Commands

Documentation for `scw keymanager`

The CLI documentation pages are currently under construction

The content is up to date. We're making improvements to the site over the next few weeks for a better experience.

This API allows you to conveniently store and use cryptographic keys.

Key management commands

Keys are logical containers which store cryptographic keys.

Create a key

Create a key in a given region specified by the region parameter. You can use keys to encrypt or decrypt arbitrary payloads, to sign and verify messages or to generate data encryption keys. Data encryption keys are not stored in Key Manager.

Usage:

Code
scw keymanager key create [arg=value ...]

Arguments:

Name	Description	Argument Specifications
project-id	Project ID to use. If none is passed the default project ID will be used
name	(Optional) Name of the key
usage.symmetric-encryption	Encrypt and decrypt arbitrary payloads using a symmetric encryption algorithm.	One of: `unknown_symmetric_encryption`, `aes_256_gcm`
usage.asymmetric-encryption	Encrypt and decrypt arbitrary payloads using an asymmetric encryption algorithm.	One of: `unknown_asymmetric_encryption`, `rsa_oaep_2048_sha256`, `rsa_oaep_3072_sha256`, `rsa_oaep_4096_sha256`
usage.asymmetric-signing	Sign and verify arbitrary messages using an asymmetric signing algorithm.	One of: `unknown_asymmetric_signing`, `ec_p256_sha256`, `ec_p384_sha384`, `rsa_pss_2048_sha256`, `rsa_pss_3072_sha256`, `rsa_pss_4096_sha256`, `rsa_pkcs1_2048_sha256`, `rsa_pkcs1_3072_sha256`, `rsa_pkcs1_4096_sha256`, `ml_dsa_44`, `ml_dsa_65`, `ml_dsa_87`, `ec_secp256k1_sha256`
usage.key-encapsulation	Wrap and unwrap key using a key encapsulation algorithm.	One of: `unknown_key_encapsulation`, `ml_kem_768`, `ml_kem_1024`
description	(Optional) Description of the key
tags.{index}	(Optional) List of the key's tags
rotation-policy.rotation-period	Rotation period
rotation-policy.next-rotation-at	Key next rotation date
unprotected	(Optional) Defines whether key protection is applied to a key. Protected keys can be used but not deleted
origin	Key origin	One of: `unknown_origin`, `scaleway_kms`, `external`
protection-level	Key Protection level	One of: `unknown_protection_level`, `software`, `hsm`
region	Region to target. If none is passed will use default region from the config	Default: `fr-par` One of: `fr-par`, `nl-ams`, `pl-waw`

Decrypt an encrypted payload

Decrypt an encrypted payload using an existing key, specified by the key_id parameter. The maximum payload size that can be decrypted is equivalent to the encrypted output of 64 KB of data (around 131 KB).

Usage:

Code
scw keymanager key decrypt <key-id ...> [arg=value ...]

Arguments:

Name	Description	Argument Specifications
key-id	ID of the key to decrypt with	Required
ciphertext	Base64 Ciphertext data to decrypt	Required
associated-data	(Optional) Additional authenticated data
region	Region to target. If none is passed will use default region from the config	Default: `fr-par` One of: `fr-par`, `nl-ams`, `pl-waw`

Delete a key

Permanently delete a key specified by the region and key_id parameters. This action is irreversible. Any data encrypted with this key, including data encryption keys, will no longer be decipherable.

Usage:

Code
scw keymanager key delete <key-id ...> [arg=value ...]

Arguments:

Name	Description	Argument Specifications
key-id	ID of the key to delete	Required
region	Region to target. If none is passed will use default region from the config	Default: `fr-par` One of: `fr-par`, `nl-ams`, `pl-waw`

Delete key material

Delete previously imported key material. This renders the associated cryptographic key unusable for any operation. The key's origin must be external.

Usage:

Code
scw keymanager key delete-key-material <key-id ...> [arg=value ...]

Arguments:

Name	Description	Argument Specifications
key-id	ID of the key of which to delete the key material	Required
key-rotation-index	(Optional) Rotation index of which to delete the key material
region	Region to target. If none is passed will use default region from the config	Default: `fr-par` One of: `fr-par`, `nl-ams`, `pl-waw`

Disable key

Disable a given key, preventing it to be used for cryptographic operations. Disabling a key renders it unusable. You must specify the region and key_id parameters.

Usage:

Code
scw keymanager key disable <key-id ...> [arg=value ...]

Arguments:

Name	Description	Argument Specifications
key-id	ID of the key to disable	Required
region	Region to target. If none is passed will use default region from the config	Default: `fr-par` One of: `fr-par`, `nl-ams`, `pl-waw`

Enable key

Enable a given key to be used for cryptographic operations. Enabling a key allows you to make a disabled key usable again. You must specify the region and key_id parameters.

Usage:

Code
scw keymanager key enable <key-id ...> [arg=value ...]

Arguments:

Name	Description	Argument Specifications
key-id	ID of the key to enable	Required
region	Region to target. If none is passed will use default region from the config	Default: `fr-par` One of: `fr-par`, `nl-ams`, `pl-waw`

Encrypt a payload

Encrypt a payload using an existing key, specified by the key_id parameter. The maximum payload size that can be encrypted is 64 KB of plaintext.

Usage:

Code
scw keymanager key encrypt <key-id ...> [arg=value ...]

