[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M69AQWT0TZEWBZN5JS8WGCBH":3,"skill-same:01M69AQWT0TZEWBZN5JS8WGCBH":84},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":38,"linkOnly":39,"markdownContent":40,"markdownBody":41,"frontMatter":42,"refName":46,"commitSha":47,"skillDirectory":48,"forksCount":49,"repositoryHtmlUrl":50,"repositoryHomepageUrl":51,"ownerHtmlUrl":52,"ownerBlogUrl":53,"ownerDescription":54,"updatedAt":55,"install":56,"resources":69},"01M69AQWT0TZEWBZN5JS8WGCBH","azure-security-keyvault-secrets-java",null,"Azure Key Vault Secrets Java SDK for secret management. Use when storing, retrieving, or managing passwords, API keys, connection strings, or other sensitive configuration data.","microsoft\u002Fskills","microsoft","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F6154722?v=4","01M698VYDXZ6JW5WH3CRV650R8","Microsoft","01M69AJYYW4E1RMSYCQDJ4FJSH",3199,"MIT","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fskills\u002Fblob\u002Fmain\u002F.github\u002Fplugins\u002Fazure-sdk-java\u002Fskills\u002Fazure-security-keyvault-secrets-java\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,9],"security","azure","azure security keyvault secrets java","java","secrets","azure security","when","sdk","secret management","api keys","for","strings","passwords","azure key vault","use","azure-security","api","vault","data","2026-11-10 10:12:30",false,"---\nname: azure-security-keyvault-secrets-java\ndescription: Azure Key Vault Secrets Java SDK for secret management. Use when storing, retrieving, or managing passwords, API keys, connection strings, or other sensitive configuration data.\nlicense: MIT\nmetadata:\n  author: Microsoft\n  version: \"1.0.0\"\n  package: com.azure:azure-security-keyvault-secrets\n---\n\n# Azure Key Vault Secrets (Java)\n\nSecurely store and manage secrets like passwords, API keys, and connection strings.\n\n## Installation\n\n```xml\n\u003Cdependency>\n    \u003CgroupId>com.azure\u003C\u002FgroupId>\n    \u003CartifactId>azure-security-keyvault-secrets\u003C\u002FartifactId>\n    \u003Cversion>4.9.0\u003C\u002Fversion>\n\u003C\u002Fdependency>\n```\n\n## Client Creation\n\n```java\nimport com.azure.core.credential.TokenCredential;\nimport com.azure.identity.AzureIdentityEnvVars;\nimport com.azure.identity.DefaultAzureCredentialBuilder;\nimport com.azure.identity.ManagedIdentityCredentialBuilder;\nimport com.azure.security.keyvault.secrets.SecretClient;\nimport com.azure.security.keyvault.secrets.SecretClientBuilder;\n\n\u002F\u002F Local dev: DefaultAzureCredential. Production: set AZURE_TOKEN_CREDENTIALS=prod or AZURE_TOKEN_CREDENTIALS=\u003Cspecific_credential>\nTokenCredential credential = new DefaultAzureCredentialBuilder()\n    .requireEnvVars(AzureIdentityEnvVars.AZURE_TOKEN_CREDENTIALS)\n    .build();\n\u002F\u002F Or use a specific credential directly in production:\n\u002F\u002F See https:\u002F\u002Flearn.microsoft.com\u002Fjava\u002Fapi\u002Foverview\u002Fazure\u002Fidentity-readme?view=azure-java-stable#credential-classes\n\u002F\u002F TokenCredential credential = new ManagedIdentityCredentialBuilder().build();\n\n\u002F\u002F Sync client\nSecretClient secretClient = new SecretClientBuilder()\n    .vaultUrl(\"https:\u002F\u002F\u003Cvault-name>.vault.azure.net\")\n    .credential(credential)\n    .buildClient();\n\n\u002F\u002F Async client\nSecretAsyncClient secretAsyncClient = new SecretClientBuilder()\n    .vaultUrl(\"https:\u002F\u002F\u003Cvault-name>.vault.azure.net\")\n    .credential(credential)\n    .buildAsyncClient();\n```\n\n## Create\u002FSet Secret\n\n```java\nimport com.azure.security.keyvault.secrets.models.KeyVaultSecret;\n\n\u002F\u002F Simple secret\nKeyVaultSecret secret = secretClient.setSecret(\"database-password\", \"P@ssw0rd123!\");\nSystem.out.println(\"Secret name: \" + secret.getName());\nSystem.out.println(\"Secret ID: \" + secret.getId());\n\n\u002F\u002F Secret with options\nKeyVaultSecret secretWithOptions = secretClient.setSecret(\n    new KeyVaultSecret(\"api-key\", \"sk_live_abc123xyz\")\n        .setProperties(new SecretProperties()\n            .setContentType(\"application\u002Fjson\")\n            .setExpiresOn(OffsetDateTime.now().plusYears(1))\n            .setNotBefore(OffsetDateTime.now())\n            .setEnabled(true)\n            .setTags(Map.of(\n                \"environment\", \"production\",\n                \"service\", \"payment-api\"\n            ))\n        )\n);\n```\n\n## Get Secret\n\n```java\n\u002F\u002F Get latest version\nKeyVaultSecret secret = secretClient.getSecret(\"database-password\");\nString value = secret.getValue();\nSystem.out.println(\"Secret value: \" + value);\n\n\u002F\u002F Get specific version\nKeyVaultSecret specificVersion = secretClient.getSecret(\"database-password\", \"\u003Cversion-id>\");\n\n\u002F\u002F Get only properties (no value)\nSecretProperties props = secretClient.getSecret(\"database-password\").getProperties();\nSystem.out.println(\"Enabled: \" + props.isEnabled());\nSystem.out.println(\"Created: \" + props.getCreatedOn());\n```\n\n## Update Secret Properties\n\n```java\n\u002F\u002F Get secret\nKeyVaultSecret secret = secretClient.getSecret(\"api-key\");\n\n\u002F\u002F Update properties (cannot update value - create new version instead)\nsecret.getProperties()\n    .setEnabled(false)\n    .setExpiresOn(OffsetDateTime.now().plusMonths(6))\n    .setTags(Map.of(\"status\", \"rotating\"));\n\nSecretProperties updated = secretClient.updateSecretProperties(secret.getProperties());\nSystem.out.println(\"Updated: \" + updated.getUpdatedOn());\n```\n\n## List Secrets\n\n```java\nimport com.azure.core.util.paging.PagedIterable;\nimport com.azure.security.keyvault.secrets.models.SecretProperties;\n\n\u002F\u002F List all secrets (properties only, no values)\nfor (SecretProperties secretProps : secretClient.listPropertiesOfSecrets()) {\n    System.out.println(\"Secret: \" + secretProps.getName());\n    System.out.println(\"  Enabled: \" + secretProps.isEnabled());\n    System.out.println(\"  Created: \" + secretProps.getCreatedOn());\n    System.out.println(\"  Content-Type: \" + secretProps.getContentType());\n    \n    \u002F\u002F Get value if needed\n    if (secretProps.isEnabled()) {\n        KeyVaultSecret fullSecret = secretClient.getSecret(secretProps.getName());\n        System.out.println(\"  Value: \" + fullSecret.getValue().substring(0, 5) + \"...\");\n    }\n}\n\n\u002F\u002F List versions of a secret\nfor (SecretProperties version : secretClient.listPropertiesOfSecretVersions(\"database-password\")) {\n    System.out.println(\"Version: \" + version.getVersion());\n    System.out.println(\"Created: \" + version.getCreatedOn());\n    System.out.println(\"Enabled: \" + version.isEnabled());\n}\n```\n\n## Delete Secret\n\n```java\nimport com.azure.core.util.polling.SyncPoller;\nimport com.azure.security.keyvault.secrets.models.DeletedSecret;\n\n\u002F\u002F Begin delete (returns poller for soft-delete enabled vaults)\nSyncPoller\u003CDeletedSecret, Void> deletePoller = secretClient.beginDeleteSecret(\"old-secret\");\n\n\u002F\u002F Wait for deletion\nDeletedSecret deletedSecret = deletePoller.poll().getValue();\nSystem.out.println(\"Deleted on: \" + deletedSecret.getDeletedOn());\nSystem.out.println(\"Scheduled purge: \" + deletedSecret.getScheduledPurgeDate());\n\ndeletePoller.waitForCompletion();\n```\n\n## Recover Deleted Secret\n\n```java\n\u002F\u002F List deleted secrets\nfor (DeletedSecret deleted : secretClient.listDeletedSecrets()) {\n    System.out.println(\"Deleted: \" + deleted.getName());\n    System.out.println(\"Deletion date: \" + deleted.getDeletedOn());\n}\n\n\u002F\u002F Recover deleted secret\nSyncPoller\u003CKeyVaultSecret, Void> recoverPoller = secretClient.beginRecoverDeletedSecret(\"old-secret\");\nrecoverPoller.waitForCompletion();\n\nKeyVaultSecret recovered = recoverPoller.getFinalResult();\nSystem.out.println(\"Recovered: \" + recovered.getName());\n```\n\n## Purge Deleted Secret\n\n```java\n\u002F\u002F Permanently delete (cannot be recovered)\nsecretClient.purgeDeletedSecret(\"old-secret\");\n\n\u002F\u002F Get deleted secret info first\nDeletedSecret deleted = secretClient.getDeletedSecret(\"old-secret\");\nSystem.out.println(\"Will purge: \" + deleted.getName());\nsecretClient.purgeDeletedSecret(\"old-secret\");\n```\n\n## Backup and Restore\n\n```java\n\u002F\u002F Backup secret (all versions)\nbyte[] backup = secretClient.backupSecret(\"important-secret\");\n\n\u002F\u002F Save to file\nFiles.write(Paths.get(\"secret-backup.blob\"), backup);\n\n\u002F\u002F Restore from backup\nbyte[] backupData = Files.readAllBytes(Paths.get(\"secret-backup.blob\"));\nKeyVaultSecret restored = secretClient.restoreSecretBackup(backupData);\nSystem.out.println(\"Restored: \" + restored.getName());\n```\n\n## Async Operations\n\n```java\nSecretAsyncClient asyncClient = new SecretClientBuilder()\n    .vaultUrl(\"https:\u002F\u002F\u003Cvault>.vault.azure.net\")\n    .credential(new DefaultAzureCredentialBuilder().build())\n    .buildAsyncClient();\n\n\u002F\u002F Set secret async\nasyncClient.setSecret(\"async-secret\", \"async-value\")\n    .subscribe(\n        secret -> System.out.println(\"Created: \" + secret.getName()),\n        error -> System.out.println(\"Error: \" + error.getMessage())\n    );\n\n\u002F\u002F Get secret async\nasyncClient.getSecret(\"async-secret\")\n    .subscribe(secret -> System.out.println(\"Value: \" + secret.getValue()));\n\n\u002F\u002F List secrets async\nasyncClient.listPropertiesOfSecrets()\n    .doOnNext(props -> System.out.println(\"Found: \" + props.getName()))\n    .subscribe();\n```\n\n## Configuration Patterns\n\n### Load Multiple Secrets\n\n```java\npublic class ConfigLoader {\n    private final SecretClient client;\n    \n    public ConfigLoader(String vaultUrl) {\n        this.client = new SecretClientBuilder()\n            .vaultUrl(vaultUrl)\n            .credential(new DefaultAzureCredentialBuilder().build())\n            .buildClient();\n    }\n    \n    public Map\u003CString, String> loadSecrets(List\u003CString> secretNames) {\n        Map\u003CString, String> secrets = new HashMap\u003C>();\n        for (String name : secretNames) {\n            try {\n                KeyVaultSecret secret = client.getSecret(name);\n                secrets.put(name, secret.getValue());\n            } catch (ResourceNotFoundException e) {\n                System.out.println(\"Secret not found: \" + name);\n            }\n        }\n        return secrets;\n    }\n}\n\n\u002F\u002F Usage\nConfigLoader loader = new ConfigLoader(\"https:\u002F\u002Fmy-vault.vault.azure.net\");\nMap\u003CString, String> config = loader.loadSecrets(\n    Arrays.asList(\"db-connection-string\", \"api-key\", \"jwt-secret\")\n);\n```\n\n### Secret Rotation Pattern\n\n```java\npublic void rotateSecret(String secretName, String newValue) {\n    \u002F\u002F Get current secret\n    KeyVaultSecret current = secretClient.getSecret(secretName);\n    \n    \u002F\u002F Disable old version\n    current.getProperties().setEnabled(false);\n    secretClient.updateSecretProperties(current.getProperties());\n    \n    \u002F\u002F Create new version with new value\n    KeyVaultSecret newSecret = secretClient.setSecret(secretName, newValue);\n    System.out.println(\"Rotated to version: \" + newSecret.getProperties().getVersion());\n}\n```\n\n## Error Handling\n\n```java\nimport com.azure.core.exception.HttpResponseException;\nimport com.azure.core.exception.ResourceNotFoundException;\n\ntry {\n    KeyVaultSecret secret = secretClient.getSecret(\"my-secret\");\n    System.out.println(\"Value: \" + secret.getValue());\n} catch (ResourceNotFoundException e) {\n    System.out.println(\"Secret not found\");\n} catch (HttpResponseException e) {\n    int status = e.getResponse().getStatusCode();\n    if (status == 403) {\n        System.out.println(\"Access denied - check permissions\");\n    } else if (status == 429) {\n        System.out.println(\"Rate limited - retry later\");\n    } else {\n        System.out.println(\"HTTP error: \" + status);\n    }\n}\n```\n\n## Secret Properties\n\n| Property | Description |\n|----------|-------------|\n| `name` | Secret name |\n| `value` | Secret value (string) |\n| `id` | Full identifier URL |\n| `contentType` | MIME type hint |\n| `enabled` | Whether secret can be retrieved |\n| `notBefore` | Activation time |\n| `expiresOn` | Expiration time |\n| `createdOn` | Creation timestamp |\n| `updatedOn` | Last update timestamp |\n| `recoveryLevel` | Soft-delete recovery level |\n| `tags` | User-defined metadata |\n\n## Environment Variables\n\n```bash\nAZURE_KEYVAULT_URL=https:\u002F\u002F\u003Cvault-name>.vault.azure.net  # Required for vault URL\nAZURE_TOKEN_CREDENTIALS=prod  # Required only if DefaultAzureCredential is used in production\n```\n\n## Best Practices\n\n1. **Enable Soft Delete** - Protects against accidental deletion\n2. **Use Tags** - Tag secrets with environment, service, owner\n3. **Set Expiration** - Use `setExpiresOn()` for credentials that should rotate\n4. **Content Type** - Set `contentType` to indicate format (e.g., `application\u002Fjson`)\n5. **Version Management** - Don't delete old versions immediately during rotation\n6. **Access Logging** - Enable diagnostic logging on Key Vault\n7. **Least Privilege** - Use separate vaults for different environments\n\n## Common Secret Types\n\n```java\n\u002F\u002F Database connection string\nsecretClient.setSecret(new KeyVaultSecret(\"db-connection\", \n    \"Server=myserver.database.windows.net;Database=mydb;...\")\n    .setProperties(new SecretProperties()\n        .setContentType(\"text\u002Fplain\")\n        .setTags(Map.of(\"type\", \"connection-string\"))));\n\n\u002F\u002F API key\nsecretClient.setSecret(new KeyVaultSecret(\"stripe-api-key\", \"sk_live_...