---
title: Key Manager - Quickstart
description: Learn how to quickly set up and manage keys with Scaleway's Key Manager. Follow our step-by-step guide to create and manage keys.
dates:
  validation: 2025-10-30
  posted: 2025-02-06
---
import Requirements from '@macros/iam/requirements.mdx'
import KeyManagerPlaintextVsCiphertext from '@macros/key-manager/plaintext-vs-ciphertext.mdx'


Scaleway's Key Manager allows you to create key encryption keys from the [Scaleway console](https://console.scaleway.com). Key encryption keys can then be used to encrypt and decrypt your encrypted data.

<Requirements />

- A Scaleway account logged into the [console](https://console.scaleway.com)
- [Owner](/iam/concepts/#owner) status or [IAM permissions](/iam/concepts/#permission) allowing you to perform actions in the intended Organization

## Console overview

Discover the Key Manager interface on the Scaleway console.
<GuideFlow src="https://app.guideflow.com/embed/9r25wn4tzr"/>

## How to create a Key Manager key

1. Click Key Manager in the **Security and Identity section** of the [Scaleway console](https://console.scaleway.com) side menu.
2. Click **+ Create key**.
3. Choose the region in which you want to create your key.
4. Enter a name, a description, and optional tags for your key.
5. Select the [encryption method](/key-manager/concepts/#encryption-method) for your key.
6. Switch the <Icon name="toggle" /> icon to disable [key protection](/key-manager/concepts/#key-protection) or leave it enabled.
    <Message type="note">
     Key protection allows you to protect your key from accidental deletion.
    </Message>
7. Click **Create key**. Your key's **Overview** page displays.

## How to create and manage a data encryption key (DEK)

1. Click Key Manager in the **Security and Identity section** of the [Scaleway console](https://console.scaleway.com) side menu. Your keys display.
2. Click the key for which to create a data encryption key.
3. Scroll down to the **Create data encryption key** section.
4. Click **Create data encryption key**. A pop-up displays with the [ciphertext](/key-manager/concepts/#ciphertext) of your DEK.
5. Copy and store your DEK's ciphertext safely.
    <Message type="important">
     - We recommend that you **always store the ciphertext** of your data encryption key rather than its [plaintext](/key-manager/concepts/#plaintext).
     - While Scaleway Key Manager is responsible for generating, encrypting, and decrypting data encryption keys, it does not store, manage, or monitor them, nor does it engage in cryptographic operations with these keys. **You must use and manage data encryption keys outside of Key Manager**.
     - Read our [documentation](/key-manager/reference-content/understanding-key-manager/) to understand Key Manager.
    </Message>
6. Optionally, click **Display plaintext** to make sure that the plaintext does not contain any mistakes.
    <KeyManagerPlaintextVsCiphertext />
7. Click **Close**.

    <Message type="important">
     You are responsible for storing your DEKS, as Key Manager does not store them for you.
    </Message>