Arguments:

Name	Description	Argument Specifications
key-id	ID of the key to use for encryption	Required
plaintext	Base64 Plaintext data to encrypt	Required
associated-data	(Optional) Additional authenticated data
region	Region to target. If none is passed will use default region from the config	Default: `fr-par` One of: `fr-par`, `nl-ams`, `pl-waw`

Create a data encryption key

Create a new data encryption key for cryptographic operations outside of Key Manager. The data encryption key is encrypted and must be decrypted using the key you have created in Key Manager.

The data encryption key is returned in plaintext and ciphertext but it should only be stored in its encrypted form (ciphertext). Key Manager does not store your data encryption key. To retrieve your key's plaintext, use the Decrypt method with your key's ID and ciphertext.

Usage:

Code
scw keymanager key generate-data-key <key-id ...> [arg=value ...]

Arguments:

Name	Description	Argument Specifications
key-id	ID of the key	Required
algorithm	Algorithm with which the data encryption key will be used to encrypt and decrypt arbitrary payloads	Default: `aes_256_gcm` One of: `unknown_symmetric_encryption`, `aes_256_gcm`
without-plaintext	(Optional) Defines whether to return the data encryption key's plaintext in the response object
region	Region to target. If none is passed will use default region from the config	Default: `fr-par` One of: `fr-par`, `nl-ams`, `pl-waw`

Get key metadata

Retrieve metadata for a specified key using the region and key_id parameters.

Usage:

Code
scw keymanager key get <key-id ...> [arg=value ...]

Arguments:

Name	Description	Argument Specifications
key-id	ID of the key to target	Required
region	Region to target. If none is passed will use default region from the config	Default: `fr-par` One of: `fr-par`, `nl-ams`, `pl-waw`

Import key material

Import externally generated key material into Key Manager to derive a new cryptographic key. The key's origin must be external.

Usage:

Code
scw keymanager key import-key-material <key-id ...> [arg=value ...]

Arguments:

Name	Description	Argument Specifications
key-id	ID of the key in which to import key material	Required
key-material	The key material
salt	(Optional) Salt value to pass the key derivation function
region	Region to target. If none is passed will use default region from the config	Default: `fr-par` One of: `fr-par`, `nl-ams`, `pl-waw`

List keys

Retrieve a list of keys across all Projects in an Organization or within a specific Project. If the user has permissions for all current and future projects: Either organization_id or project_id is required. If the user has permissions for all current projects or only specific projects: The project_id is required. The region parameter in path is needed in both case.

Usage:

Code
scw keymanager key list [arg=value ...]

Arguments:

Name	Description	Argument Specifications
project-id	(Optional) Filter by Project ID
order-by		One of: `name_asc`, `name_desc`, `created_at_asc`, `created_at_desc`, `updated_at_asc`, `updated_at_desc`
tags.{index}	(Optional) List of tags to filter on
name	(Optional) Filter by key name
usage	(Optional) Filter keys by usage.	One of: `unknown_usage`, `symmetric_encryption`, `asymmetric_encryption`, `asymmetric_signing`, `key_encapsulation`
scheduled-for-deletion	Filter keys based on their deletion status. By default, only keys not scheduled for deletion are returned in the output.
protection-level	(Optional) Filter keys by protection level.	One of: `unknown_protection_level`, `software`, `hsm`
organization-id	(Optional) Filter by Organization ID
region	Region to target. If none is passed will use default region from the config	Default: `fr-par` One of: `fr-par`, `nl-ams`, `pl-waw`, `all`

Apply key protection

Apply protection to a given key specified by the key_id parameter. Applying key protection means that your key can be used and modified, but it cannot be deleted.

Usage:

Code
scw keymanager key protect <key-id ...> [arg=value ...]

Arguments:

Name	Description	Argument Specifications
key-id	ID of the key to apply key protection to	Required
region	Region to target. If none is passed will use default region from the config	Default: `fr-par` One of: `fr-par`, `nl-ams`, `pl-waw`

Rotate a key

Generate a new version of an existing key with new key material. Previous key versions remain usable to decrypt previously encrypted data, but the key's new version will be used for subsequent encryption operations and data key generation.

Usage:

Code
scw keymanager key rotate <key-id ...> [arg=value ...]

Arguments:

Name	Description	Argument Specifications
key-id	ID of the key to rotate	Required
region	Region to target. If none is passed will use default region from the config	Default: `fr-par` One of: `fr-par`, `nl-ams`, `pl-waw`

Remove key protection

Remove key protection from a given key specified by the key_id parameter. Removing key protection means that your key can be deleted anytime.

Usage:

Code
scw keymanager key unprotect <key-id ...> [arg=value ...]

Arguments:

Name	Description	Argument Specifications
key-id	ID of the key to remove key protection from	Required
region	Region to target. If none is passed will use default region from the config	Default: `fr-par` One of: `fr-par`, `nl-ams`, `pl-waw`

Update a key

Modify a key's metadata including name, description and tags, specified by the key_id and region parameters.

Usage:

Code
scw keymanager key update <key-id ...> [arg=value ...]

Arguments:

Name	Description	Argument Specifications
key-id	ID of the key to update	Required
name	(Optional) Updated name of the key
description	(Optional) Updated description of the key
tags.{index}	(Optional) Updated list of the key's tags
rotation-policy.rotation-period	Rotation period
rotation-policy.next-rotation-at	Key next rotation date
region	Region to target. If none is passed will use default region from the config	Default: `fr-par` One of: `fr-par`, `nl-ams`, `pl-waw`