\")\n    .setProperties(new SecretProperties()\n        .setContentType(\"text\u002Fplain\")\n        .setExpiresOn(OffsetDateTime.now().plusYears(1))));\n\n\u002F\u002F JSON configuration\nsecretClient.setSecret(new KeyVaultSecret(\"app-config\", \n    \"{\\\"endpoint\\\":\\\"https:\u002F\u002F...\\\",\\\"key\\\":\\\"...\\\"}\")\n    .setProperties(new SecretProperties()\n        .setContentType(\"application\u002Fjson\")));\n\n\u002F\u002F Certificate password\nsecretClient.setSecret(new KeyVaultSecret(\"cert-password\", \"CertP@ss!\")\n    .setProperties(new SecretProperties()\n        .setContentType(\"text\u002Fplain\")\n        .setTags(Map.of(\"certificate\", \"my-cert\"))));\n```\n\n## Trigger Phrases\n\n- \"Key Vault secrets Java\", \"secret management Java\"\n- \"store password\", \"store API key\", \"connection string\"\n- \"retrieve secret\", \"rotate secret\"\n- \"Azure secrets\", \"vault secrets\"\n","# Azure Key Vault Secrets (Java)\n\nSecurely store and manage secrets like passwords, API keys, and connection strings.\n\n## Installation\n\n```xml\n\u003Cdependency>\n    \u003CgroupId>com.azure\u003C\u002FgroupId>\n    \u003CartifactId>azure-security-keyvault-secrets\u003C\u002FartifactId>\n    \u003Cversion>4.9.0\u003C\u002Fversion>\n\u003C\u002Fdependency>\n```\n\n## Client Creation\n\n```java\nimport com.azure.core.credential.TokenCredential;\nimport com.azure.identity.AzureIdentityEnvVars;\nimport com.azure.identity.DefaultAzureCredentialBuilder;\nimport com.azure.identity.ManagedIdentityCredentialBuilder;\nimport com.azure.security.keyvault.secrets.SecretClient;\nimport com.azure.security.keyvault.secrets.SecretClientBuilder;\n\n\u002F\u002F Local dev: DefaultAzureCredential. Production: set AZURE_TOKEN_CREDENTIALS=prod or AZURE_TOKEN_CREDENTIALS=\u003Cspecific_credential>\nTokenCredential credential = new DefaultAzureCredentialBuilder()\n    .requireEnvVars(AzureIdentityEnvVars.AZURE_TOKEN_CREDENTIALS)\n    .build();\n\u002F\u002F Or use a specific credential directly in production:\n\u002F\u002F See https:\u002F\u002Flearn.microsoft.com\u002Fjava\u002Fapi\u002Foverview\u002Fazure\u002Fidentity-readme?view=azure-java-stable#credential-classes\n\u002F\u002F TokenCredential credential = new ManagedIdentityCredentialBuilder().build();\n\n\u002F\u002F Sync client\nSecretClient secretClient = new SecretClientBuilder()\n    .vaultUrl(\"https:\u002F\u002F\u003Cvault-name>.vault.azure.net\")\n    .credential(credential)\n    .buildClient();\n\n\u002F\u002F Async client\nSecretAsyncClient secretAsyncClient = new SecretClientBuilder()\n    .vaultUrl(\"https:\u002F\u002F\u003Cvault-name>.vault.azure.net\")\n    .credential(credential)\n    .buildAsyncClient();\n```\n\n## Create\u002FSet Secret\n\n```java\nimport com.azure.security.keyvault.secrets.models.KeyVaultSecret;\n\n\u002F\u002F Simple secret\nKeyVaultSecret secret = secretClient.setSecret(\"database-password\", \"P@ssw0rd123!\");\nSystem.out.println(\"Secret name: \" + secret.getName());\nSystem.out.println(\"Secret ID: \" + secret.getId());\n\n\u002F\u002F Secret with options\nKeyVaultSecret secretWithOptions = secretClient.setSecret(\n    new KeyVaultSecret(\"api-key\", \"sk_live_abc123xyz\")\n        .setProperties(new SecretProperties()\n            .setContentType(\"application\u002Fjson\")\n            .setExpiresOn(OffsetDateTime.now().plusYears(1))\n            .setNotBefore(OffsetDateTime.now())\n            .setEnabled(true)\n            .setTags(Map.of(\n                \"environment\", \"production\",\n                \"service\", \"payment-api\"\n            ))\n        )\n);\n```\n\n## Get Secret\n\n```java\n\u002F\u002F Get latest version\nKeyVaultSecret secret = secretClient.getSecret(\"database-password\");\nString value = secret.getValue();\nSystem.out.println(\"Secret value: \" + value);\n\n\u002F\u002F Get specific version\nKeyVaultSecret specificVersion = secretClient.getSecret(\"database-password\", \"\u003Cversion-id>\");\n\n\u002F\u002F Get only properties (no value)\nSecretProperties props = secretClient.getSecret(\"database-password\").getProperties();\nSystem.out.println(\"Enabled: \" + props.isEnabled());\nSystem.out.println(\"Created: \" + props.getCreatedOn());\n```\n\n## Update Secret Properties\n\n```java\n\u002F\u002F Get secret\nKeyVaultSecret secret = secretClient.getSecret(\"api-key\");\n\n\u002F\u002F Update properties (cannot update value - create new version instead)\nsecret.getProperties()\n    .setEnabled(false)\n    .setExpiresOn(OffsetDateTime.now().plusMonths(6))\n    .setTags(Map.of(\"status\", \"rotating\"));\n\nSecretProperties updated = secretClient.updateSecretProperties(secret.getProperties());\nSystem.out.println(\"Updated: \" + updated.getUpdatedOn());\n```\n\n## List Secrets\n\n```java\nimport