Key Manager - Quickstart

Reviewed on August 18, 2025

Scaleway's Key Manager allows you to create key encryption keys from the Scaleway console. Key encryption keys can then be used to encrypt and decrypt your encrypted data.

Before you start

To complete the actions presented below, you must have:

• A Scaleway account logged into the console
• Owner status or IAM permissions allowing you to perform actions in the intended Organization

How to create a Key Manager key

1. Click Key Manager in the Security and Identity section of the Scaleway console side menu.
2. Click + Create key.
3. Choose the region in which you want to create your key.
4. Enter a name, a description, and optional tags for your key.
5. Select the encryption method for your key.
6. Switch the toggle icon icon to disable key protection or leave it enabled.
   Note

   Key protection allows you to protect your key from accidental deletion.

7. Click Create key. Your key's Overview page displays.

How to create and manage a data encryption key (DEK)

1. Click Key Manager in the Security and Identity section of the Scaleway console side menu. Your keys display.

2. Click the key for which to create a data encryption key.

3. Scroll down to the Create data encryption key section.

4. Click Create data encryption key. A pop-up displays with the ciphertext of your DEK.

5. Copy and store your DEK's ciphertext safely.

   Important

   • We recommend that you always store the ciphertext of your data encryption key rather than its plaintext.
   • While Scaleway Key Manager is responsible for generating, encrypting, and decrypting data encryption keys, it does not store, manage, or monitor them, nor does it engage in cryptographic operations with these keys. You must use and manage data encryption keys outside of Key Manager.
   • Read our documentation to understand Key Manager.

6. Optionally, click Display plaintext to make sure that the plaintext does not contain any mistakes.

   What is the difference between ciphertext and plaintext?

   Ciphertext refers to data that has been encrypted using a cryptographic algorithm and a key.

   Plaintext refers to unencrypted, readable data.

7. Click Close.

   Important

   You are responsible for storing your DEKS, as Key Manager does not store them for you.