Key Manager API

Scaleway Key Manager allows you to create, manage, and use cryptographic keys in a centralized and secure service. All your cryptographic operations can be delegated to Key Manager, which in turn ensures the security and availability of your keys.

Key Manager supports the following cryptographic operations: data encryption, data decryption, and data encryption key generation.

Concepts

Refer to our dedicated concepts pageOpen in new context to learn about the different concepts and terms related to Key Manager.

Quickstart

1. Configure your environment variables.

   Note

   This is an optional step that aims to simplify your usage of the API.

   Code
   export SCW_ACCESS_KEY="<API access key>"
   export SCW_SECRET_KEY="<API secret key>"
   export SCW_PROJECT_ID="<Scaleway Project ID>"

2. Create a key. Run the following command to create a key that you can use to encrypt and decrypt your data:

   Code
   curl "https://api.scaleway.com/key-manager/v1alpha1/regions/$REGION/keys" \
     -H "Content-Type: application/json" \
     -H "X-Auth-Token: $SCW_SECRET_KEY" \
     -d '{
       "project_id": "$PROJECT_ID",
       "name": "my-key",
       "usage": {
           "symmetric_encryption": "aes_256_gcm"
       }
      }'

3. Rotate your key. Run the following command to generate a new version of your key. This operation renders your previous key version obsolete.

   Code
   curl "https://api.scaleway.com/key-manager/v1alpha1/regions/$REGION/keys/<KEY_ID>/rotate" \
     -H "X-Auth-Token: $SCW_SECRET_KEY" \
     -d '{
       "key_id": "$KEY_ID"
     }'

4. Encrypt data. Run the following command to encrypt data with the key you have created in step 2:

   Code
   curl "https://api.scaleway.com/key-manager/v1alpha1/regions/$REGION/keys/<KEY_ID>/encrypt" \
     -H "X-Auth-Token: $SCW_SECRET_KEY" \
     -d '{
       "key_id": "$KEY_ID",
       "plaintext": "'"$(echo -n "plaintext-data" | base64)"'"
     }'

5. Generate a data encryption key. Run the following command to generate a data encryption key that you can use for cryptographic operations outside of Key Manager:

   Code
   curl "https://api.scaleway.com/key-manager/v1alpha1/regions/$REGION/keys/<KEY_ID>/generate-data-key" \
     -H "X-Auth-Token: $SCW_SECRET_KEY" \
     -d '{
       "key_id": "$KEY_ID",
       "algorithm": "aes_256_gcm"
     }'

Technical information

Regions

Scaleway's infrastructure spans different regions and Availability ZonesOpen in new context.

Key Manager is available in all regions.

Technical limitations

• While Scaleway Key Manager is responsible for generating, encrypting, and decrypting data encryption keysOpen in new context, it does not store, manage, or monitor them, nor does it engage in cryptographic operations with these keys. You must use and manage data encryption keys outside of Key Manager. Read our security recommendationsOpen in new context to find out about security measures to be aware of while using Key Manager.

Symmetric encryption

• The maximum payload size that can be encrypted is 64 KB of plaintext.
• The maximum payload size that can be decrypted is around 131 KB of data.
• The only symmetric algorithm currently supported by Key Manager is AES-256-GCM.

Asymmetric encryption

Key Manager supports the following asymmetric encryption algorithms:

• RSA-OAEP-2048-SHA256
• RSA-OAEP-3072-SHA256
• RSA-OAEP-4096-SHA256

Asymmetric signing

Key Manager supports the following asymmetric signing algorithms:

• EC-P256-SHA256
• EC-P384-SHA256
• RSA-PSS-2048-SHA256
• RSA-PSS-3072-SHA256
• RSA-PSS-4096-SHA256
• RSA-PKCS1-2048-SHA256
• RSA-PKCS1-3072-SHA256
• RSA-PKCS1-4096-SHA256

Key Encapsulation

Key Manager supports the following key encapsulation algorithms:

• MLKEM-768
• MLKEM-1024

Going further

For more information about Key Manager, you can check out the following pages:

• Key Manager documentationOpen in new context
• Contact our Support teamOpen in new context.