com.azure.core.util.paging.PagedIterable;\nimport com.azure.security.keyvault.secrets.models.SecretProperties;\n\n\u002F\u002F List all secrets (properties only, no values)\nfor (SecretProperties secretProps : secretClient.listPropertiesOfSecrets()) {\n    System.out.println(\"Secret: \" + secretProps.getName());\n    System.out.println(\"  Enabled: \" + secretProps.isEnabled());\n    System.out.println(\"  Created: \" + secretProps.getCreatedOn());\n    System.out.println(\"  Content-Type: \" + secretProps.getContentType());\n    \n    \u002F\u002F Get value if needed\n    if (secretProps.isEnabled()) {\n        KeyVaultSecret fullSecret = secretClient.getSecret(secretProps.getName());\n        System.out.println(\"  Value: \" + fullSecret.getValue().substring(0, 5) + \"...\");\n    }\n}\n\n\u002F\u002F List versions of a secret\nfor (SecretProperties version : secretClient.listPropertiesOfSecretVersions(\"database-password\")) {\n    System.out.println(\"Version: \" + version.getVersion());\n    System.out.println(\"Created: \" + version.getCreatedOn());\n    System.out.println(\"Enabled: \" + version.isEnabled());\n}\n```\n\n## Delete Secret\n\n```java\nimport com.azure.core.util.polling.SyncPoller;\nimport com.azure.security.keyvault.secrets.models.DeletedSecret;\n\n\u002F\u002F Begin delete (returns poller for soft-delete enabled vaults)\nSyncPoller\u003CDeletedSecret, Void> deletePoller = secretClient.beginDeleteSecret(\"old-secret\");\n\n\u002F\u002F Wait for deletion\nDeletedSecret deletedSecret = deletePoller.poll().getValue();\nSystem.out.println(\"Deleted on: \" + deletedSecret.getDeletedOn());\nSystem.out.println(\"Scheduled purge: \" + deletedSecret.getScheduledPurgeDate());\n\ndeletePoller.waitForCompletion();\n```\n\n## Recover Deleted Secret\n\n```java\n\u002F\u002F List deleted secrets\nfor (DeletedSecret deleted : secretClient.listDeletedSecrets()) {\n    System.out.println(\"Deleted: \" + deleted.getName());\n    System.out.println(\"Deletion date: \" + deleted.getDeletedOn());\n}\n\n\u002F\u002F Recover deleted secret\nSyncPoller\u003CKeyVaultSecret, Void> recoverPoller = secretClient.beginRecoverDeletedSecret(\"old-secret\");\nrecoverPoller.waitForCompletion();\n\nKeyVaultSecret recovered = recoverPoller.getFinalResult();\nSystem.out.println(\"Recovered: \" + recovered.getName());\n```\n\n## Purge Deleted Secret\n\n```java\n\u002F\u002F Permanently delete (cannot be recovered)\nsecretClient.purgeDeletedSecret(\"old-secret\");\n\n\u002F\u002F Get deleted secret info first\nDeletedSecret deleted = secretClient.getDeletedSecret(\"old-secret\");\nSystem.out.println(\"Will purge: \" + deleted.getName());\nsecretClient.purgeDeletedSecret(\"old-secret\");\n```\n\n## Backup and Restore\n\n```java\n\u002F\u002F Backup secret (all versions)\nbyte[] backup = secretClient.backupSecret(\"important-secret\");\n\n\u002F\u002F Save to file\nFiles.write(Paths.get(\"secret-backup.blob\"), backup);\n\n\u002F\u002F Restore from backup\nbyte[] backupData = Files.readAllBytes(Paths.get(\"secret-backup.blob\"));\nKeyVaultSecret restored = secretClient.restoreSecretBackup(backupData);\nSystem.out.println(\"Restored: \" + restored.getName());\n```\n\n## Async Operations\n\n```java\nSecretAsyncClient asyncClient = new SecretClientBuilder()\n    .vaultUrl(\"https:\u002F\u002F\u003Cvault>.vault.azure.net\")\n    .credential(new DefaultAzureCredentialBuilder().build())\n    .buildAsyncClient();\n\n\u002F\u002F Set secret async\nasyncClient.setSecret(\"async-secret\", \"async-value\")\n    .subscribe(\n        secret -> System.out.println(\"Created: \" + secret.getName()),\n        error -> System.out.println(\"Error: \" + error.getMessage())\n    );\n\n\u002F\u002F Get secret async\nasyncClient.getSecret(\"async-secret\")\n    .subscribe(secret -> System.out.println(\"Value: \" + secret.getValue()));\n\n\u002F\u002F List secrets async\nasyncClient.listPropertiesOfSecrets()\n    .doOnNext(props -> System.out.println(\"Found: \" + props.getName()))\n    .subscribe();\n```\n\n## Configuration Patterns\n\n### Load Multiple Secrets\n\n```java\npublic class ConfigLoader {\n    private final SecretClient client;\n    \n    public ConfigLoader(String vaultUrl) {\n        this.client = new SecretClientBuilder()\n            .vaultUrl(vaultUrl)\n            .credential(new DefaultAzureCredentialBuilder().build())\n            .buildClient();\n    }\n    \n    public Map\u003CString, String> loadSecrets(List\u003CString> secretNames) {\n        Map\u003CString, String> secrets = new HashMap\u003C>();\n        for (String name : secretNames) {\n            try {\n                KeyVaultSecret secret = client.getSecret(name);\n                