Register an existing Azure key (BYOK)
Step 3 of 5 in Connect Azure KMS with BYOK and BYOC.
Check what the provider can do before depending on it. Capabilities list the algorithms and operations the provider supports, which is what issuer and verifier signing settings will require.
Register the key by its provider-native alias on the tenant host. No private material is uploaded.
{
"providerId": "customer-azure-vault",
"alias": "credential-signing-key"
}
Read the key back and compare its algorithm, kid and public JWK with what Azure reports. The
capture reads a key on the tenant's default provider; the response has the same shape for an Azure
reference, with providerId naming the Azure provider and no private members in the JWK.
- Overview
- Request
- Response
Read the key by alias
Endpoint: GET /api/kms/v1/keys/customer-tenant-signing-key
Captured response: 200 OK
This captured endpoint is shown from the E2E run; it is not mapped to one of the generated EDK REST API reference pages.
Connect an environment to rewrite this call to real service bases and run it.
Registering a reference does not add or change Azure tags. When the provider is shared, a key without the tenant tag is refused even though the provider itself is enabled for the tenant.
Next
Continue with step 4, Register the certificate chain (BYOC).