold the key
AliasHuman name used later in protocols and DID binding
Key type and algorithmFrom that provider’s reported capabilities

Generate keeps private material in KMS and returns metadata (and public JWK over REST when applicable).

Generate key dialog

Import key​

Use when key material was created outside the product. Paste a JWK (kty required). Alias is optional in the dialog; REST carries alias on keyInfo.

Import key dialog

Key detail​

Opened by clicking an alias in the Keys table.

Info tab​

  • Alias, key type, signature algorithm
  • kid with copy
  • Provider association from the list row / API

JWK tab​

Public JWK when the provider exposes it. Empty state if public material is unavailable. Private material is never shown.

Delete​

Header Delete is available when the UI allows it. The server still rejects deletion if the key is assigned or otherwise protected.

Key detail Info and JWK

Providers, Certificates, Keys and DID guide, KMS API