secrets.put(name, secret.getValue());\n            } catch (ResourceNotFoundException e) {\n                System.out.println(\"Secret not found: \" + name);\n            }\n        }\n        return secrets;\n    }\n}\n\n\u002F\u002F Usage\nConfigLoader loader = new ConfigLoader(\"https:\u002F\u002Fmy-vault.vault.azure.net\");\nMap\u003CString, String> config = loader.loadSecrets(\n    Arrays.asList(\"db-connection-string\", \"api-key\", \"jwt-secret\")\n);\n```\n\n### Secret Rotation Pattern\n\n```java\npublic void rotateSecret(String secretName, String newValue) {\n    \u002F\u002F Get current secret\n    KeyVaultSecret current = secretClient.getSecret(secretName);\n    \n    \u002F\u002F Disable old version\n    current.getProperties().setEnabled(false);\n    secretClient.updateSecretProperties(current.getProperties());\n    \n    \u002F\u002F Create new version with new value\n    KeyVaultSecret newSecret = secretClient.setSecret(secretName, newValue);\n    System.out.println(\"Rotated to version: \" + newSecret.getProperties().getVersion());\n}\n```\n\n## Error Handling\n\n```java\nimport com.azure.core.exception.HttpResponseException;\nimport com.azure.core.exception.ResourceNotFoundException;\n\ntry {\n    KeyVaultSecret secret = secretClient.getSecret(\"my-secret\");\n    System.out.println(\"Value: \" + secret.getValue());\n} catch (ResourceNotFoundException e) {\n    System.out.println(\"Secret not found\");\n} catch (HttpResponseException e) {\n    int status = e.getResponse().getStatusCode();\n    if (status == 403) {\n        System.out.println(\"Access denied - check permissions\");\n    } else if (status == 429) {\n        System.out.println(\"Rate limited - retry later\");\n    } else {\n        System.out.println(\"HTTP error: \" + status);\n    }\n}\n```\n\n## Secret Properties\n\n| Property | Description |\n|----------|-------------|\n| `name` | Secret name |\n| `value` | Secret value (string) |\n| `id` | Full identifier URL |\n| `contentType` | MIME type hint |\n| `enabled` | Whether secret can be retrieved |\n| `notBefore` | Activation time |\n| `expiresOn` | Expiration time |\n| `createdOn` | Creation timestamp |\n| `updatedOn` | Last update timestamp |\n| `recoveryLevel` | Soft-delete recovery level |\n| `tags` | User-defined metadata |\n\n## Environment Variables\n\n```bash\nAZURE_KEYVAULT_URL=https:\u002F\u002F\u003Cvault-name>.vault.azure.net  # Required for vault URL\nAZURE_TOKEN_CREDENTIALS=prod  # Required only if DefaultAzureCredential is used in production\n```\n\n## Best Practices\n\n1. **Enable Soft Delete** - Protects against accidental deletion\n2. **Use Tags** - Tag secrets with environment, service, owner\n3. **Set Expiration** - Use `setExpiresOn()` for credentials that should rotate\n4. **Content Type** - Set `contentType` to indicate format (e.g., `application\u002Fjson`)\n5. **Version Management** - Don't delete old versions immediately during rotation\n6. **Access Logging** - Enable diagnostic logging on Key Vault\n7. **Least Privilege** - Use separate vaults for different environments\n\n## Common Secret Types\n\n```java\n\u002F\u002F Database connection string\nsecretClient.setSecret(new KeyVaultSecret(\"db-connection\", \n    \"Server=myserver.database.windows.net;Database=mydb;...\")\n    .setProperties(new SecretProperties()\n        .setContentType(\"text\u002Fplain\")\n        .setTags(Map.of(\"type\", \"connection-string\"))));\n\n\u002F\u002F API key\nsecretClient.setSecret(new KeyVaultSecret(\"stripe-api-key\", \"sk_live_...\")\n    .setProperties(new SecretProperties()\n        .setContentType(\"text\u002Fplain\")\n        .setExpiresOn(OffsetDateTime.now().plusYears(1))));\n\n\u002F\u002F JSON configuration\nsecretClient.setSecret(new KeyVaultSecret(\"app-config\", \n    \"{\\\"endpoint\\\":\\\"https:\u002F\u002F...\\\",\\\"key\\\":\\\"...\\\"}\")\n    .setProperties(new SecretProperties()\n        .setContentType(\"application\u002Fjson\")));\n\n\u002F\u002F Certificate password\nsecretClient.setSecret(new KeyVaultSecret(\"cert-password\", \"CertP@ss!\")\n    .setProperties(new SecretProperties()\n        .setContentType(\"text\u002Fplain\")\n        .setTags(Map.of(\"certificate\", \"my-cert\"))));\n```\n\n## Trigger Phrases\n\n- \"Key Vault secrets Java\", \"secret management Java\"\n- \"store password\", \"store API key\", \"connection string\"\n- \"retrieve secret\", \"rotate secret\"\n- \"Azure secrets\", \"vault secrets\"\n",{"name":5,"license":15,"metadata":43,"description":7},{"author":12,"package":44,"version":45},"com.azure:azure-security-keyvault-secrets","1.0.0","main","3f5b461b2314e01c400564051e92469114c5b68f",".github\u002Fplugins\u002Fazure-sdk-java\u002Fskills\u002Fazure-security-keyvault-secrets-java",366,"https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fskills","https:\u002F\u002Fmicrosoft.github.io\u002Fskills\u002F","https:\u002F\u002Fgithub.com\u002Fmicrosoft","https:\u002F\u002Fopensource.microsoft.com","Open source projects and samples from Microsoft","2026-11-13 02:10:26",{"source":8,"skillName":5,"commands":57,"prompt":67,"zipAvailable":68},[58,61,64],{"tool":59,"command":60},"npx","npx skills add microsoft\u002Fskills --skill azure-security-keyvault-secrets-java",{"tool":62,"command":63},"bunx","bunx skills add microsoft\u002Fskills --skill azure-security-keyvault-secrets-java",{"tool":65,"command":66},"pnpm","pnpm dlx skills add microsoft\u002Fskills --skill azure-security-keyvault-secrets-java","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fskills\u002Fblob\u002Fmain\u002F.github\u002Fplugins\u002Fazure-sdk-java\u002Fskills\u002Fazure-security-keyvault-secrets-java\u002FSKILL.md",true,[70,76,80],{"path":71,"resourceType":72,"resourceTypeDesc":73,"sizeBytes":74,"sourceHtmlUrl":75},"references\u002Fexamples.md","REFERENCE","参考文档",12003,"https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fskills\u002Fblob\u002Fmain\u002F.github\u002Fplugins\u002Fazure-sdk-java\u002Fskills\u002Fazure-security-keyvault-secrets-java\u002Freferences\u002Fexamples.md",{"path":77,"resourceType":72,"resourceTypeDesc":73,"sizeBytes":78,"sourceHtmlUrl":79},"references\u002Freport-template.md",13595,"https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fvcpkg\u002Fblob\u002Fmaster\u002F.github\u002Fskills\u002Fanalyze-ci-failures\u002Freferences\u002Freport-template.md",{"path":81,"resourceType":72,"resourceTypeDesc":73,"sizeBytes":82,"sourceHtmlUrl":83},"references\u002Fvcpkg-failure-patterns.md",24513,"https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fvcpkg\u002Fblob\u002Fmaster\u002F.github\u002Fskills\u002Fanalyze-ci-failures\u002Freferences\u002Fvcpkg-failure-patterns.md",[85,111,148,175,195,233],{"skillNo":86,"name":87,"nameZh":6,"description":88,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":89,"categories":90,"keywords":96,"publishedAt":38},"01M69B4JCRQV5SPXAFCKXQRV0H","skill-creator","Guide for creating effective skills for AI coding agents working with Azure SDKs and Microsoft Foundry services. Use when creating new skills or updating existing skills.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fskills\u002Fblob\u002Fmain\u002F.github\u002Fskills\u002Fskill-creator\u002FSKILL.md",[91],{"categoryNo":92,"categoryName":93,"taxonomyType":94,"taxonomyTypeDesc":95},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[97,98,99,9,100,101,102,20,103,104,105,33,106,107,108,29,109,25,110],"skill creator","creator","coding agents","foundry","microsoft foundry","ai coding agents","services","coding","guide","ai coding","with","sdks","Existing","new",{"skillNo":112,"name":113,"nameZh":6,"description":114,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":115,"categories":116,"keywords":127,"publishedAt":38},"01M69B4FD57V1MYKRWAJJECTZ7","podcast-generation","Generate AI-powered podcast-style audio narratives using Azure OpenAI's GPT Realtime Mini model via WebSocket. Use when building text-to-speech features, audio narrative generation, podcast creation from content, or integrating with Azure OpenAI Realtime API for real audio output. Covers full-stack implementation from React frontend to Python FastAPI backend with WebSocket streaming.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fskills\u002Fblob\u002Fmain\u002F.github\u002Fskills\u002Fpodcast-generation\u002FSKILL.md",[117,120,123,126],{"categoryNo":118,"categoryName":119,"taxonomyType":94,"taxonomyTypeDesc":95},"01JBSEEDCAT000000000000009","前端开发",{"categoryNo":121,"categoryName":122,"taxonomyType":94,"taxonomyTypeDesc":95},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":124,"categoryName":125,"taxonomyType":94,"taxonomyTypeDesc":95},"01JBSEEDCAT000000000000016","图像与多媒体",{"categoryNo":92,"categoryName":93,"taxonomyType":94,"taxonomyTypeDesc":95},[128,129,130,131,132,133,134,20,135,136,137,35,138,139,140,141,142,143,144,145,146,25,147],"podcast generation","podcast","generation","frontend","python","react","realtime","azure openai","generate","streaming","Audio","stack","text","model","fastapi","creation","python fastapi","narrative","features","fastapi backend",{"skillNo":149,"name":150,"nameZh":6,"description":151,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":152,"categories":153,"keywords":155,"publishedAt":38},"01M69B4CYPM5SESY5ZWEFDXEQZ","microsoft-docs","Understand Microsoft technologies by querying official documentation. Use whenever the user asks how something works, wants tutorials, needs configuration options, limits, quotas, or best practices for any Microsoft technology (Azure, .NET, M365, Windows, Power Platform, etc.)—even if they don't mention \"docs.\" If the question is about understanding a concept rather than writing code, this is the right skill.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fskills\u002Fblob\u002Fmain\u002F.github\u002Fskills\u002Fmicrosoft-docs\u002FSKILL.md",[154],{"categoryNo":92,"categoryName":93,"taxonomyType":94,"taxonomyTypeDesc":95},[156,9,157,158,159,160,161,162,163,164,165,20,166,167,168,33,169,59,170,171,172,173,174,29],"docs","microsoft docs","MCP","writing","cli","mcp server","windows","power platform","official","documentation","learn","best practices","question","power","back","technology","platform","learn mcp","concept",{"skillNo":176,"name":177,"nameZh":6,"description":178,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":179,"categories":180,"keywords":182,"publishedAt":38},"01M69B49C3YPD1ZJ3NC0HPCY58","mcp-builder","Guide for creating high-quality MCP (Model Context Protocol) servers that enable LLMs to interact with external services through well-designed tools. Use when building MCP servers to integrate external APIs or services, whether in Python (FastMCP), Node\u002FTypeScript (MCP SDK), or C#\u002F.NET (Microsoft MCP SDK).","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fskills\u002Fblob\u002Fmain\u002F.github\u002Fskills\u002Fmcp-builder\u002FSKILL.md",[181],{"categoryNo":92,"categoryName":93,"taxonomyType":94,"taxonomyTypeDesc":95},[158,183,184,185,132,186,26,187,9,188,189,141,190,191,105,33,192,193,194,107,29,25],"mcp builder","builder","typescript","llms","model context protocol","fastmcp","Tools","node","context","integrate","mcp sdk","building mcp servers",{"skillNo":196,"name":197,"nameZh":6,"description":198,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":199,"categories":200,"keywords":213,"publishedAt":38},"01M69B467A7CDMFQ0T6Q0ZA12Q","kql","KQL language expertise for writing correct, efficient Kusto Query Language queries. Covers syntax gotchas, join patterns, dynamic types, datetime pitfalls, regex patterns, serialization, memory management, result-size discipline, and advanced functions (geo, vector, graph). USE THIS SKILL whenever writing, debugging, or reviewing KQL queries — even simple ones — because the gotchas section prevents the most common errors that waste tool calls and cause expensive retry cascades. Trigger on: KQL, Kusto, ADX, Azure Data Explorer, Fabric Real-Time Intelligence, EventHouse, Log Analytics, log analysis, data exploration, time series, anomaly detection, summarize, where clause, join, extend, project, let statement, parse operator, extract function, any mention of pipe-forward query syntax.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fskills\u002Fblob\u002Fmain\u002F.github\u002Fskills\u002Fkql\u002FSKILL.md",[201,204,205,210],{"categoryNo":202,"categoryName":203,"taxonomyType":94,"taxonomyTypeDesc":95},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":92,"categoryName":93,"taxonomyType":94,"taxonomyTypeDesc":95},{"categoryNo":206,"categoryName":207,"taxonomyType":208,"taxonomyTypeDesc":209},"01JBSEEDCAT000000000000033","数据分析师","PROFESSION","适用职业",{"categoryNo":211,"categoryName":212,"taxonomyType":208,"taxonomyTypeDesc":209},"01JBSEEDCAT000000000000036","内容创作者",[197,159,214,215,216,20,217,218,219,220,221,222,223,224,225,226,227,228,229,29,230,231,232],"summarize","memory","analytics","vector","time series","tool","discipline","log","geo","exploration","pipe","time","project","regex","join","datetime","section","anomaly","parse",{"skillNo":234,"name":235,"nameZh":6,"description":236,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":237,"categories":238,"keywords":239,"publishedAt":38},"01M69B44HJQ7897EZ7NE7DWQX3","github-issue-creator","Convert raw notes, error logs, voice dictation, or screenshots into crisp GitHub-flavored markdown issue reports. Use when the user pastes bug info, error messages, or informal descriptions and wants a structured GitHub issue. Supports images\u002FGIFs for visual evidence.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fskills\u002Fblob\u002Fmain\u002F.github\u002Fskills\u002Fgithub-issue-creator\u002FSKILL.md",[],[240,241,242,243,98,244,245,246,247,248,249,250,33,251,252,253,254,255,256,29,25],"github","github issue creator","github issue","issue","issue creator","screenshots","notes","logs","error messages","messages","convert","evidence","reports","images","info","visual","error"]